Adware.Gexin.21158

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) up####.sdk.jig####.cn:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(TLS/1.0) wmn.1####.com:443
TCP(TLS/1.0) qy-swa####.qi####.com:443
TCP(TLS/1.0) s####.j####.cn:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.2) 74.1####.131.101:443
TCP(TLS/1.2) 74.1####.205.95:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP 1####.230.236.35:7006
UDP s.j####.cn:19000

DNS requests:

and####.google####.com
android####.go####.com
instant####.google####.com
log.u####.com
md####.google####.com
p####.google####.com
pv.s####.com
qy-swa####.qi####.com
s####.j####.cn
s####.u####.com
s####.u####.com.####.8
s.j####.cn
up####.sdk.jig####.cn
wmn.1####.com
www.google####.com

HTTP GET requests:

gd.a.s####.com/cityjson?ie=####

HTTP POST requests:

up####.sdk.jig####.cn/v1/push/sdk/postlist

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/1621582810346.log
/data/data/####/JPushSA_Config.xml
/data/data/####/JPushSA_Config.xml.bak
/data/data/####/NYAPP.xml
/data/data/####/QALConfigStore.dat
/data/data/####/TLS_DEVICE_INFO.xml
/data/data/####/TLS_DEVICE_INFO.xml.bak
/data/data/####/WLOGIN_DEVICE_INFO.xml
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/classes3.dex
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.android.user.profile.xml.bak
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/cn.jpush.preferences.v2.xml.bak
/data/data/####/com.qiyukf.analytics.xml
/data/data/####/com.qiyukf.analytics.xml.bak
/data/data/####/device_id.xml.xml
/data/data/####/imei
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/jg_so_upgrade_setting.xml.bak
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_local_notification.db
/data/data/####/jpush_local_notification.db-journal
/data/data/####/jpush_local_notification.db-journal (deleted)
/data/data/####/jpush_local_notification.db-wal
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jpush_statistics.db
/data/data/####/jpush_statistics.db-journal
/data/data/####/jpush_statistics.db-journal (deleted)
/data/data/####/jpush_statistics.db-shm (deleted)
/data/data/####/jpush_statistics.db-wal
/data/data/####/jpush_statistics.db-wal (deleted)
/data/data/####/libjiagu.so
/data/data/####/mutex
/data/data/####/proc_auxv
/data/data/####/qiyu_save_600d23d5f06978a80d41f9d4cf3ae394.xml
/data/data/####/report_v5.msgstore-journal
/data/data/####/report_v5.msgstore-journal (deleted)
/data/data/####/tls_device.dat
/data/data/####/umeng_socialize.xml
/data/data/####/unicorn#cheese#
/data/data/####/wlogin_device.dat
/data/media/####/.nomedia
/data/media/####/app.21.05.21.10.log
/data/media/####/imsdk_20210521.log
/data/media/####/sdk.21.05.21.10.log
/data/media/####/tmp_c_20210521
/data/media/####/tmp_u_20210521
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes2.dex --dex-file=<Package Folder>/.jiagu/classes3.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so

Uses the following algorithms to encrypt data: