Adware.Gexin.21

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.1.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 1####.205.203.105:8019
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(TLS/1.0) m1.pinzh####.com:443
TCP(TLS/1.0) img.pinzh####.com:443

Запросы DNS:

a####.m.ta####.com
a####.u####.com
ag####.m.ta####.com
api.m.ta####.com
img.pinzh####.com
m1.pinzh####.com
msg.umengc####.com

Запросы HTTP GET:

api.m.ta####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####...
api.m.ta####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&a...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=#...
api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...

Запросы HTTP POST:

a####.u####.com/app_logs
msg.umengc####.com/v2/register

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/cache/####/0d3c853ba1f054ad8e348f26774d880c3a6....0.tmp
<Package Folder>/cache/####/102eebbe065286e02fd16b2606b437eee10....0.tmp
<Package Folder>/cache/####/1dbf40b92bf72a6ad5658ce886157d85433....0.tmp
<Package Folder>/cache/####/23fc22bd6f7dbf89a0c8a376326e2ee2da6....0.tmp
<Package Folder>/cache/####/2abb06f4fd42954c25259384d6e595c69a2....0.tmp
<Package Folder>/cache/####/3a98881d569d41eed718e9518bd38bb296b....0.tmp
<Package Folder>/cache/####/4b25b3b4ae6e57eff92a587e343908cd10c....0.tmp
<Package Folder>/cache/####/54104b324a855350af2b0fcb96fc8568a37....0.tmp
<Package Folder>/cache/####/5f12e481760ed22e0da60c9f0031a9bdf92....0.tmp
<Package Folder>/cache/####/63ff7d2de3e8af08da987ee82a518bfb279....0.tmp
<Package Folder>/cache/####/720aa2d736172b43180188c0b7809505c43....0.tmp
<Package Folder>/cache/####/7f57b8d19f120776ec1284e4d5c58b5485d....0.tmp
<Package Folder>/cache/####/8e8541604d6a0c42f52d18a4e318b6a104c....0.tmp
<Package Folder>/cache/####/91f28d5ecf53cacb9dae6100d425f452d7c....0.tmp
<Package Folder>/cache/####/99d5276e9330eb0ff8e738cda3b2a170a0b....0.tmp
<Package Folder>/cache/####/a7564a9f5e51d293eb44c83cfa8aff4e11e....0.tmp
<Package Folder>/cache/####/ad9f775862f8462af19c97d63bcf3165804....0.tmp
<Package Folder>/cache/####/b9bd28eccfacc28a3b7a54cf3bde732aef2....0.tmp
<Package Folder>/cache/####/c4c8b93546518306e8cb56472779fe49fce....0.tmp
<Package Folder>/cache/####/eb6bfa72888d9b90e9ddcb4bd650316406c....0.tmp
<Package Folder>/cache/####/ffe924333e9d55c99594e92f52e07384ebe....0.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/UmengLocalNotificationStore.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.imprint
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/exid.dat
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/AGOO_CONNECT.xml
<Package Folder>/shared_prefs/AGOO_HOST.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppStore.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/PhoneUtil.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_message_state.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.umeng.message.UmengService --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_android_daemon_1.1.0 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5279b36856240bf5740885c0","utdid":"Wg2FJevFUxwDAGdzx1EBUM5G","sdkVersion":"20160215"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu.so
sh

Загружает динамические библиотеки: