Adware.Gexin.6492

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) tvaw####.g####.sina####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 10rd####.qini####.com:80
TCP(HTTP/1.1) app.luobosh####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) tvaxw####.g####.sina####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) img1-do####.b0.a####.com:443
TCP(TLS/1.0) 1####.217.19.206:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) i####.doub####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

Запросы DNS:

7j####.c####.z0.####.com
a####.u####.com
aexcep####.b####.qq.com
and####.b####.qq.com
app.luobosh####.com
c####.g####.ig####.com
c-h####.g####.com
i####.doub####.com
i####.doub####.com
l####.hig####.me
pv.s####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
ssl.gst####.com
t####.sin####.cn
t####.sin####.cn
t####.sin####.cn
thi####.q####.cn
thi####.q####.cn
www.go####.com
www.gst####.com

Запросы HTTP GET:

10rd####.qini####.com/-1/154443959772891.jpg
10rd####.qini####.com//excerptBG/lowerBG/1086/hdpi
10rd####.qini####.com/56f9ee8ee4b0385755214a77/153383037335090.jpg
10rd####.qini####.com/578e4003e4b0a743964a8a89/149667315147761.jpg
10rd####.qini####.com/57c3def7e4b03bebafb9f92c/153490856965554.jpg
10rd####.qini####.com/58288821e4b04124f4f91af9/152529921542651.jpg
10rd####.qini####.com/58319250e4b04d7562607526/147971521867702.jpg
10rd####.qini####.com/5831bc8be4b04d756261664e/154384029376535.jpg
10rd####.qini####.com/5868d1bce4b07fa822adc76f/148664951709432.jpg
10rd####.qini####.com/586f4cd7e4b07fa822bb9251/154086242074495.jpg
10rd####.qini####.com/5874feeae4b07fa822c99870/152099873794401.jpg
10rd####.qini####.com/58875bb5e4b05cc815fd13f3/150395967718024.jpg
10rd####.qini####.com/589aff7ce4b0065bd09730a1/153546840116706.jpg
10rd####.qini####.com/593e2114e4b0a7859217bb9b/153401485122208.jpg
10rd####.qini####.com/59827f04e4b0e75c110a511e/150270249935990.jpg
10rd####.qini####.com/59899a16e4b0e75c1123cf2a/154470441004172.jpg
10rd####.qini####.com/599d7a00e4b03f37f0c916c6/151237677485684.jpg
10rd####.qini####.com/59b7d505e4b0273735a13b9c/153285454845273.jpg
10rd####.qini####.com/59b94aefe4b0273735a3775d/152354730085903.jpg
10rd####.qini####.com/5a12dd8be4b0005f956d1a23/151521231630842.jpg
10rd####.qini####.com/5a98a679e4b03f09173cdd4e/152075417128346.jpg
10rd####.qini####.com/5b497a44e4b0886dd5f9e7b8/153871962838748.jpg
10rd####.qini####.com/5b94a79fe4b0d3628b3d17fc/154238051596991.jpg
10rd####.qini####.com/defaultProfileImage.jpg
10rd####.qini####.com/excerptBG/CPUrl/1029/hdpi
10rd####.qini####.com/excerptBG/CPUrl/1086/hdpi
10rd####.qini####.com/excerptBG/NSPUrl/1029/hdpi
10rd####.qini####.com/excerptBG/NSPUrl/1086/hdpi
10rd####.qini####.com/excerptBG/PSDUrl/1029/hdpi
10rd####.qini####.com/excerptBG/PSDUrl/1086/hdpi
10rd####.qini####.com/excerptBG/PSUUrl/1029/hdpi
10rd####.qini####.com/excerptBG/PSUUrl/1086/hdpi
10rd####.qini####.com/excerptBG/lowerBG/1086/hdpi
10rd####.qini####.com/excerptBG/perceptionBG/1029/hdpi
10rd####.qini####.com/excerptBG/perceptionBG/1086/hdpi
10rd####.qini####.com/excerptBG/tiledBG/1029/hdpi
10rd####.qini####.com/excerptBG/tiledBG/1086/hdpi
10rd####.qini####.com/excerptBG/upperBG/1029/hdpi
10rd####.qini####.com/excerptBG/upperBG/1086/hdpi
10rd####.qini####.com/luobooms/longArticle/15371523087519.jpg
10rd####.qini####.com/luobooms/longArticle/153856037914643.jpg
10rd####.qini####.com/luobooms/longArticle/154013418577939.jpg
10rd####.qini####.com/luobooms/longArticle/154251956458326.jpg
10rd####.qini####.com/luobooms/longArticle/15425196767114.jpg
10rd####.qini####.com/luobooms/longArticle/15425196963561.jpg
10rd####.qini####.com/luobooms/longArticle/154251973244738.jpg
10rd####.qini####.com/luobooms/longArticle/15425197609359.jpg
10rd####.qini####.com/luobooms/longArticle/154251978070566.jpg
10rd####.qini####.com/luobooms/longArticle/154251979639382.jpg
10rd####.qini####.com/luobooms/longArticle/154398344247514.jpg
10rd####.qini####.com/luobooms/longArticle/154467891147761.jpg
10rd####.qini####.com/luobooms/longArticle/154467894158143.jpg
10rd####.qini####.com/splashAd/1041/hdpi
gdv.a.s####.com/cityjson?ie=####
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_ntt510
thi####.q####.cn/mmopen/vi_32/O3S0AHKOfFiaXSpjTAftd9YwUhfR5Fffju7TwopDeZ...
thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTJ8AIWicxca3uHUXOEhKMKuTJdWLHVFnU...
thi####.q####.cn/mmopen/vi_32/WHzIOLKiaKIvFAiaCStkNIoa99F8hJvd2lldsVCNa6...
thi####.q####.cn/qqapp/1104888272/0F48B24895A6FDF3DF0F178E031D5514/100
thi####.q####.cn/qqapp/1104888272/48CEF97F1E9A22EDF2011F4C19196DD5/100
thi####.q####.cn/qqapp/1104888272/51008D328882C6D3B7D8CCAB540A561F/100
thi####.q####.cn/qqapp/1104888272/E086ADC90D314F362D464CF96002DF11/100
thi####.q####.cn/qqapp/1104888272/F3F73F0FAEC254FB35DD2A361CC58918/100
ti####.c####.l####.####.com/config/hz-hzv3.conf
tvaw####.g####.sina####.com/crop.0.0.180.180.180/825b0727jw1e8qgp5bmzyj2...
tvaxw####.g####.sina####.com/crop.0.0.1242.1242.180/cb620c86ly8fi59s8syk...
tvaxw####.g####.sina####.com/crop.0.0.664.664.180/007uQFIwly8fxqhy5a0r5j...

Запросы HTTP POST:

a####.u####.com/app_logs
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
app.luobosh####.com/luoboserver/discover/list
app.luobosh####.com/luoboserver/excerpt/bgBlockList
app.luobosh####.com/luoboserver/excerpt/layout
app.luobosh####.com/luoboserver/excerpt/list
app.luobosh####.com/luoboserver/excerpt/select
app.luobosh####.com/luoboserver/excerpt/unlockBG
app.luobosh####.com/luoboserver/parameter/list
app.luobosh####.com/luoboserver/recommend/bookSet
app.luobosh####.com/luoboserver/user/activate
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1490355015
/data/data/####/-2015697543
/data/data/####/-2141744983
/data/data/####/.imprint
/data/data/####/1004
/data/data/####/1056642461
/data/data/####/1437647836
/data/data/####/406988981780129038
/data/data/####/832993036
/data/data/####/93027657
/data/data/####/947181164
/data/data/####/APP_GAOSHOU_KEY.xml
/data/data/####/BLOOMLIFE.xml
/data/data/####/MultiDex.lock
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/crashrecord.xml
/data/data/####/exchangeIdentity.json
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libnfix.so
/data/data/####/libshella-2.8.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/luobo-journal
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_ntt510
/data/data/####/tdata_ntt510.jar
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/media/####/.nomedia
/data/media/####/10v8x1egamha5c8e4iwcqvu0.tmp
/data/media/####/118sbhxtpqm20t5aal6yew4hs.tmp
/data/media/####/11rxfi5f867wmues0p6wc29bb.tmp
/data/media/####/14nr6xtavgymkq6m3nrreg8a7.tmp
/data/media/####/18-12-13.html
/data/media/####/18grl5cvr3yncdielkt118l3y.tmp
/data/media/####/1e99l82v1ohmsi4bolo8z7jmk.tmp
/data/media/####/1kxbov9rw3o61sb4ymipnxnel.tmp
/data/media/####/1mgspev1hcmy4vcdebkb58f3x.tmp
/data/media/####/1oi8yi95nilsftps6eun77131.tmp
/data/media/####/1rskdup27ork8t5lsk3q8znf2.tmp
/data/media/####/1su1dmlln3ka4b562mi66oh0n.tmp
/data/media/####/1vh0e21u3x294fo1xrz3y2klq.tmp
/data/media/####/1wf54lfg9n76gl1uja1lzuv7n.tmp
/data/media/####/2101wxhzf9mdn4zm664n1ibm9.tmp
/data/media/####/29he7znej72vtgqoh255s8n0z.tmp
/data/media/####/2a5xjgdq0jampspvwy0m9ynu2.tmp
/data/media/####/2ftiqlg5q6su7b13jedqj52dz.tmp
/data/media/####/2lq1je6169d909k8wh6re554m.tmp
/data/media/####/2mnsjmj80b54wl2s594cii5bf.tmp
/data/media/####/2o9u7z17cvm2d04k4rag8jg49.tmp
/data/media/####/2ouwwym29eiqsb2c87ujqn3xs.tmp
/data/media/####/36mu5w7knvtnzj7jh2b2c8zyj.tmp
/data/media/####/380b5d2cqzdoa6sfvwuwbul48.tmp
/data/media/####/3aj0kaz8cqvwm9un8q6ckycye.tmp
/data/media/####/3bolf8a4aupw2dwmk0fevdwpp.tmp
/data/media/####/3i6kgdxi7b22s9274x90zy67y.tmp
/data/media/####/3iomi4iod0m1rib5gbnq6w9zd.tmp
/data/media/####/3j362kb9mspenu0p1k2zuq98j.tmp
/data/media/####/3jrlw596gd93pmlgpqk1em0zo.tmp
/data/media/####/3o8tvsf0oilbhn62jxt61mg3l.tmp
/data/media/####/3q1ckedrlfmq989n6j1d2kx1i.tmp
/data/media/####/3vuoa0uo99r87fqmc249o669y.tmp
/data/media/####/41r0wwj48mrqlj14epr6chqsg.tmp
/data/media/####/43lie34rz9alddkms1hyy2shz.tmp
/data/media/####/45lsksnmtmvctmbac6ia27hco.tmp
/data/media/####/45xo6h30q1spq79x0xbhbnca8.tmp
/data/media/####/4609bkafctjdyykfujpamldog.tmp
/data/media/####/4684fosyqnxf03vvlmjumm46h.tmp
/data/media/####/4j2vgqahu3japz4y269e1nsv5.tmp
/data/media/####/4pbxs56bth4plvbue33bzfsan.tmp
/data/media/####/4y2uwy1se1vaslzmpdir50xx7.tmp
/data/media/####/4yukxgbwz1hxu3w51ffdye6lp.tmp
/data/media/####/51s357uq2d3qnls9hntkt546u.tmp
/data/media/####/524hvagn436uem2xxjun2h4tq.tmp
/data/media/####/57d3hzajzv0i8mrqylypbu01f.tmp
/data/media/####/5ca4ogp1h2cnrzdsv6c49ruh8.tmp
/data/media/####/5iosy54yzoknpqmmkv0xhomzu.tmp
/data/media/####/5n30o6u31qwq25hivdzq4757c.tmp
/data/media/####/5n7rnao4fhh141hmwgyt3ctmh.tmp
/data/media/####/5o7w3bu49g3be3n0z4zu3660z.tmp
/data/media/####/5qqhywc5i5hiq4gmjz62rlujb.tmp
/data/media/####/5u93njuvdvjjx8y2pygcjqdvu.tmp
/data/media/####/5uo8w4l28bclguwttqthy5wg9.tmp
/data/media/####/5zngpbkai3kdta7kfe04lrric.tmp
/data/media/####/5zrotiq36wqk64squz4ztlpfp.tmp
/data/media/####/61um31sm0c74wl8rxppycv1z2.tmp
/data/media/####/68fuox03snoyuxiylj1ap7b9w.tmp
/data/media/####/6hedpqz1s8q22bdfszieiruh6.tmp
/data/media/####/6hekuj0r2iwiw5ju3q7wmzjx3.tmp
/data/media/####/6mbgjtrckhnsjv0robtz504xf.tmp
/data/media/####/6n5r52m93rbhaf3idkl8qbff7.tmp
/data/media/####/6oiwm8cfcwkqchkweqpqc3psk.tmp
/data/media/####/6t98ai4583p1i9slek78l9wwf.tmp
/data/media/####/6unnp543c8tuqqfir5ldkagmb.tmp
/data/media/####/6vyt8ycjxexcffaqb6xnyhvgd.tmp
/data/media/####/6yi1ft4sb5a967mz2c2y6xb61.tmp
/data/media/####/75sftm1uyr5jkvdpngye88hgm.tmp
/data/media/####/7af3u6t6hniee5uaiowquokh6.tmp
/data/media/####/7cqn4o9ga45q8jhb1tbt70om4.tmp
/data/media/####/7e5l7xjzbgwebszhtorh3xs35.tmp
/data/media/####/7ixn6q4ku6bcbt3y3j2dkz15m.tmp
/data/media/####/7kbjm51zu95dpdpra9oovsmfv.tmp
/data/media/####/7mxgikxotoevwh0i1ua9rurt.tmp
/data/media/####/app.db
/data/media/####/c96pnlb5r32s9cqe2k4buxav.tmp
/data/media/####/com.bloomlife.luobo.bin
/data/media/####/com.bloomlife.luobo.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/eop10xv7yqpjeqjq1b1w0i1e.tmp
/data/media/####/imd0bl6h7748h8nkl31lglqv.tmp
/data/media/####/inp2i759xxyn8v1sifyq0m82.tmp
/data/media/####/lpotof09jev7yi7ertz00939.tmp
/data/media/####/mkivc3fxzfqg1su410n4b8h.tmp
/data/media/####/tdata_Soq141
/data/media/####/tdata_ntt510
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GeTuiPushService 24909 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GeTuiPushService 24909 300 0

Загружает динамические библиотеки:

Bugly
getuiext2
libnfix
libshella-2.8
libufix
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней