Adware.Gexin.887

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) i.t####.com:80
TCP(HTTP/1.1) oss-pic####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) s####.s.360.cn:80
TCP(HTTP/1.1) qos.l####.360.cn:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) api.zantou####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) ope.zantou####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
TCP(HTTP/1.1) cn-hang####.oss####.aliyun####.com:80
TCP(HTTP/1.1) cloud####.fengkon####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) sdk.l####.360.cn:80
TCP(HTTP/1.1) ip.ch####.com:80
TCP(HTTP/1.1) s####.l####.360.####.com:80
TCP(HTTP/1.1) mo####.b####.com:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(HTTP/1.1) p5.q####.com:80
TCP(TLS/1.0) t####.me####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) sh####.me####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) openins####.io:443
TCP(TLS/1.0) sdkc####.e.360.cn:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

Запросы DNS:

api.zantou####.com
av1.x####.com
c####.g####.ig####.com
c####.x####.com
c-h####.g####.com
cloud####.fengkon####.com
cn-hang####.oss####.aliyun####.com
f####.fengkon####.com
i.t####.com
ip.ch####.com
log.u####.com
mo####.b####.com
mobads-####.b####.com
ope.zantou####.com
openins####.io
oss-pic####.oss-cn-####.aliy####.com
p5.q####.com
plb####.u####.com
pub-####.qin####.com
qos.l####.360.cn
res####.a####.com
s####.l####.360.cn
s####.s.360.cn
sdk.c####.ig####.com
sdk.l####.360.cn
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sdkc####.e.360.cn
sf3-ttc####.ps####.com
sh####.me####.com
t####.me####.com
u####.u####.com

Запросы HTTP GET:

api.zantou####.com/dot-app-api/api/blacklist
api.zantou####.com/dot-app-api/api/content/article/recommend/0?toUp=####...
api.zantou####.com/dot-app-api/api/device/version?bundleId=####&platform...
api.zantou####.com/dot-app-api/api/task/sign/hour?timestamp=####&token=#...
api.zantou####.com/dot-app-api/api/user/message/mark?timestamp=####&toke...
api.zantou####.com/dot-app-api/api/v1_3/article/category?type=####&times...
cn-hang####.oss####.aliyun####.com/amap-api/comm/upload/CoordinateSoEnhe...
i.t####.com/a/3c1e0985093cceca4f16f5f8da551f103
ip.ch####.com/getip.aspx
mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7055.jar
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246467148=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476432=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476472=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476473=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476474=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476475=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476476=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476478=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476479=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476480=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476481=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476482=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476483=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1533246476486=####
ope.zantou####.com/img/1533018183782.jpg
ope.zantou####.com/img/1533018188398.jpg
oss-pic####.oss-cn-####.aliy####.com/06debe1e-93d4-11e8-81be-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/0722877a-93d4-11e8-81be-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/075fbece-93d4-11e8-81be-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/196b1270-95dd-11e8-b793-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/19aefa44-95dd-11e8-b793-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/19d86956-95dd-11e8-b793-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/2513a6d0-9567-11e8-8f28-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/2521033e-9567-11e8-8f28-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/2530196e-9567-11e8-8f28-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/7346ed02-9545-11e8-b9c8-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/73c4450e-9545-11e8-b9c8-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/73e7dabe-9545-11e8-b9c8-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/a885519a-95c5-11e8-8c34-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/a8d88496-95c5-11e8-8c34-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/a8f79d0e-95c5-11e8-8c34-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/f1f2b8e4-9580-11e8-9876-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/f88d3c3e-95d9-11e8-89c4-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/f8af95ae-95d9-11e8-89c4-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/f8c9dbe4-95d9-11e8-89c4-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/fecc338c-93c9-11e8-b56f-00163e08345...
oss-pic####.oss-cn-####.aliy####.com/ff5152ce-95db-11e8-81fd-00163e08345...
p5.q####.com/t011ea5004aed407750.jpg
qos.l####.360.cn/vc.gif?&bid=####&pid=####&ver=####&c_ver=####&os=####&m...
s####.l####.360.####.com/Object.getFile/livecloudsdk/YW5kcm9pZF9wbHVnaW5...
s####.s.360.cn/ak/2e65f2f2fdaf6c699b223c61b1b5ab89.html?m2=####
sdk.l####.360.cn/codec?os=####&tm=####&model=####&r=####&package=####&pi...
sdk.l####.360.cn/qvideo_sdk_and_android_145.conf?os=####&tm=####&r=####&...
sdk.l####.360.cn/rtc?os=####&tm=####&model=####&r=####&package=####&pid=...
sf3-ttc####.ps####.com/obj/ad.union.api/744876be9ce69a672d15c2a539354686
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_YYn966
sni.c####.q####.####.net/tdata_eOt091
t####.c####.q####.####.com/tdata_EDT356

Запросы HTTP POST:

api.zantou####.com/dot-app-api/api/user/recordUser
c-h####.g####.com/api.php?format=####&t=####
cloud####.fengkon####.com/v2/device/conf
f####.fengkon####.com/v2/device/profile
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/020b96e8f7918e735e1a6210d5c31182bbf3598c2ac2a70....0.tmp
/data/data/####/07ac3e7af5a1917a6102ac43f8c11008ba425f61d527efb....0.tmp
/data/data/####/0ec545bcf05e1a7ebcec697d858a217b9be567e518691f3....0.tmp
/data/data/####/13f2f27bd07812e4ed2f9a5af454d318d5f7be14ff4d65c....0.tmp
/data/data/####/1533246470179_2090
/data/data/####/1533246470394_2090
/data/data/####/1533246470721_2090
/data/data/####/1533246471178_2090
/data/data/####/1533246473055_2090
/data/data/####/1533246475176_2090
/data/data/####/1900ddfa46ffe3f638972e4406972059ee7987829a95f4b....0.tmp
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/1e67126040499a6accf39137b47085b1c1e9ee092b70e94....0.tmp
/data/data/####/234fe4c46da9232d390eeac29f54ebca5defe2ae6e86bc6....0.tmp
/data/data/####/424d3d14ae19942f4961fca41883d2901145891fc137da6....0.tmp
/data/data/####/5df040971859db62bc0fd672c6983d84c155407f81cc267....0.tmp
/data/data/####/6199b86acda62d81c0f3ab3f36f47a1d8b16307cae00acf....0.tmp
/data/data/####/7c71b33a5bfc2d47b8015e646d2590a4317e0e61c2f21b6....0.tmp
/data/data/####/7d76179e30fcff6935a9806c54860c467129f5e2cf85872....0.tmp
/data/data/####/7f14731a56ed4d470695628eb065476ac07866e63aa538c....0.tmp
/data/data/####/838cd7169bc3c06853e07a634352f0d71d240a0e0831a3d....0.tmp
/data/data/####/Alvin2.xml
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/ContextData.xml
/data/data/####/FM_config.xml
/data/data/####/MultiDex.lock
/data/data/####/QH_DeviceSDK.xml
/data/data/####/QH_SDK_M2.xml
/data/data/####/QH_SDK_UserData2e65f2f2fdaf6c699b223c61b1b5ab89.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__2031e7af-5dfa-439e-aaa...88.jar
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__builtinversion__.jar
/data/data/####/__xadsdk__remote__final__running__.jar
/data/data/####/__xadsdk_downloaded__version__.xml
/data/data/####/a6ef71ff2d11
/data/data/####/a==7.5.0&&1.4.5_1533246475214_envelope.log
/data/data/####/app_globel_config_file.xml
/data/data/####/b12c963a714b9b4a5244084c2652d0e6564253a6b0d3485....0.tmp
/data/data/####/b8d61460d5ac85fecef91aac28378f1d79e78329d576a2f....0.tmp
/data/data/####/b9548a925b966196b303064661f153fd673424db4a6065f....0.tmp
/data/data/####/bf1f600d279595aa2340f91f610366eb6d0acccc740cba5....0.tmp
/data/data/####/c48021cb5b0ba09c570abef37fda89c3f618c6415d7f47a....0.tmp
/data/data/####/cfbfd2820429ba3387d271bc32ad440270e13fea5f9a837....0.tmp
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/com.diandi.app_preferences.xml
/data/data/####/com.qihoo.livecloud.settings.GPWebrtcSettings.pref.xml
/data/data/####/com.shumei.xml
/data/data/####/diandi.db
/data/data/####/diandi.db-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e63be5df5dfeb6020c0101035520fcdb10c0baeecb9ae17....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f3c2fa914ba66f0e6fd8190a1a33a124e8a795d6bfce388....0.tmp
/data/data/####/f803d8b08c9e2b934adecb5ea5c446dc63d06e5461e2cea....0.tmp
/data/data/####/feaa855c3bcf479c60cb32d97700ac13492e25d6ed2e88c....0.tmp
/data/data/####/finalcore.jar
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/i==1.2.0&&1.4.5_1533246469982_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/is.xml
/data/data/####/iv
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/libdvrender.so.tmp
/data/data/####/libjiagu195634731.so
/data/data/####/libjplayer.so.tmp
/data/data/####/liblocalserver.so.tmp
/data/data/####/libmyssl.so.1.1 (deleted)
/data/data/####/libmyssl.so.1.1.tmp
/data/data/####/libtranscore.so.tmp
/data/data/####/libviewer.so.tmp
/data/data/####/libwgs2gcj.so
/data/data/####/localserver_2.0.3.18042602.zip
/data/data/####/locker
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/multidex.version.xml
/data/data/####/new_sp.xml
/data/data/####/player_2.0.3.18051401.zip
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qhvc_plugin.xml
/data/data/####/run.pid
/data/data/####/salt
/data/data/####/sdk_config.xml
/data/data/####/seq.xml
/data/data/####/share.db-journal
/data/data/####/share_data.xml
/data/data/####/slldate.xml
/data/data/####/sp.livecloud.database.xml
/data/data/####/tdata_YYn966
/data/data/####/tdata_YYn966.jar
/data/data/####/tdata_eOt091
/data/data/####/tdata_eOt091.jar
/data/data/####/tdid.xml
/data/data/####/tools_2.0.3.18051401.zip
/data/data/####/tracker.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/webview.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.deviceId
/data/media/####/.nomedia
/data/media/####/.sfp
/data/media/####/.tcookieid
/data/media/####/.testf
/data/media/####/.thumbcache_idx0
/data/media/####/.umm.dat
/data/media/####/1533246473790.db
/data/media/####/9RaFTQW4gFeCAzrvPE6691-bOWI.-2027513844.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/Uiq
/data/media/####/Uiq (deleted)
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/app.db
/data/media/####/com.diandi.app.bin
/data/media/####/com.diandi.app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/p113gp
/data/media/####/shumei.txt
/data/media/####/tdata_YYn966
/data/media/####/tdata_eOt091
/data/media/####/test.log
/data/media/####/yG4dOpPKCAySF30Dsf58AjMJ1-0.-2027513844.tmp

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.ui.service.MeGTPushService 24349 300 0
app_process /system/bin com.android.commands.pm.Pm list package -3
cat /proc/self/cgroup
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu195634731.so
getprop
ls -l /system/bin/su
ls /
ls /sys/class/thermal
mount
pm list package -3
ps
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.ui.service.MeGTPushService 24349 300 0

Загружает динамические библиотеки:

getuiext2
libdvrender
libimagepipeline
libjiagu195634731
libjplayer
liblocalserver
libtranscore
libviewer
smsdk

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к интерфейсу камеры.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней