Adware.Gexin.5411

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) pub-####.qin####.com:80
TCP(HTTP/1.1) analy####.ray####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) 75a2####.cdn.uc####.####.cn:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) net.ray####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) hy####.ray####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) cdn-ad####.ray####.com:80
TCP(HTTP/1.1) fk-k8s-####.ray####.com:80
TCP(TLS/1.0) d1qtxr7####.cloudf####.net:443
TCP(TLS/1.0) a####.i####.pw:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) rep####.crashly####.com:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) a.d####.icu:443
TCP(TLS/1.0) s####.945####.com.####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) avnight####.f####.myqc####.com:443
TCP(TLS/1.0) sdk.adti####.com:443
TCP c####.g####.ig####.com:5227
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
a####.i####.pw
a.d####.icu
analy####.ray####.com
and####.b####.qq.com
avnight####.f####.myqc####.com
c####.g####.ig####.com
c-h####.g####.com
cdn####.ray####.com
cdn-ad####.ray####.com
cdn-ad####.ray####.com
d1qtxr7####.cloudf####.net
e.crashly####.com
hy####.ray####.com
m.adti####.com
net.ray####.com
pub-####.qin####.com
rep####.crashly####.com
s####.945####.com
sdk.adti####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
set####.ray####.com
sett####.crashly####.com
ssl.google-####.com

Запросы HTTP GET:

75a2####.cdn.uc####.####.cn/cdn-adn/dmp/17/12/23/15/10/5a3e01615c90a.png
75a2####.cdn.uc####.####.cn/cdn-adn/dmp/18/06/24/14/48/5b2f3eb663cfe.jpg
75a2####.cdn.uc####.####.cn/cdn-adn/vn/18/07/03/18/51/96790e0db9b2320018...
cdn-ad####.ray####.com/cdn-adn/dmp/17/12/23/15/10/5a3e01615c90a.png
cdn-ad####.ray####.com/cdn-adn/dmp/18/06/24/14/48/5b2f3eb663cfe.jpg
cdn-ad####.ray####.com/cdn-adn/vn/18/07/03/18/51/96790e0db9b232001891148...
cdn-ad####.ray####.com/cdn-adn/vn/18/07/03/18/51/c387b0e3fe689f94f7d7718...
fk-k8s-####.ray####.com/rewardsetting?app_id=####&sign=####&channel=####...
fk-k8s-####.ray####.com/rewardsetting?app_id=####&sign=####&unit_ids=###...
fk-k8s-####.ray####.com/setting?app_id=####&sign=####&channel=####&platf...
hy####.ray####.com/rv-zip-627/mini-dd547832d45ce40ac158105eba8adb81.zip?...
hy####.ray####.com/rv-zip-711/tpl1-e4658ee3d2222db533f6138fc8a180a0.zip?...
hy####.ray####.com/rv/endv4.html?unit_id=####&sdk_version=####
net.ray####.com/openapi/ad/v3?app_id=####&unit_id=####&sign=####&req_typ...
pub-####.qin####.com/tdata_EDT356
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_iGj879
ti####.c####.l####.####.com/config/hz-hzv3.conf

Запросы HTTP POST:

analy####.ray####.com/
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BBeginSession.cls_temp
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BBeginSession.json
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BSessionApp.cls_temp
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BSessionApp.json
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BSessionDevice.cls_temp
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BSessionDevice.json
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BSessionOS.cls_temp
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BSessionOS.json
/data/data/####/5BFEF87F0098-0001-08E9-49D6D5FB151BSessionUser.cls_temp
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151B.cls_temp
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BBeginSession.cls_temp
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BBeginSession.json
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionApp.cls_temp
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionApp.json
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionCrash.cls_temp
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionDevice.cls_temp
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionDevice.json
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionOS.cls_temp
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionOS.json
/data/data/####/5BFEF87F0311-0001-0924-49D6D5FB151BSessionUser.cls_temp
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BBeginSession.cls_temp
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BBeginSession.json
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BSessionApp.cls_temp
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BSessionApp.json
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BSessionDevice.cls_temp
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BSessionDevice.json
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BSessionOS.cls_temp
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BSessionOS.json
/data/data/####/5BFEF88B0365-0002-08E9-49D6D5FB151BSessionUser.cls_temp
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151B.cls_temp
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BBeginSession.cls_temp
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BBeginSession.json
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionApp.cls_temp
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionApp.json
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionCrash.cls_temp
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionDevice.cls_temp
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionDevice.json
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionOS.cls_temp
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionOS.json
/data/data/####/5BFEF89000CE-0001-0A4E-49D6D5FB151BSessionUser.cls_temp
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BBeginSession.cls_temp
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BBeginSession.json
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BSessionApp.cls_temp
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BSessionApp.json
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BSessionDevice.cls_temp
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BSessionDevice.json
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BSessionOS.cls_temp
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BSessionOS.json
/data/data/####/5BFEF8AB014F-0002-0A4E-49D6D5FB151BSessionUser.cls_temp
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151B.cls_temp
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BBeginSession.cls_temp
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BBeginSession.json
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionApp.cls_temp
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionApp.json
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionCrash.cls_temp
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionDevice.cls_temp
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionDevice.json
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionOS.cls_temp
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionOS.json
/data/data/####/5BFEF8B20370-0001-0BA4-49D6D5FB151BSessionUser.cls_temp
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BBeginSession.cls_temp
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BBeginSession.json
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BSessionApp.cls_temp
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BSessionApp.json
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BSessionDevice.cls_temp
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BSessionDevice.json
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BSessionOS.cls_temp
/data/data/####/5BFEF8BC0262-0002-0BA4-49D6D5FB151BSessionOS.json
/data/data/####/MultiDex.lock
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/UUID.xml
/data/data/####/announce.xml
/data/data/####/bugly_db_legu-journal
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.google.android.gms.analytics.prefs.xml
/data/data/####/com.google.android.gms.analytics.prefs.xml (deleted)
/data/data/####/core.xml
/data/data/####/crash_log_sp.xml
/data/data/####/crash_marker
/data/data/####/fd145caa77b3
/data/data/####/gaClientId
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/google_analytics_v4.db-journal
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.andr...ml.bak
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.l.xml
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.2.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/mobvista.msdk.db-journal
/data/data/####/mobvista.xml
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sa_0669ac53-8da3-45ad-9e0a-041d5387c4dd_1543436432662.tap
/data/data/####/sa_5c41c00e-0e20-4e33-961b-2e29d4426b67_1543436467170.tap
/data/data/####/sa_754fc857-27c2-4068-b0ce-b9fa41da7a99_1543436417517.tap
/data/data/####/sa_7a69a8fd-8bf3-4888-8737-9cad28b5eeff_1543436416158.tap
/data/data/####/sa_7d8ef4b8-3559-477e-8e38-4406febe1da9_1543436481754.tap
/data/data/####/sa_8b7b55d2-f9f7-4c58-85b9-1df03ba616c3_1543436417506.tap
/data/data/####/security_info
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap (deleted)
/data/data/####/session_analytics.tap.tmp
/data/data/####/share_date.xml
/data/data/####/shell_config
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_iGj879
/data/data/####/tdata_iGj879.jar
/data/data/####/uij
/data/data/####/webview.db-journal
/data/media/####/-1145178948
/data/media/####/-350985158
/data/media/####/-86550328
/data/media/####/.nomedia
/data/media/####/1209378021
/data/media/####/1473812851
/data/media/####/1589425169
/data/media/####/26992fc57093a723478cd02ce026a37a.html
/data/media/####/2cddda5da0050f796849201bc7a3ab59.html
/data/media/####/507ecad79fa91949800d8eac50e21262.zip
/data/media/####/app.db
/data/media/####/c1ff5e2ce7efcf08e296a3d1a6a09438.zip
/data/media/####/close_v2.png
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/common.min.js
/data/media/####/d7d07d1837b18e862f9812d42e7367ac
/data/media/####/dc124cd185b9cff7104db08820cb5318
/data/media/####/dda96b15a36d876d5aebdb592b1b3007
/data/media/####/mini.html
/data/media/####/rv_bg_0.jpg
/data/media/####/rv_bg_1.jpg
/data/media/####/rv_bg_2.jpg
/data/media/####/sound_off_v2.png
/data/media/####/sound_open_v2.png
/data/media/####/star.png
/data/media/####/star1.png
/data/media/####/tdata_MkX219
/data/media/####/tdata_iGj879
/data/media/####/test.log
/data/media/####/tpl1.html
/data/media/####/tpl1.js
/data/media/####/tv.i999.bin
/data/media/####/tv.i999.db

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.Service.PushService 23556 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.Service.PushService 23556 300 0

Загружает динамические библиотеки:

Bugly
getuiext2
libnfix
libshella-2.9.0.2
libufix
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней