Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub-####.qin####.com:80
- TCP(HTTP/1.1) tkl.suixi####.com:80
- TCP(HTTP/1.1) peiz####.suixi####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) ada####.m.ta####.com:80
- TCP(HTTP/1.1) spfe####.suixi####.com:80
- TCP(HTTP/1.1) logshan####.suixi####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) ad####.m.ta####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) norma-e####.m####.com:80
- TCP(HTTP/1.1) wild####.al####.com.####.net:80
- TCP(TLS/1.0) ope####.m.ta####.com:443
- TCP(TLS/1.0) t####.c####.q####.####.com:443
- TCP(TLS/1.0) nbsdk-b####.al####.com:443
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) guide-a####.m.ta####.com:443
- TCP(TLS/1.0) 69a3f4c####.bug####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
- TCP c####.g####.ig####.com:5225
- TCP sdk.o####.t####.####.com:5224
- UDP 1####.168.108.1:137
Запросы DNS:
- 69a3f4c####.bug####.com
- 7j####.c####.z0.####.com
- acs4bai####.m.ta####.com
- ad####.m.ta####.com
- ada####.m.ta####.com
- c####.g####.ig####.com
- c-h####.g####.com
- h####.m.ta####.com
- h5.suixi####.com
- img.al####.com
- logshan####.suixi####.com
- nbsdk-b####.al####.com
- norma-e####.m####.com
- ope####.maiya####.com
- peiz####.suixi####.com
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- spfe####.suixi####.com
- tkl.suixi####.com
- xinx####.suixi####.com
- y####.al####.org
Запросы HTTP GET:
- ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
- norma-e####.m####.com/android/exchange/getpublickey.do
- pub-####.qin####.com/tdata_EDT356
- t####.c####.q####.####.com/appfe/bbdetails.html?id=####&appver=####
- t####.c####.q####.####.com/appfe/static/css/bbdetails.min.css?v=####
- t####.c####.q####.####.com/appfe/static/css/common.min.css?v=####
- t####.c####.q####.####.com/appfe/static/js/bbdetails.min.js?v=####
- t####.c####.q####.####.com/appfe/static/js/common.min.js?v=####
- t####.c####.q####.####.com/tdata_GKE879
- t####.c####.q####.####.com/tdata_IfO862
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- wild####.al####.com.####.net/bao/uploaded/i4/2282910353/O1CN01ncvDC51ETi...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN011ETiHgHwf7yMdX...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN011ETiHhO0bsCQK4...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN011ETiHi1hprKrev...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN013VusxR1ETiIDRO...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN019lbMpK1ETiHi4G...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN01IbpKpU1ETiHfr8...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN01YjymXh1ETiHi1j...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN01gzwD3r1ETiHhNy...
- wild####.al####.com.####.net/imgextra/i1/2282910353/O1CN01rlkzYe1ETiHfr6...
- wild####.al####.com.####.net/imgextra/i1/4129961044/O1CN011JaBxWOrwBLIC8...
- wild####.al####.com.####.net/imgextra/i1/4129961044/O1CN011JaBxXZ2X1hNt0...
- wild####.al####.com.####.net/imgextra/i1/4129961044/O1CN011JaBxXZ4btUSBN...
- wild####.al####.com.####.net/imgextra/i1/4129961044/O1CN011JaBxYCs0yqwT0...
- wild####.al####.com.####.net/imgextra/i2/2282910353/O1CN011ETiHEMsmaaetG...
- wild####.al####.com.####.net/imgextra/i2/2282910353/O1CN011k4dPN1ETiHhAE...
- wild####.al####.com.####.net/imgextra/i2/2282910353/O1CN01CFD3c61ETiIC7W...
- wild####.al####.com.####.net/imgextra/i2/2282910353/O1CN01HRbKKL1ETiHizE...
- wild####.al####.com.####.net/imgextra/i2/2282910353/O1CN01UpDeza1ETiHhO0...
- wild####.al####.com.####.net/imgextra/i2/2282910353/O1CN01wTWR6e1ETiHgo5...
- wild####.al####.com.####.net/imgextra/i2/2282910353/O1CN01yYWw2c1ETiIFJO...
- wild####.al####.com.####.net/imgextra/i2/4129961044/O1CN011JaBxVuOMd8RhB...
- wild####.al####.com.####.net/imgextra/i2/4129961044/O1CN011JaBxWOqb4Y5wL...
- wild####.al####.com.####.net/imgextra/i2/4129961044/O1CN011JaBxWOqb4k8YH...
- wild####.al####.com.####.net/imgextra/i3/2282910353/O1CN011ETiHi4FfJqiNW...
- wild####.al####.com.####.net/imgextra/i3/2282910353/O1CN01ELATZC1ETiI6kv...
- wild####.al####.com.####.net/imgextra/i3/2282910353/O1CN01KnZ6pF1ETiHiln...
- wild####.al####.com.####.net/imgextra/i3/2282910353/O1CN01bzBYNe1ETiHhjs...
- wild####.al####.com.####.net/imgextra/i3/2282910353/O1CN01tBiI1k1ETiHiKv...
- wild####.al####.com.####.net/imgextra/i3/2282910353/O1CN01yRg3k01ETiHhNz...
- wild####.al####.com.####.net/imgextra/i3/4129961044/O1CN011JaBxV4lrUVgyQ...
- wild####.al####.com.####.net/imgextra/i3/4129961044/O1CN011JaBxXnBiS31IP...
- wild####.al####.com.####.net/imgextra/i4/2282910353/O1CN012qbYM91ETiICjd...
- wild####.al####.com.####.net/imgextra/i4/2282910353/O1CN01CYP4d11ETiHizG...
- wild####.al####.com.####.net/imgextra/i4/2282910353/O1CN01EPtmLQ1ETiHhed...
- wild####.al####.com.####.net/imgextra/i4/2282910353/O1CN01x9NFao1ETiICjc...
- wild####.al####.com.####.net/imgextra/i4/4129961044/O1CN011JaBxWOsCoN39M...
- wild####.al####.com.####.net/imgextra/i4/4129961044/O1CN011JaBxX07Zj5zw7...
- wild####.al####.com.####.net/imgextra/i4/4129961044/O1CN011JaBxX08B79uQ6...
- wild####.al####.com.####.net/imgextra/i4/4129961044/O1CN011JaBxYOqnLyYUM...
- wild####.al####.com.####.net/imgextra/i4/4129961044/O1CN011JaBxYOqrWcixM...
Запросы HTTP POST:
- ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
- c-h####.g####.com/api.php?format=####&t=####
- logshan####.suixi####.com/maltdiary_log/active
- logshan####.suixi####.com/maltdiary_log/click
- logshan####.suixi####.com/maltdiary_log/install
- logshan####.suixi####.com/maltdiary_log/online
- norma-e####.m####.com/push/android/external/add.do
- peiz####.suixi####.com/app_config/queryConfig
- sdk.o####.p####.####.com/api.php?format=####&t=####
- spfe####.suixi####.com/MaltDiary/hotsales
- spfe####.suixi####.com/MaltDiary/recgoods
- spfe####.suixi####.com/MaltDiaryType/labletype
- spfe####.suixi####.com/app_config/queryConfig
- spfe####.suixi####.com/sxg_basedata/getHomePageWord
- tkl.suixi####.com/MaltDiaryDetail/detailpg
- tkl.suixi####.com/MaltDiaryDetail/getdetailbyid
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/00521383c4d4a9b8bade4e74dc3b7d8ca7446c4f9d1ff3b....0.tmp
- /data/data/####/01a0192434ccd4ab29b7c1eef8f586028a358ee27ebaec4....0.tmp
- /data/data/####/0341ef20f91a98c74673c9d658acb0dc4bcd53c78559b0b....0.tmp
- /data/data/####/05c8bf225dc602b1ce89a9e7b904276a8ce9aae56171187....0.tmp
- /data/data/####/0675d8f94df23d60c6fd29b454f0014aec4b58cb594b421....0.tmp
- /data/data/####/0a231bd8575dcf72.txt
- /data/data/####/0adc5e1bddfac43be7397a7b620a4fe73071bb01238edea....0.tmp
- /data/data/####/10e48e08e12987b72717c2dcd50c0c12ea0de97a89b4bd8....0.tmp
- /data/data/####/12fbe4a8f15af61349ba8479e16ce6a10798f0770e75f97....0.tmp
- /data/data/####/1322e4689317a94e9a8be1449b4a22f9b358f365cae66a5....0.tmp
- /data/data/####/13723b682f64da6ead1d05bbed8cd52d4f1d2ddb81b9c21....0.tmp
- /data/data/####/1e6ca66deaf9c050420df66fded5f4dd386b67ac6cf9f07....0.tmp
- /data/data/####/23d59108fcfbcd768429fcfe8ae0b1d7b36d6288942ae88....0.tmp
- /data/data/####/27888799186795034203d293c1d65a60f1a42396fd37644....0.tmp
- /data/data/####/29efcbb9cbfbf19baca0b29083435921cadd634be67ec50....0.tmp
- /data/data/####/2fcc2c75a2d27808affe236445178eaa986a27871fb587d....0.tmp
- /data/data/####/314f0adddde9f008ee57c8f5124ffff60be2843c6c6a2db....0.tmp
- /data/data/####/33bd74e19e4b8422ec17fb379a6a82aa6c89a2101c316ee....0.tmp
- /data/data/####/348f5707d0c4288313bfc4ffee0a64230d00a2a2ef6e04a....0.tmp
- /data/data/####/35837dd52a2f293e8281a040aede90f66e195f4ec75038c....0.tmp
- /data/data/####/3c0ca76a892fc2c05935690126ae78faec73445c83df7b2....0.tmp
- /data/data/####/3c74be633f347c822d87b1c3256d9494c9c246ee0e74cff....0.tmp
- /data/data/####/483f4b106bc3
- /data/data/####/497659f2a721d955e2e63882bf4fa083d017aace4cce42e....0.tmp
- /data/data/####/4eef2b3d14dca97b7adaf95ad84cdacb670a4b0ebd0ca6b....0.tmp
- /data/data/####/51f4b1aca4ad9d30d52afd2f6e27e284e048bf589997fd4....0.tmp
- /data/data/####/5335686e124ac3941afc67a7d66a647910c29c910089016....0.tmp
- /data/data/####/5d0239e2be64b2333318a328656a3d1e638fd50443f7758....0.tmp
- /data/data/####/6061462c4a38b06acbe87970af17ec80.0.tmp
- /data/data/####/6061462c4a38b06acbe87970af17ec80.1.tmp
- /data/data/####/629485bfb8c02e2cc775fc7fb3197c37d4917fa368b09c1....0.tmp
- /data/data/####/67af9bcdbe9cfd9ac3da9acaa47a7c55941e51f7d3c9308....0.tmp
- /data/data/####/6d58da5943c8b806ae54c1abfdbf4e2f3e4121cbdb106ab....0.tmp
- /data/data/####/6ecadfdae13b75ee2546a02b5f9def0c4309da8dbdacb47....0.tmp
- /data/data/####/6f6f0e6b7968b79f77af437aa1230889bddb25ebf51e402....0.tmp
- /data/data/####/71ccac88b858a33f8d7dc54e6400d71b3658a65a81e9e24....0.tmp
- /data/data/####/7337425c78368bbace4cadcc30535214b22da8cda4be173....0.tmp
- /data/data/####/738d5e9e0ca464b0b25e67898f3a5e8f32105e4082b1efd....0.tmp
- /data/data/####/7597f28d58315b35ac5ef3f8d1b8bc0ecacd3a2d146047f....0.tmp
- /data/data/####/7a1ca719c779795d57431107a5e5970ec22f99bb56b53ef....0.tmp
- /data/data/####/7b5c74a757a306684bb33d6a3572352cad78face6b88208....0.tmp
- /data/data/####/7d3753c62c78c7502c3a60b547acbb70935e5c4951a2265....0.tmp
- /data/data/####/846e74bc81e27693beb1312b94f849d3b8b2be6909b362a....0.tmp
- /data/data/####/84ba43b61d6877c8857756afa432810f8407f5a9cee8640....0.tmp
- /data/data/####/85f0413e5d22edf8cb0ffb79523060fa8b1d05a06d61096....0.tmp
- /data/data/####/8c5d35fbc7cbb96af429aabec734f5ad779fe097652b566....0.tmp
- /data/data/####/8ed7e73360701ce1761595a397b5da3fdf643803893cf51....0.tmp
- /data/data/####/91e8b6d079a2912b3b14d76f479b936569383fa6ff3b98b....0.tmp
- /data/data/####/9769570f3b3f54266255765502a081b412ce5d161e8029d....0.tmp
- /data/data/####/97e03c0c1555674d66556ce789a58bb00fd588d5616768a....0.tmp
- /data/data/####/9f210f9cd98d7c8ba2730926d5cc9f1941ee964014ef21a....0.tmp
- /data/data/####/AlibcLinkPartner.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/Q0VSVC5SU0EK.txt8e8
- /data/data/####/SGMANAGER_DATA2.tmp
- /data/data/####/SG_INNER_DATA
- /data/data/####/UTCommon.xml
- /data/data/####/_okhttputils.db-journal
- /data/data/####/a02a45d519b2156489f17e023a43ec0111d8746d0f016a4....0.tmp
- /data/data/####/a1fc073cd0e1dfacf23c95bb51367783d4de3462d42c1b1....0.tmp
- /data/data/####/ae3c7c1d300e79305a6d47a6bfb9db7f746370aba24d13a....0.tmp
- /data/data/####/aliTradeConfigSP.xml
- /data/data/####/ap.Lock
- /data/data/####/auth_sdk_device.xml
- /data/data/####/b31eded3f5e39b0980829fe825018741c24c30488646bb8....0.tmp
- /data/data/####/b371a2f25e8414bcd08dbc8a1a638c41401589bbca51326....0.tmp
- /data/data/####/b3b8b9d61157d0452791f0f8e358765b14b73e7f58b3480....0.tmp
- /data/data/####/b5bf46dee072d1075c794a937310e7f8af5ab01abbcee61....0.tmp
- /data/data/####/b9d9b0db7047a8a41cd6ce80c807e8f0980a886822f5b5a....0.tmp
- /data/data/####/bc25c653440014aa31207012e7e7856886bbf13e9ee6a14....0.tmp
- /data/data/####/bdcd8bb635c517f8f1bdeb3a9efbad6f802eb2cd55a5eb4....0.tmp
- /data/data/####/c62a1b10cc0aca192c5c3c1b2e8e7d2568c7c00bb2e01ec....0.tmp
- /data/data/####/c96c6c5e80322f7f5a0df1a551c89583d59556625130a4c....0.tmp
- /data/data/####/cafc2969a518ff7451297e75cd5076fe9fd853d5126bbec....0.tmp
- /data/data/####/cf2379a474d23f064d8458dcd175043a6bdfaa5f2ccde21....0.tmp
- /data/data/####/com.maiya.suixingou_preferences.xml
- /data/data/####/com.x.y.1.xml
- /data/data/####/com.x.y.2.xml
- /data/data/####/com_songheng_maiya__cache_data_commodity_list.xml
- /data/data/####/com_songheng_maiya__cache_data_commodity_list_json.xml
- /data/data/####/d15028d5f100c162087afdf6f25bc620a206d9bc567df08....0.tmp
- /data/data/####/d3e01aac45e26f6c4a2c49d7a5de254542bb147e0e9bb15....0.tmp
- /data/data/####/d4ad98ce5e1cdf7d86a865579a8cb7b68bcea8b58a333aa....0.tmp
- /data/data/####/data_0
- /data/data/####/data_0 (deleted)
- /data/data/####/data_1
- /data/data/####/data_1 (deleted)
- /data/data/####/data_2
- /data/data/####/data_2 (deleted)
- /data/data/####/data_3
- /data/data/####/data_3 (deleted)
- /data/data/####/db84a3fd4efd3fd0c69454a39e2d919807bec7a66a31272....0.tmp
- /data/data/####/dc7c09568643247325
- /data/data/####/dea9fe762f76b55d4b6d81809441afa7051c0bd2bb088ad....0.tmp
- /data/data/####/df0affc6e9679fd5a3303d55ff8306d8ee66ab1032e6e55....0.tmp
- /data/data/####/dfttsdk-db
- /data/data/####/dfttsdk-db-journal
- /data/data/####/e66a2462d731fd3313f59e028663498a3bc3148b7f01b86....0.tmp
- /data/data/####/f0a2546b14e16f35e7d1b5947e9a69266a2c0141be06e78....0.tmp
- /data/data/####/f3081252714bf153e7091febe863c74729726a19c9171e0....0.tmp
- /data/data/####/f554b9879db4024db4496b940b52b48f32ecfcae3d46aa1....0.tmp
- /data/data/####/f5e12e5c9d9b06efec62a7286731653c1241b99796d9b83....0.tmp
- /data/data/####/f7f3b67d0ec7a9c36f7dd6602eeab52c0a7e0d6a1d76c1a....0.tmp
- /data/data/####/f966515565199b3c8935d5847d5aad6f46b866aec3856d3....0.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/gxcoreframework_app_setting.xml
- /data/data/####/index
- /data/data/####/index (deleted)
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu1085314503.so
- /data/data/####/libsgmainso-5.4.67.so.tmp.2280
- /data/data/####/lock.lock
- /data/data/####/multidex.version.xml
- /data/data/####/mz_push_preference.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/sgFile.lock
- /data/data/####/sp.lock
- /data/data/####/tdata_GKE879
- /data/data/####/tdata_GKE879.jar
- /data/data/####/tdata_IfO862
- /data/data/####/tdata_IfO862.jar
- /data/data/####/timestamp
- /data/data/####/ut.db
- /data/data/####/ut.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/2018-12-04.log.txt
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.maiya.suixingou.bin
- /data/media/####/com.maiya.suixingou.db
- /data/media/####/dd7893586a493dc3
- /data/media/####/hid.dat
- /data/media/####/tdata_GKE879
- /data/media/####/tdata_IfO862
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/dc7c09568643247325
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.songheng.components.push.business.DfttPushService 24943 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.build.version.release
- getprop ro.miui.ui.version.name
- getprop ro.smartisan.version
- getprop ro.vivo.os.version
- mount
Загружает динамические библиотеки:
- Bugtags
- getuiext3
- libjiagu1085314503
- sgmainso-5.4
- ut_c_api
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
