Adware.Gexin.5192

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(TLS/1.0) api.yg####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) lbs.net####.im:443
TCP c####.g####.ig####.com:5224
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
and####.b####.qq.com
api.yg####.com
c####.g####.ig####.com
c-h####.g####.com
lbs.net####.im
log.u####.com
pi####.qq.com
plb####.u####.com
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
u####.u####.com
up.ga####.n####.com
wa####.127.net

Запросы HTTP GET:

t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_YYn966
t####.c####.q####.####.com/tdata_eOt091
ti####.c####.l####.####.com/rn/dev/android/yigou-dev2705853.patch.zip

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
pi####.qq.com/mstat/report/?index=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/201811231306610.v1.crash
/data/data/####/201811231306953.v1.crash
/data/data/####/201811231307182.v1.crash
/data/data/####/201811231307189.v1.crash
/data/data/####/201811231307199.v1.crash
/data/data/####/201811231307282.v1.crash
/data/data/####/201811231307334.v1.crash
/data/data/####/201811231307567.v1.crash
/data/data/####/201811231307751.v1.crash
/data/data/####/201811231307786.v1.crash
/data/data/####/201811231307825.v1.crash
/data/data/####/201811231307858.v1.crash
/data/data/####/201811231307863.v1.crash
/data/data/####/201811231307902.v1.crash
/data/data/####/201811231307910.v1.crash
/data/data/####/201811231307934.v1.crash
/data/data/####/201811231307947.v1.crash
/data/data/####/201811231307964.v1.crash
/data/data/####/MultiDex.lock
/data/data/####/NIMSDK_Config_64a94cbcf8d6d6d0167c9543752e10af.xml
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/com.xuanming.yueweipan.mid.world.ro.xml
/data/data/####/com.xuanming.yueweipan_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDE3MDY4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDEzOTkx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDI1MDYw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDI3OTk3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDIxNjk1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDM1NzUz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDM5NDE1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDMxNjU4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDQ0MDk2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDQ2NTc5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDQwNzM5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDU3MDQ2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDUwMDU1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDUzNjM2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDY3ODY0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDYwODM0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDYzODAy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQyOTc4NDcwODU4;
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/i==1.2.0&&5.5.0_1542978414023_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu-1935116391.so
/data/data/####/local_crash_lock
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/pri_tencent_analysis.db_com.xuanming.yueweipan
/data/data/####/pri_tencent_analysis.db_com.xuanming.yueweipan-journal
/data/data/####/pri_tencent_analysis.db_com.xuanming.yueweipan;...ournal
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/sys_log_1542978431684928.txt
/data/data/####/tdata_YYn966
/data/data/####/tdata_YYn966.jar
/data/data/####/tdata_eOt091
/data/data/####/tdata_eOt091.jar
/data/data/####/tencent_analysis.db_com.xuanming.yueweipan
/data/data/####/tencent_analysis.db_com.xuanming.yueweipan-journal
/data/data/####/tencent_analysis.db_com.xuanming.yueweipan;core-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/yingxin.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/app.db
/data/media/####/assets.zip
/data/media/####/bundle.zip
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.xuanming.yueweipan.bin
/data/media/####/com.xuanming.yueweipan.db
/data/media/####/demo_20181123.log
/data/media/####/index.android.bundle
/data/media/####/nim_sdk.log
/data/media/####/node_modules_reactnavigation_src_views_assets_...on.png
/data/media/####/node_modules_reactnavigation_src_views_assets_...sk.png
/data/media/####/tdata_YYn966
/data/media/####/tdata_eOt091
/data/media/####/test.log
/data/media/####/uuid.txt
/data/media/####/workspace_res_images_buy_cornormark_chongzhiyouli.png
/data/media/####/workspace_res_images_buy_deal_btn_query.png
/data/media/####/workspace_res_images_buy_order_bt_clicked.png
/data/media/####/workspace_res_images_buy_order_bt_nor.png
/data/media/####/workspace_res_images_buy_orderpage_bg_selectblue.png
/data/media/####/workspace_res_images_buy_orderpage_increase.png
/data/media/####/workspace_res_images_buy_orderpage_reduce.png
/data/media/####/workspace_res_images_buy_transaction_icon_ampl...on.png
/data/media/####/workspace_res_images_chat_chat_tips.png
/data/media/####/workspace_res_images_communication_community_b...an.png
/data/media/####/workspace_res_images_communication_community_b...nt.png
/data/media/####/workspace_res_images_communication_community_b...or.png
/data/media/####/workspace_res_images_communication_community_b...se.png
/data/media/####/workspace_res_images_communication_community_b...to.png
/data/media/####/workspace_res_images_communication_community_bg_more.png
/data/media/####/workspace_res_images_communication_community_bt_post.png
/data/media/####/workspace_res_images_communication_community_bt_topic.png
/data/media/####/workspace_res_images_communication_community_close.png
/data/media/####/workspace_res_images_communication_community_i...al.png
/data/media/####/workspace_res_images_communication_community_i...ce.png
/data/media/####/workspace_res_images_communication_community_i...ge.png
/data/media/####/workspace_res_images_communication_community_i...is.png
/data/media/####/workspace_res_images_communication_community_i...ou.png
/data/media/####/workspace_res_images_communication_community_i...rd.png
/data/media/####/workspace_res_images_communication_community_i...ry.png
/data/media/####/workspace_res_images_communication_daijinquan_icon_no.png
/data/media/####/workspace_res_images_communication_followdeal_...ed.png
/data/media/####/workspace_res_images_communication_followorder...et.png
/data/media/####/workspace_res_images_communication_followorder...le.png
/data/media/####/workspace_res_images_communication_followorder...se.png
/data/media/####/workspace_res_images_communication_gradefive.png
/data/media/####/workspace_res_images_communication_gradefour.png
/data/media/####/workspace_res_images_communication_gradeone.png
/data/media/####/workspace_res_images_communication_gradethree.png
/data/media/####/workspace_res_images_communication_gradetwo.png
/data/media/####/workspace_res_images_communication_head.png
/data/media/####/workspace_res_images_coupon_coupon_bg.png
/data/media/####/workspace_res_images_coupon_daijinquan_icon_no.png
/data/media/####/workspace_res_images_coupon_pastcoupon_bg.png
/data/media/####/workspace_res_images_defaultavatar_touxiang.png
/data/media/####/workspace_res_images_followbuy_ranking_btn_pulldown.png
/data/media/####/workspace_res_images_followbuy_ranking_btn_pullup.png
/data/media/####/workspace_res_images_followbuy_ranking_checked.png
/data/media/####/workspace_res_images_followbuy_ranking_first.png
/data/media/####/workspace_res_images_followbuy_ranking_second.png
/data/media/####/workspace_res_images_followbuy_ranking_third.png
/data/media/####/workspace_res_images_followbuy_ranklist_btn_query.png
/data/media/####/workspace_res_images_holdlist_guadan_icon_gouxuan.png
/data/media/####/workspace_res_images_holdlist_guadan_icon_hint.png
/data/media/####/workspace_res_images_holdlist_guadan_icon_mianfei.png
/data/media/####/workspace_res_images_holdlist_guadan_icon_wu.png
/data/media/####/workspace_res_images_holdlist_guadan_icon_zhekou.png
/data/media/####/workspace_res_images_holdlist_translation_bg_g...ct.png
/data/media/####/workspace_res_images_holdlist_translation_bg_nor.png
/data/media/####/workspace_res_images_holdlist_translation_bg_r...ct.png
/data/media/####/workspace_res_images_home_bg_homepage_tu.png
/data/media/####/workspace_res_images_home_bt_close.png
/data/media/####/workspace_res_images_home_guess_icon_dowmgreen.png
/data/media/####/workspace_res_images_home_guess_icon_noresult.png
/data/media/####/workspace_res_images_home_guess_icon_upred.png
/data/media/####/workspace_res_images_home_home_bg_guess1.png
/data/media/####/workspace_res_images_home_home_bg_guess2.png
/data/media/####/workspace_res_images_home_home_bg_popup.png
/data/media/####/workspace_res_images_home_home_bt_guessgray.png
/data/media/####/workspace_res_images_home_home_bt_guessgreen.png
/data/media/####/workspace_res_images_home_home_bt_guessquestion.png
/data/media/####/workspace_res_images_home_home_bt_guessred.png
/data/media/####/workspace_res_images_home_home_bt_littlegreen.png
/data/media/####/workspace_res_images_home_home_bt_littlered.png
/data/media/####/workspace_res_images_home_home_popup_redbag.png
/data/media/####/workspace_res_images_home_home_popuped_redbag.png
/data/media/####/workspace_res_images_home_homepage_bg_fourtitle.png
/data/media/####/workspace_res_images_home_homepage_icon_coupon.png
/data/media/####/workspace_res_images_home_homepage_icon_green.png
/data/media/####/workspace_res_images_home_homepage_icon_newschool.png
/data/media/####/workspace_res_images_home_homepage_icon_recharge.png
/data/media/####/workspace_res_images_home_homepage_icon_red.png
/data/media/####/workspace_res_images_home_homepage_icon_redbag.png
/data/media/####/workspace_res_images_home_homepage_icon_xianshiqiang.png
/data/media/####/workspace_res_images_home_homepage_yinglibobao.png
/data/media/####/workspace_res_images_home_jinrishuju_twinkle.png
/data/media/####/workspace_res_images_home_mayiyigou_nor.png
/data/media/####/workspace_res_images_home_newgift_bg_coupon.png
/data/media/####/workspace_res_images_home_newgift_bg_go.png
/data/media/####/workspace_res_images_home_newgift_coupon.png
/data/media/####/workspace_res_images_home_onboardingscreen1.png
/data/media/####/workspace_res_images_home_onboardingscreen2.png
/data/media/####/workspace_res_images_home_onboardingscreen3.png
/data/media/####/workspace_res_images_home_shouyekefu_zhengchan...hi.png
/data/media/####/workspace_res_images_home_shouyepage_bg_tishi.png
/data/media/####/workspace_res_images_home_shouyetishi_icon_xiala.png
/data/media/####/workspace_res_images_home_teachpage_icon_vidioviews.png
/data/media/####/workspace_res_images_home_teachplaypage_btn_back.png
/data/media/####/workspace_res_images_loginregister_110.png
/data/media/####/workspace_res_images_loginregister_login_closeeyes.png
/data/media/####/workspace_res_images_loginregister_login_openeyes.png
/data/media/####/workspace_res_images_loginregister_zhucepage_checked.png
/data/media/####/workspace_res_images_mine_cornormark_chongzhiyouli.png
/data/media/####/workspace_res_images_mine_gerenzhongxin_bg.png
/data/media/####/workspace_res_images_mine_gerenzhongxin_gerengo.png
/data/media/####/workspace_res_images_mine_login_bg_gift.png
/data/media/####/workspace_res_images_mine_mine_icon_aboutus.png
/data/media/####/workspace_res_images_mine_mine_icon_onlineservive.png
/data/media/####/workspace_res_images_mine_mine_icon_phone.png
/data/media/####/workspace_res_images_mine_mine_icon_risktips.png
/data/media/####/workspace_res_images_mine_minepage_antiaddiction.png
/data/media/####/workspace_res_images_mine_minepage_bg_chongzhitixian.png
/data/media/####/workspace_res_images_mine_minepage_bg_huiyuan.png
/data/media/####/workspace_res_images_mine_minepage_btn_set.png
/data/media/####/workspace_res_images_mine_minepage_go_gray.png
/data/media/####/workspace_res_images_mine_minepage_icon_all.png
/data/media/####/workspace_res_images_mine_minepage_icon_daifahuo.png
/data/media/####/workspace_res_images_mine_minepage_icon_daifukuan.png
/data/media/####/workspace_res_images_mine_minepage_icon_daishouhuo.png
/data/media/####/workspace_res_images_mine_minepage_icon_integral.png
/data/media/####/workspace_res_images_mine_minepage_icon_massage.png
/data/media/####/workspace_res_images_mine_minepage_icon_sign.png
/data/media/####/workspace_res_images_mine_minepage_redbag.png
/data/media/####/workspace_res_images_mine_newbietask_bg_homepage_tu.png
/data/media/####/workspace_res_images_mine_newbietask_xinshoure...ft.png
/data/media/####/workspace_res_images_mine_newbietask_xinshoure...ht.png
/data/media/####/workspace_res_images_mine_newbietask_xinshoure...le.png
/data/media/####/workspace_res_images_mine_rank.png
/data/media/####/workspace_res_images_mine_signin_bg.png
/data/media/####/workspace_res_images_mine_signin_close.png
/data/media/####/workspace_res_images_mine_yigoushop_bg.png
/data/media/####/workspace_res_images_mine_yigoushop_bg_chongzhitixian.png
/data/media/####/workspace_res_images_mine_zhongrunshop_bg.png
/data/media/####/workspace_res_images_nationalflag_australian.png
/data/media/####/workspace_res_images_nationalflag_cannada.png
/data/media/####/workspace_res_images_nationalflag_england.png
/data/media/####/workspace_res_images_nationalflag_europe.png
/data/media/####/workspace_res_images_nationalflag_japan.png
/data/media/####/workspace_res_images_nationalflag_newzealand.png
/data/media/####/workspace_res_images_navbar_homepage_buy_nor.png
/data/media/####/workspace_res_images_navbar_homepage_buy_pre.png
/data/media/####/workspace_res_images_navbar_homepage_home_nor.png
/data/media/####/workspace_res_images_navbar_homepage_home_pre.png
/data/media/####/workspace_res_images_navbar_homepage_icon_reta...ct.png
/data/media/####/workspace_res_images_navbar_homepage_icon_retailnor.png
/data/media/####/workspace_res_images_navbar_homepage_interaction_nor.png
/data/media/####/workspace_res_images_navbar_homepage_interaction_pre.png
/data/media/####/workspace_res_images_navbar_homepage_mine_nor.png
/data/media/####/workspace_res_images_navbar_homepage_mine_nor1.png
/data/media/####/workspace_res_images_navbar_nav_icon_highlight.png
/data/media/####/workspace_res_images_navbar_nav_icon_nor.png
/data/media/####/workspace_res_images_player_back.png
/data/media/####/workspace_res_images_player_fause.png
/data/media/####/workspace_res_images_player_fulllscreen.png
/data/media/####/workspace_res_images_player_play.png
/data/media/####/workspace_res_images_player_smallscreen.png
/data/media/####/workspace_res_images_quickorder_bt_close.png
/data/media/####/workspace_res_images_quickorder_xinrenlibaoanniu.png
/data/media/####/workspace_res_images_quickorder_xinrenlibaotankuang.png
/data/media/####/workspace_res_images_rechargewithdrawal_pay_bt...ht.png
/data/media/####/workspace_res_images_rechargewithdrawal_pay_btn_nor.png
/data/media/####/workspace_res_images_rute_back.png
/data/media/####/workspace_res_images_rute_backwhite.png
/data/media/####/workspace_res_images_rute_go.png
/data/media/####/workspace_res_images_transaction_billpage_icon...aw.png
/data/media/####/workspace_res_images_transaction_billpage_icon...ge.png
/data/media/####/workspace_res_images_transaction_buzou1.png
/data/media/####/workspace_res_images_transaction_buzou2.png
/data/media/####/workspace_res_images_transaction_buzou3.png
/data/media/####/workspace_res_images_transaction_deal_btn_shoploss.png
/data/media/####/workspace_res_images_transaction_deal_btn_stopprofit.png
/data/media/####/workspace_res_images_transaction_dealpage_swit...al.png
/data/media/####/workspace_res_images_transaction_dealpage_swit...ct.png
/data/media/####/workspace_res_images_transaction_dealpage_swit...op.png
/data/media/####/workspace_res_images_transaction_dinggoudanbuzou.png
/data/media/####/workspace_res_images_transaction_guadan.png
/data/media/####/workspace_res_images_transaction_xjdg.png
/data/media/####/workspace_res_images_transaction_zsjdg.png

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.MyGTPushService 25265 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop
logcat -c
logcat -d -v time
ls /sys/class/thermal
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.MyGTPushService 25265 300 0

Загружает динамические библиотеки:

Bugly
MtaNativeCrash_v2
bsdiff
getuiext2
libjiagu-1935116391

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней