Adware.Gexin.3607

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) log.r####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) h####.b####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) t####.growi####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) a####.w####.cn:80
TCP(HTTP/1.1) w####.w####.cn:80
TCP(HTTP/1.1) dn-gro####.q####.me:80
TCP(HTTP/1.1) t####.talking####.net:80
TCP(HTTP/1.1) img.w####.cn:80
TCP(TLS/1.0) w####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) jic.talking####.com:443
TCP(TLS/1.0) a####.w####.cn:443
TCP(TLS/1.0) s####.ml####.cc:443
TCP(TLS/1.0) t.growi####.com:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) as####.growi####.com.####.net:443
TCP(TLS/1.0) api.growi####.com:443
TCP(TLS/1.0) img.w####.cn:443
TCP(TLS/1.0) x####.com:443
TCP c####.g####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
a####.w####.cn
and####.b####.qq.com
api.growi####.com
api.w####.com
as####.growi####.com
c####.g####.ig####.com
c-h####.g####.com
dn-gro####.q####.me
h####.b####.com
i####.cn
img.w####.cn
jic.talking####.com
log.r####.com
pub-####.qin####.com
r####.wx.qq.com
s####.ml####.cc
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
t####.growi####.com
t####.talking####.net
t.growi####.com
w####.oss-cn-####.aliy####.com
w####.w####.cn
x####.com

Запросы HTTP GET:

dn-gro####.q####.me/vds.js
img.w####.cn/upload/035d2f16-e596-4b9e-85b6-745eb1c592c1.jpg
img.w####.cn/upload/275d108b-8a2e-4e7f-ae2b-16851f5dfa8c.jpg
img.w####.cn/upload/32422504-3c34-4487-9743-0a43fa26be56.jpg
img.w####.cn/upload/36fbafc6-258d-426c-9977-594d51fb8406.jpg
img.w####.cn/upload/9cd4fcad-a57f-48a9-94fd-487fef4f8421.jpg
img.w####.cn/upload/c1dfd3b3-5361-49ca-bb84-6834587a3b49.jpg
log.r####.com/receive/gettime
s####.tc.qq.com/open/js/jweixin-1.0.0.js
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_BAI450
t####.c####.q####.####.com/tdata_EDT356
t####.c####.q####.####.com/tdata_YJA893
t####.growi####.com/products/a7bedd1e59d5cf94/web/wmall.wochu.cn/setting...
w####.w####.cn/h5/activityTemplate/css/common.css
w####.w####.cn/h5/activityTemplate/css/template-59c779bfea.css
w####.w####.cn/h5/activityTemplate/html/activityPage.html?activityId=####
w####.w####.cn/h5/activityTemplate/img/ac-back.png
w####.w####.cn/h5/activityTemplate/img/ac-cart.png
w####.w####.cn/h5/activityTemplate/img/ac-share.png
w####.w####.cn/h5/activityTemplate/img/go_top.png
w####.w####.cn/h5/activityTemplate/img/share-icon.png
w####.w####.cn/h5/activityTemplate/js/activity-519ce8fa4d.js
w####.w####.cn/h5/activityTemplate/js/browser.js
w####.w####.cn/h5/activityTemplate/js/hammer.min.js
w####.w####.cn/h5/activityTemplate/js/jquery.js
w####.w####.cn/h5/css/jsTools.css
w####.w####.cn/h5/js/common.js
w####.w####.cn/h5/js/jqueryMore.js
w####.w####.cn/h5/js/jsTools.js

Запросы HTTP POST:

a####.w####.cn/client/v1/member/appactivation
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
h####.b####.com/app.gif
log.r####.com/receive/pkginfo
log.r####.com/receive/tkio/install
log.r####.com/receive/tkio/startup
sdk.o####.p####.####.com/api.php?format=####&t=####
t####.talking####.net/g/d

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/CookiePersistence.xml
/data/data/####/MultiDex.lock
/data/data/####/Reyun.db
/data/data/####/Reyun.db-journal
/data/data/####/TD_CHANNEL_ID.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/a24dc2e4618b
/data/data/####/bugly_db_legu-journal
/data/data/####/com.wicture.wochu;pushservice.growing.db
/data/data/####/com.wicture.wochu;pushservice.growing.db-journal
/data/data/####/com.wicture.wochu_preferences.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/growing.db
/data/data/####/growing.db-journal
/data/data/####/growing_ecsid.xml
/data/data/####/growing_persist_data.xml
/data/data/####/growing_profile.xml
/data/data/####/growingio_diagnose.xml
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.2.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/mwsdk_analytics.db-journal
/data/data/####/native_record_lock
/data/data/####/netflow.xml
/data/data/####/persistent_data.xml
/data/data/####/persistent_data.xml.bak
/data/data/####/pkgInfo.xml
/data/data/####/pref_longtime.xml
/data/data/####/pref_shorttime.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/reyunchannel_interval.xml
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/share.xml
/data/data/####/talkingdata_file_prefence.xml
/data/data/####/td.lock
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_YJA893
/data/data/####/tdata_YJA893.jar
/data/data/####/tdid.xml
/data/data/####/trackAppIntall.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/weibo_sdk_aid1
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.config
/data/media/####/.cuid
/data/media/####/.tcookieid
/data/media/####/032176fbc19dff7b360c98aef276e80170835e43fa894b....0.tmp
/data/media/####/06c92a6bf020b3ad5459ff5d0443d02ba742e24e4a8182....0.tmp
/data/media/####/08f4cc48ee559816bed9755cd83ab6a47c4ef5c495d79e....0.tmp
/data/media/####/09e4e66084d0f37fea080af6f0ff374f2965f65ff9fa1c....0.tmp
/data/media/####/0b69ac6517ccf61fcbee1796eb1f7e6396e1a2042efe00....0.tmp
/data/media/####/10ff6cf28aaf3863318893398e070d1fdc670ed5fbf6ff....0.tmp
/data/media/####/11e34c208e7b08b8763d801b6760533d21f26028603ee6....0.tmp
/data/media/####/150aac66db2adb62d96a5dcbc4a82e9219f4e57c57ed9b....0.tmp
/data/media/####/1726341bc789064bf59cad05ae2214f0cb658503c497a5....0.tmp
/data/media/####/1944b9434a85c8a9162080868b6ee4e1f588019aa5f9c6....0.tmp
/data/media/####/1a85efdcfb0e007f481949e5ffe0754b0a87d10359bf67....0.tmp
/data/media/####/1c510ac6140f9b879565fc5f343a4c10693c51d4f4fdf0....0.tmp
/data/media/####/1c744479460ef9026ceb7a47dd7fa20eaf5661a35fe242....0.tmp
/data/media/####/1cfea52637137f61a891b28fb75a85b3496cad840cb2a8....0.tmp
/data/media/####/24af5a2df3ab42c7f349d5b2254a0512010fd1de8e0743....0.tmp
/data/media/####/2645cb3511d0af51a4f3991052a892a7206b414a9f93e9....0.tmp
/data/media/####/26fcbfb3eeb3a95e7dfc21f32cc4239de780224712b581....0.tmp
/data/media/####/2785e0bae61772bf5b31ab4aefaecbf3edd21ff9d2fd8d....0.tmp
/data/media/####/28b717d112525034c5acb6651d0cb48ff156b8ce4deaab....0.tmp
/data/media/####/292f9888c544f0908dfa260aa7a1af6288797cf676668e....0.tmp
/data/media/####/2c8940ceb6ac3b933ea0eddcf05b0a55a332ed299da6df....0.tmp
/data/media/####/2f8f1a2ed6cac02b1df042783783d57f14a63e3ed0d2fe....0.tmp
/data/media/####/346a70f0d4a6604545801ae63a81a78126418d5e132d41....0.tmp
/data/media/####/34a9d77f945d41a048776c3b32d1befde8de34241fa483....0.tmp
/data/media/####/34cc33ad1dd87500815021b0feaa59bb58ce3cefe63f65....0.tmp
/data/media/####/367b20f1b75b1d44239a8c342ebd7baa31cee27b0d8bbe....0.tmp
/data/media/####/3716f8b69668101ef602b8a6c36508e5ff5fe29f85a4b5....0.tmp
/data/media/####/3c665d1713488d564e161afda4555c40153c0f23f81994....0.tmp
/data/media/####/3c76c397ce1a6a5b6e7baf8ec7cbb4ffcac219890f588c....0.tmp
/data/media/####/3ef78da0f133b9a92fb9de1595fbe5ca79fc0b38669be5....0.tmp
/data/media/####/3f61aaeb25c6e4f064dae8a347bee18844e4e9e2ba77b8....0.tmp
/data/media/####/4078497bc6ca990b4e4eda0069832b9de7714f427ea797....0.tmp
/data/media/####/41869f6d12a65a78b6bdbb2d37c84f2467ffbabbba57f0....0.tmp
/data/media/####/42087ca8f54c70ff8a3fe1589997cde9829ce112994a58....0.tmp
/data/media/####/47f12a97889a0cc61bcc46def0f1d86a0cafa45fe67fcd....0.tmp
/data/media/####/49247ede6e9094087893cb0a35f46e0f580e617f9d6e55....0.tmp
/data/media/####/495af61ee82e220b5a7f66dad6b32acb5f5b9061b8b39b....0.tmp
/data/media/####/4b28678ba208345bd1ee16894b9571e20c76adaa75c96d....0.tmp
/data/media/####/4d6f029e7ad7c63936377c5037c293fa3f3caf51bfa7b5....0.tmp
/data/media/####/4dd70181e7f32215a3384b1e1c4ab3b5e71d69176a9672....0.tmp
/data/media/####/4e5c3691894f8a961bc7e0fb4fd380566348f4263d1739....0.tmp
/data/media/####/4e89af7c9200da57eac0e4dd53b545ef2a55e70135677d....0.tmp
/data/media/####/50f4a665ca905df198984576e94ea08040fc617ade17b7....0.tmp
/data/media/####/553434dde89c0e3219b028920200b958b78932b9607be1....0.tmp
/data/media/####/55e6c202e67da1dc647076a77736c413e8691b8f98867f....0.tmp
/data/media/####/59033daf6448ef9b94ddfbef9976707347eb2cacf18b15....0.tmp
/data/media/####/59137650d28aa8298f7fc871e0f624b3181ead175faafa....0.tmp
/data/media/####/5c27938b0b37713db1287a78a45b4128d19d0eb0b39381....0.tmp
/data/media/####/5d496a8ef163e7c4ceae48cec18e232a6ef32ff0184dc4....0.tmp
/data/media/####/5f0922174c4a19af586c7abc69e627c90b20bdf3090ce7....0.tmp
/data/media/####/5fae7684f3058784f21c644407a7d0fa9430913cffdd90....0.tmp
/data/media/####/6092b899ec00a05b24cbe1bc93bdd2cd3eb8edba3e48fd....0.tmp
/data/media/####/62ea55ad485b286b70f7b9c9ec4326a6b78022e2929f46....0.tmp
/data/media/####/63060acd80a7cfc1acbe28e191e1a8b371458b27290163....0.tmp
/data/media/####/65ca492e31fbf0d433343e25bd36c384078a400810b416....0.tmp
/data/media/####/67f48ef4d10a838ddcc8aedd4d75f8dc4e1535af48de7a....0.tmp
/data/media/####/6c7066bafc33500bcdb94839a539fbbf171946d4e64472....0.tmp
/data/media/####/6c92e78cf03fd73b6612269aa7bf746cace627a5fb0754....0.tmp
/data/media/####/6dd82b452d8b1e324cd69f27e1660a02be706cf10d8d34....0.tmp
/data/media/####/719dba3535e26bea4c4b1b49f45914b5ef1d58752b9187....0.tmp
/data/media/####/7220c60ff7efc045168546a047789e067902af5a541339....0.tmp
/data/media/####/73b7681c06a33c6076a150e0bd953d9f8932b216c3f395....0.tmp
/data/media/####/74ec1de7772dcdd8f7b01e58a411e0e491874557582e69....0.tmp
/data/media/####/76e75646130b7b102f734bfe62116c92d9ff46c8df85eb....0.tmp
/data/media/####/77df2b3a922efb6d1e4ee6b274c20babb107d744dac38e....0.tmp
/data/media/####/79dddadd02853cbe27840856507693eb002eaa56e4fab4....0.tmp
/data/media/####/7a95a68e29dd73a881dd8f6a4008d1e01f028ac3d37835....0.tmp
/data/media/####/7ae25d9991065d2f2d0d093655372041bc5fa9dd0f2352....0.tmp
/data/media/####/7bb8ce8e148f2d10ecde2e00f1c55a733afa411609b3a0....0.tmp
/data/media/####/7cbeaac5fb26966afd2e890d167d75d69971d1aab33956....0.tmp
/data/media/####/7cecfec7fd1f7640b2a00d74e1bea2fd356001fb040ffe....0.tmp
/data/media/####/83848497fc6538f7c3def0fa9baea6aaadcda0f96211e0....0.tmp
/data/media/####/83ea02b987195ca9b60ccc0d9a38b55831aca78215cf62....0.tmp
/data/media/####/84a016563222234b88ddd0077fddf901445fdad60e8340....0.tmp
/data/media/####/84a093a4f0d9fb95f84729c7b9c6cf1544a4a26127cb31....0.tmp
/data/media/####/8ac3d90d44c39971ec829996ee1e353c366b376636e4ac....0.tmp
/data/media/####/8de1fb0c17ac508495373cd8faa3cd7fc71a035b7647ed....0.tmp
/data/media/####/8e51465c0615f086df0b55cb8e3550ebb95068691a5fb4....0.tmp
/data/media/####/915641c1d1b5d388f40268398d9efe78abd1653e8c03e9....0.tmp
/data/media/####/9518220d26e9493e59ffa7aab79a14fc680ba341e95c12....0.tmp
/data/media/####/9613fd543d5d4d7155b2118026a89bec051f535f49724f....0.tmp
/data/media/####/9d60ccf4fa2c92318ff9d9a45ba9c00c9f006127ddb1d5....0.tmp
/data/media/####/9d6597c5bba48f29b3a9da836d8ffb6c4c73c4bdc1cdf0....0.tmp
/data/media/####/a7e6aad6b5bccd7a24e10c6be26191ee1f221a5b6ae175....0.tmp
/data/media/####/abae7040713c7daf9accf00c9bc1a775e935a871ff8c32....0.tmp
/data/media/####/af12c6b93cde55c73f5c4c092a8ff52c34c32afcc5b45a....0.tmp
/data/media/####/af9a270a8889fb6d751cd1f437d689f65ed1239cfbb36f....0.tmp
/data/media/####/app.db
/data/media/####/b0a5b525af0e794ccbf75d9e10f4e0a2806c79ca4e3fcc....0.tmp
/data/media/####/b3c94802951c576e9b4616079074407dd4b1998596c0a7....0.tmp
/data/media/####/b4d7ba95a1d0a7c4e80fc85f7c6659851f91255a640b31....0.tmp
/data/media/####/b81ae4ac554fa8302cd9777a8055e80c71c11024089c56....0.tmp
/data/media/####/bd2cc706490fb428b4817a98ab0b4ffd068d82d1fc05bb....0.tmp
/data/media/####/c5ac9cd5f6bdfc3fabae09916aaf2cb9d8b2397f100334....0.tmp
/data/media/####/caf21fcaa474580f0f0d41a25adfc93d50eefb826c4b79....0.tmp
/data/media/####/cda214534aecccf1f6423d190edd0162a7fdbda6a87c1a....0.tmp
/data/media/####/cdd7eaf426f795f4f71836e2f7ec908ddec8fdd783e177....0.tmp
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.wicture.wochu.db
/data/media/####/d07ef0cb0c2b5705bb7b44b74ba28fece54317b7365c3f....0.tmp
/data/media/####/d0cbba356d25ac1b6ec4ff7732dda17726697ff8a3be4f....0.tmp
/data/media/####/d1051cafd57bfca3a6b53bd80d8c33ae3551a1d92d98f7....0.tmp
/data/media/####/d688e98c5cffafd57f38705c7616b90e12084118af8af6....0.tmp
/data/media/####/dd35966c16e30b5e7892880ec8dd75e862b79d2feeefbd....0.tmp
/data/media/####/ddd77c1540a1a58b5206ec88bed59627f45457fbd5c73f....0.tmp
/data/media/####/e22099024af48a1ad9661811d47a274a19b32dadf5543b....0.tmp
/data/media/####/e53027b5b1b1aa2125e1bc443c41ee03b360d49224b522....0.tmp
/data/media/####/e57e939ae12be34c89d4496c60e4114bb6ff0a66d53eab....0.tmp
/data/media/####/e66d5b45f52418f940ccde6f906b993344ca44a473c5d9....0.tmp
/data/media/####/e723ba9d57417eac64beca239649f92508278e6f63b681....0.tmp
/data/media/####/e806e918a3c0cd17968dc28c1e702c3a4664e53ca85b9d....0.tmp
/data/media/####/e846c87aee179f1d4d3a13655d1e539ed38fe0334157cf....0.tmp
/data/media/####/e8c0d338aeea3a58e0febe46e51182d6e6dcbba9844587....0.tmp
/data/media/####/eac3ee96d860a084b19b036552c4bec089770b8d29c2af....0.tmp
/data/media/####/ed2efe28dfec4b553f47beb4972fa154429ffbe322b646....0.tmp
/data/media/####/ed8f1a02596a45570b28d9f47f63a2c94c4d3b70b0f8cc....0.tmp
/data/media/####/f78e6879302bebce78c68454aa19c8509b3738b539608a....0.tmp
/data/media/####/f7d643d58c83920b4cc5a4ab17137a2307bd42c945eb10....0.tmp
/data/media/####/f8285e1178926777c7035974c11d1cda20d5fa1c0bbce8....0.tmp
/data/media/####/f8532a531fcac019e22b3cececd69b653f46e498c0b1d8....0.tmp
/data/media/####/f966b1ccaafb57f2770539addea8608412bef58ff5838f....0.tmp
/data/media/####/fb3f950ffa0c054d75e2e8a4c4d73c2da56f6a26e44e7c....0.tmp
/data/media/####/fda0c605d813a55a43eb71e4f62e0785a11b5332db7468....0.tmp
/data/media/####/journal.tmp
/data/media/####/tdata_BAI450
/data/media/####/tdata_YJA893
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24732 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
mount

Загружает динамические библиотеки:

Bugly
getuiext2
libnfix
libshella-2.9.0.2
libufix
nfix
ufix
weibosdkcore

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-GCM-NoPadding
DES-CBC-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о настроках APN.

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней