Adware.Gexin.21119

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) s####.zqf.com.cn:80
TCP(HTTP/1.1) c####.zqf.com.cn:80
TCP(HTTP/1.1) i.t####.com:80
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) 1####.217.17.42:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) s####.zqf.com.cn:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) app-ro####.leanc####.cn:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.217.17.42:443
TCP(TLS/1.2) 1####.250.179.163:443
TCP(TLS/1.2) 2####.58.214.14:443

DNS requests:

and####.google####.com
android####.go####.com
app-ro####.leanc####.cn
app-ro####.leanc####.cn.####.8
av1.x####.com
biz.q####.com
c####.x####.com
c####.x####.com
c####.zqf.com.cn
i.t####.com
instant####.google####.com
mcap####.zqf.com.cn
md####.google####.com
p####.google####.com
s####.zqf.com.cn
www.gst####.com

HTTP GET requests:

c####.zqf.com.cn/v4/Api/kbspirit?type=####&market=####&count=####&output...
i.t####.com/a/3ecf82f3930e0f2fca8c3019af489a072
s####.zqf.com.cn/Api/Quote/Index?output=####&obj=####&subcode=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/1619890541374_3413
/data/data/####/1619890551577_3588
/data/data/####/1619890552751_3588
/data/data/####/1619890553121_3588
/data/data/####/1619890558005_3588
/data/data/####/1619890558650_3588
/data/data/####/1619890558924_3588
/data/data/####/1619890559214_3588
/data/data/####/AV_CLOUD_API_VERSION_KEY_ZONE.xml
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/Hawk2.xml
/data/data/####/Pythagoras_phase.xml
/data/data/####/Pythagoras_phase.xml.bak
/data/data/####/TDCloudSettingsConfigC654CB226C9748B1AACEE26F39...ml.bak
/data/data/####/TDCloudSettingsConfigC654CB226C9748B1AACEE26F3920C085.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_cloudcontrol1.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_longtime0.xml.bak
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml.bak
/data/data/####/TDpref_shorttime0.xml
/data/data/####/TalingDataConfigC654CB226C9748B1AACEE26F3920C085.xml
/data/data/####/access_control.control.mx
/data/data/####/access_control.write.mx
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/classes3.dex
/data/data/####/classes4.dex
/data/data/####/classes5.dex
/data/data/####/com.avos.avoscloud.RequestStatisticsUtil.data.xml
/data/data/####/com.qktz.qkz_preferences.xml
/data/data/####/com.qktz.qkz_preferences.xml.bak
/data/data/####/crypto.KEY_256.xml
/data/data/####/default.realm
/data/data/####/default.realm.lock
/data/data/####/libjiagu.so
/data/data/####/mPBE.xml
/data/data/####/proc_auxv
/data/data/####/tdid.xml
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes2.dex --dex-file=<Package Folder>/.jiagu/classes3.dex --dex-file=<Package Folder>/.jiagu/classes4.dex --dex-file=<Package Folder>/.jiagu/classes5.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop

Uses the following algorithms to encrypt data: