Adware.Gexin.254

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) i.t####.com:80
TCP(HTTP/1.1) oss-pic####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) mo####.b####.com:80
TCP(HTTP/1.1) s####.s.360.cn:80
TCP(HTTP/1.1) qos.l####.360.cn:80
TCP(HTTP/1.1) api.zantou####.com:80
TCP(HTTP/1.1) ope.zantou####.com:80
TCP(HTTP/1.1) ope####.k.36####.com:80
TCP(HTTP/1.1) diandit####.com:8080
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
TCP(HTTP/1.1) cn-hang####.oss####.aliyun####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) sdk.l####.360.cn:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) s####.l####.360.####.com:80
TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
TCP(TLS/1.0) t####.me####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) sh####.me####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) sdkc####.e.360.cn:443
TCP c####.g####.ig####.com:5224
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
api.zantou####.com
av1.x####.com
c####.g####.ig####.com
c####.g####.ig####.com
c####.x####.com
c-h####.g####.com
cn-hang####.oss####.aliyun####.com
diandit####.com
i.t####.com
log.u####.com
mo####.b####.com
mobads-####.b####.com
ope####.k.36####.com
ope.zantou####.com
oss-pic####.oss-cn-####.aliy####.com
plb####.u####.com
qos.l####.360.cn
res####.a####.com
s####.l####.360.cn
s####.s.360.cn
sdk####.l####.360.cn
sdk.c####.ig####.com
sdk.l####.360.cn
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sdkc####.e.360.cn
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
sh####.me####.com
t####.me####.com
u####.u####.com

Запросы HTTP GET:

api.zantou####.com/dot-app-api/api/advertisement/tabActivity?locationId=...
api.zantou####.com/dot-app-api/api/blacklist
api.zantou####.com/dot-app-api/api/content/article/recommend/549?timesta...
api.zantou####.com/dot-app-api/api/content/article/recommend/550?timesta...
api.zantou####.com/dot-app-api/api/content/article/recommend/553?timesta...
api.zantou####.com/dot-app-api/api/device/version?bundleId=####&platform...
api.zantou####.com/dot-app-api/api/discovery/banner?timestamp=####
api.zantou####.com/dot-app-api/api/discovery/local/news?timestamp=####&t...
api.zantou####.com/dot-app-api/api/discovery/weather/citys?timestamp=####
api.zantou####.com/dot-app-api/api/task/sign/hour?timestamp=####&token=#...
api.zantou####.com/dot-app-api/api/tools/weather/city?params=####&aos=s9...
api.zantou####.com/dot-app-api/api/user/message/mark?timestamp=####&toke...
api.zantou####.com/dot-app-api/api/v1/video/category?timestamp=####&chan...
api.zantou####.com/dot-app-api/api/v1_3/article/category?timestamp=####&...
cn-hang####.oss####.aliyun####.com/amap-api/comm/upload/CoordinateSoEnhe...
diandit####.com:8080/img/a429c8c68c8f42be80348a7e1d22b452_banner.jpg
i.t####.com/a/3c1e0985093cceca4f16f5f8da551f103
mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7054.jar
mo####.b####.com/cpro/ui/mads.php?code2=####&b1531834294768=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1531834298207=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1531834298218=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1531834298228=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1531834298241=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1531834298253=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1531834298263=####
ope####.k.36####.com/api/sdk/channel?m2=####&appid=####&m=####&ch=####&v...
ope.zantou####.com/img/1531208729684.png
oss-pic####.oss-cn-####.aliy####.com/4b7b7df6-893d-11e8-94f6-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/51e685c4-7b95-11e8-95b4-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/520143aa-7b95-11e8-95b4-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/520edc68-7b95-11e8-95b4-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/57843b56-76af-11e8-9817-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/5793ebf0-76af-11e8-9817-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/57aac7d0-76af-11e8-9817-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/6529a47c-72c1-11e8-b2a3-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/6543753c-72c1-11e8-b2a3-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/6556897e-72c1-11e8-b2a3-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/66ecbefe-892b-11e8-ac27-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/78620932-8949-11e8-81c8-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/7bdc6994-88eb-11e8-8a87-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/7c0728b4-88eb-11e8-8a87-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/7c37ba88-88eb-11e8-8a87-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/9288bd40-866c-11e8-a950-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/92fd3774-866c-11e8-a950-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/931fe13e-866c-11e8-a950-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/bb77dafa-7394-11e8-8dc2-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/bb8c633a-7394-11e8-8dc2-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/bbabcf18-7394-11e8-8dc2-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/d28d3fda-868d-11e8-8d0f-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/d297fc40-868d-11e8-8d0f-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/d2af09a8-868d-11e8-8d0f-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/d50fa6b6-88d2-11e8-93c1-00163e0850f...
oss-pic####.oss-cn-####.aliy####.com/e5717fa8-893f-11e8-ac62-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/f0f350ae-8917-11e8-8217-00163e08345...
qos.l####.360.cn/vc.gif?&bid=####&pid=####&ver=####&c_ver=####&os=####&m...
s####.l####.360.####.com/Object.getFile/livecloudsdk/YW5kcm9pZF9wbHVnaW5...
s####.s.360.cn/ak/2e65f2f2fdaf6c699b223c61b1b5ab89.html?m2=####
sdk.l####.360.cn/codec?os=####&tm=####&model=####&r=####&package=####&pi...
sdk.l####.360.cn/qvideo_sdk_and_android_134.conf?os=####&tm=####&r=####&...
sdk.l####.360.cn/rtc?os=####&tm=####&model=####&r=####&package=####&pid=...
sf3-ttc####.ps####.com/obj/ad.union.api/0c1dabcb5fc20299c55d7038b79d3643
sf6-ttc####.ps####.com.####.com/obj/ad.union.api/1e3eb469e7d6b20fa77a6fa...
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_YYn966
sni.c####.q####.####.net/tdata_eOt091

Запросы HTTP POST:

api.zantou####.com/dot-app-api/api/user/recordUser
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1531834292829_2088
/data/data/####/1531834293362_2088
/data/data/####/1531834294989_2088
/data/data/####/1531834295370_2088
/data/data/####/1531834296097_2088
/data/data/####/1531834296522_2194
/data/data/####/1531834297238_2088
/data/data/####/1531834298659_2088
/data/data/####/1531834299481_2194
/data/data/####/1531834300821_2194
/data/data/####/1531834304444_2194
/data/data/####/1531834315504_2491
/data/data/####/1531834316784_2491
/data/data/####/1531834319211_2491
/data/data/####/1531834346640_2088
/data/data/####/1531834347113_2088
/data/data/####/1531834347278_2088
/data/data/####/1531834347437_2088
/data/data/####/1531834348957_2088
/data/data/####/1531834357978_2088
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/206affefb82125c909e3efb19a925e0756ac232a614db06....0.tmp
/data/data/####/242fb2888aa814a72ba672fe6dfc12748c8834a4d58863d....0.tmp
/data/data/####/345fff0c4e8e12350554d205b31e94d82fe69ba0ff26d2e....0.tmp
/data/data/####/40ca8466bf3027a917a40c8d3e95cecbe634e33633e3b60....0.tmp
/data/data/####/46c5cf362abe1a4ed12080dfd3d3dc930be4e9fc0d4e042....0.tmp
/data/data/####/47b703fbc7974e44366386678290326546e101ec471aa27....0.tmp
/data/data/####/4c40a4b6bbdd614793cfe5fbb20f5f25d3407d5deecea4d....0.tmp
/data/data/####/50e638e59e67f904e0608400c27cc80d834f012a3f01b5b....0.tmp
/data/data/####/51210439256acc74ca0a90a531081dab4d4722d62773d44....0.tmp
/data/data/####/58d8d36e617c5d25131b357097a17aa617a7975b00a879b....0.tmp
/data/data/####/5cfcea726cbe0f0685cf4c372c01cfd8748d57a5bdaa136....0.tmp
/data/data/####/6bf9c6e0cc6a6b166e9e193209fb88ef1a6e868860daaea....0.tmp
/data/data/####/74047682a53dba24fb31ce7858ac8c3b71e2757989d917d....0.tmp
/data/data/####/784281b4ad61272296b31cda4baaf281dfa074541e48779....0.tmp
/data/data/####/785edb5433112323878631b9c6301a3ba4d33d87e28861e....0.tmp
/data/data/####/9939441b3bc7cde156d00e603def50cd6599c1191a9f1c2....0.tmp
/data/data/####/9a1f0b83375b4de20afa8aba787fb1b080f59dbc9093f2b....0.tmp
/data/data/####/AKDownload.db
/data/data/####/AKDownload.db-journal
/data/data/####/Alvin2.xml
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/ContextData.xml
/data/data/####/MultiDex.lock
/data/data/####/QH_DeviceSDK.xml
/data/data/####/QH_SDK_M2.xml
/data/data/####/QH_SDK_UserData2e65f2f2fdaf6c699b223c61b1b5ab89.xml
/data/data/####/TAB_CACHE.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__94c62af5-81b7-49cc-84f...91.jar
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__builtinversion__.jar
/data/data/####/__xadsdk__remote__final__running__.jar
/data/data/####/__xadsdk_downloaded__version__.xml
/data/data/####/a0fa82b5e0a1b0bd532f0ff9346d85e3aa30fa4669e83ab....0.tmp
/data/data/####/a2d6aea34422914de40810f9c6a51dbd0f568c751a96473....0.tmp
/data/data/####/a9aaeea4591cc8caa85384d2a8d51b9d1285b5bf18fcf35....0.tmp
/data/data/####/a==7.5.0&&1.3.4_1531834295040_envelope.log
/data/data/####/adf93c2b10909425030f80fcc03b66d4f3f9f7ded3ec58b....0.tmp
/data/data/####/app_globel_config_file.xml
/data/data/####/b8fa3948799cddfe49d48a5415a99eaf81ea68a232a4037....0.tmp
/data/data/####/bd9210c0b53dbca47184b4a8105e2d78a950834c40d8865....0.tmp
/data/data/####/caeba732b6b7731057dfe50e007f99316ff66280816189f....0.tmp
/data/data/####/cba4ab46d61315703febd088b4203a8f0606e226c8b2e59....0.tmp
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/com.diandi.app_preferences.xml
/data/data/####/com.qihoo.livecloud.settings.GPWebrtcSettings.pref.xml
/data/data/####/d567ea0a7a0f582442613f09849358df241bc1fe12c7549....0.tmp
/data/data/####/dec17b361979d4a0ee1b0ef4ae880207eb7d5aeb5725a9e....0.tmp
/data/data/####/diandi.db
/data/data/####/diandi.db-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/ea0831b2b7081e67a58d545c40ea26cabcc2c50735d641c....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f043197d60ae3ed885cd67ae10472f83360d03cf16ba0e7....0.tmp
/data/data/####/finalcore.jar
/data/data/####/getui_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/i==1.2.0&&1.3.4_1531834292350_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/is.xml
/data/data/####/iv
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/libdvrender.so.tmp
/data/data/####/libjiagu195634731.so
/data/data/####/libjplayer.so.tmp
/data/data/####/liblocalserver.so.tmp
/data/data/####/libmyssl.so.1.1.tmp
/data/data/####/libtranscore.so.tmp
/data/data/####/libviewer.so.tmp
/data/data/####/libwgs2gcj.so
/data/data/####/localserver_2.0.3.18042602.zip
/data/data/####/localserver_2.0.3.18042602.zip (deleted)
/data/data/####/locker
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/multidex.version.xml
/data/data/####/new_sp.xml
/data/data/####/player_2.0.3.18051401.zip
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qhvc_plugin.xml
/data/data/####/run.pid
/data/data/####/salt
/data/data/####/sdk_config.xml
/data/data/####/share.db-journal
/data/data/####/share_data.xml
/data/data/####/slldate.xml
/data/data/####/sp.livecloud.database.xml
/data/data/####/tdata_YYn966
/data/data/####/tdata_eOt091
/data/data/####/tdid.xml
/data/data/####/tools_2.0.3.18051401.zip
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/weixinfull.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.deviceId
/data/media/####/.nomedia
/data/media/####/.sfp
/data/media/####/.tcookieid
/data/media/####/.testf
/data/media/####/.umm.dat
/data/media/####/1531834294383.db
/data/media/####/2NY
/data/media/####/2NY (deleted)
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/__VERSION__
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/app.db
/data/media/####/com.diandi.app.bin
/data/media/####/com.diandi.app.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/hkaw7jG225OoegHXS_QUF0cBWBI.-626611521.tmp
/data/media/####/mjSrH-nitSENEHwjQdVdauYrIEo.-626611521.tmp
/data/media/####/tdata_YYn966
/data/media/####/tdata_eOt091

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
app_process /system/bin com.android.commands.pm.Pm list package -3
chmod 755 <Package Folder>/.jiagu/libjiagu195634731.so
getprop
ls -l /system/bin/su
ls /
ls /sys/class/thermal
pm list package -3

Загружает динамические библиотеки:

getuiext2
libdvrender
libimagepipeline
libjiagu195634731
libjplayer
liblocalserver
libtranscore
libviewer

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней