Adware.Gexin.5147

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) pub-####.qin####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) o####.pape####.cn:80
TCP(HTTP/1.1) 2####.107.1.1:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 2c52####.cdn.uc####.####.cn:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(TLS/1.0) schedul####.yo####.com:443
TCP(TLS/1.0) bbl.xueb####.com:443
TCP c####.g####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
7x####.c####.z0.####.com
bbl.xueb####.com
c####.g####.ig####.com
c-h####.g####.com
o####.pape####.cn
pi####.qq.com
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
tj.youza####.com
wb####.u####.uc####.####.cn

Запросы HTTP GET:

2c52####.cdn.uc####.####.cn/166ae3d7392a62995d5980bf6e3594a1.apk
2c52####.cdn.uc####.####.cn/1848fcfba85a1389198bc9b04ff69c89.apk
2c52####.cdn.uc####.####.cn/2ea025991362c8bb50dc91b4f0d6055c.apk
2c52####.cdn.uc####.####.cn/4f6bf9061211c831b0b2a452a9ef649c.apk
2c52####.cdn.uc####.####.cn/5cc92db959669161a4a78092a5b87f7a.apk
2c52####.cdn.uc####.####.cn/65515251ff01dd7eb97e3c8f7dcbc6eb.apk
2c52####.cdn.uc####.####.cn/763509a7cf31552133d7ccf16c8c3141.apk
2c52####.cdn.uc####.####.cn/979be035e116c22dd1d007c13681077e.apk
2c52####.cdn.uc####.####.cn/9c00271c997bae45b1748165e408d442.apk
2c52####.cdn.uc####.####.cn/a976d6d4a6fcd9b5391ffa0300d5060d.apk
2c52####.cdn.uc####.####.cn/bf090f4bcaa72c94cc29574f4307dcf3.apk
2c52####.cdn.uc####.####.cn/c5d26ea482f4e1d4ddc333966ec9b62c.apk
2c52####.cdn.uc####.####.cn/eff3cff84607b852e9ffed54403bec12.apk
2c52####.cdn.uc####.####.cn/fd67ed9c9a60ad5fd8f61727088a6764.apk
pub-####.qin####.com/tdata_EDT181
t####.c####.q####.####.com/android_theme_special_christmas.apk
t####.c####.q####.####.com/android_theme_special_newyear.apk
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_RbW195
t####.c####.q####.####.com/tdata_YEE769
t####.c####.q####.####.com/tdata_hqM577

Запросы HTTP POST:

c-h####.g####.com/api.php?format=####&t=####
o####.pape####.cn/api/v1/ClientCheck
pi####.qq.com/mstat/report/?index=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/.mta-wxop.xml
/data/data/####/.setting
/data/data/####/5da079039627
/data/data/####/UUID
/data/data/####/UUID_N
/data/data/####/_nohttp_cache_db.db
/data/data/####/_nohttp_cache_db.db-journal
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.wenba.bangbang_preferences.xml
/data/data/####/com.wenba.bangbang_prefs.xml
/data/data/####/com.youzan.mobile.AnalyticsPrefs.xml
/data/data/####/events
/data/data/####/events-journal
/data/data/####/gdaemon_20161017
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c.pid
/data/data/####/libjiagu53689302.so
/data/data/####/mobclick_agent_cached_com.wenba.bangbang5003001
/data/data/####/multidex.version.xml
/data/data/####/pri_wxop_tencent_analysis.db-journal
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/setting.xml
/data/data/####/shuzilm.db
/data/data/####/special_christmas-5003001.temp
/data/data/####/special_christmas-5003001.temp.nohttp
/data/data/####/special_newyear-5003001.temp
/data/data/####/special_newyear-5003001.temp.nohttp
/data/data/####/tdata_RbW195
/data/data/####/tdata_RbW195.jar
/data/data/####/tdata_YEE769
/data/data/####/tdata_YEE769.jar
/data/data/####/tdata_hqM577
/data/data/####/tdata_hqM577.jar
/data/data/####/umeng_general_config.xml
/data/data/####/wxop_tencent_analysis.db-journal
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/UUID
/data/media/####/UUID_N
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.wenba.bangbang.db
/data/media/####/event_3bb0770d881141e3b364649c880a57f6.args
/data/media/####/event_3bb0770d881141e3b364649c880a57f6.log
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/lut
/data/media/####/sequence_number
/data/media/####/tdata_RbW195
/data/media/####/tdata_YEE769
/data/media/####/tdata_hqM577
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24752 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
ls /dev/socket
mount
netstat
service call iphonesubinfo 1
sh -c cat /proc/cpuinfo
sh -c cat /proc/net/arp
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid