Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.27.163.136:7878
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) pass####.z####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) o####.z####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) ce####.z####.com:80
- TCP(TLS/1.0) api.w####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) gdv.a.s####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) ce####.z####.com:443
Запросы DNS:
- a####.b####.qq.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- api.w####.com
- ce####.z####.com
- cgi.con####.qq.com
- g####.z####.com
- h####.b####.com
- hm.b####.com
- o####.z####.com
- openmo####.qq.com
- pass####.z####.com
- pv.s####.com
- sdk.o####.p####.####.com
- www.z####.com
Запросы HTTP GET:
- ce####.z####.com/
- ce####.z####.com/_src/css/animation.css?1792400####
- ce####.z####.com/_src/css/dialog.css?1792400####
- ce####.z####.com/_src/css/i_0323.css?1792400####
- ce####.z####.com/_src/css/i_0828.css?1792400####
- ce####.z####.com/_src/css/index.min.css?1792400####
- ce####.z####.com/_src/css/sharesview.css?1792400####
- ce####.z####.com/_src/css/swiper_modify.css?1792400####
- ce####.z####.com/_src/css/zt/cssjs/Normalize.css
- ce####.z####.com/_src/css/zt/cssjs/c.css
- ce####.z####.com/_src/css/zt/cssjs/font-awesome-4.7.0/css/font-awesome.m...
- ce####.z####.com/_src/css/zt/cssjs/human-format.css
- ce####.z####.com/_src/js/commonInit.js?1792400####
- ce####.z####.com/_src/js/dialog-min.js?1792400####
- ce####.z####.com/_src/js/login.js?1792400####
- ce####.z####.com/_src/js/swiper.js?1792400####
- ce####.z####.com/_src/js/window.js?1792400####
- ce####.z####.com/account/stock/ajax_stock_info/?symbol=####
- ce####.z####.com/ajax/news?id=####
- ce####.z####.com/img/20180322index_03.png
- ce####.z####.com/img/appD.png
- ce####.z####.com/img/appdownload2.png
- ce####.z####.com/img/blog/cover/small/20.png
- ce####.z####.com/img/blog/cover/small/28.png
- ce####.z####.com/img/blog/cover/small/50.png
- ce####.z####.com/img/bottom//b_01.png
- ce####.z####.com/img/bottom//b_02.png
- ce####.z####.com/img/bottom//b_03.png
- ce####.z####.com/img/bottom//b_04.png
- ce####.z####.com/img/bottom//b_05.png
- ce####.z####.com/img/bottom//b_06.png
- ce####.z####.com/img/bottom/b_logo.png
- ce####.z####.com/img/cwfx1218new.png
- ce####.z####.com/img/erweima_03.png
- ce####.z####.com/img/favorite.png
- ce####.z####.com/img/gpfx1218new.png
- ce####.z####.com/img/hgfx1218new.png
- ce####.z####.com/img/index/app0622.png
- ce####.z####.com/img/index/center.png
- ce####.z####.com/img/index/i_12.png
- ce####.z####.com/img/index/i_13.png
- ce####.z####.com/img/index/i_24.png
- ce####.z####.com/img/index/i_26.png
- ce####.z####.com/img/index/i_28.png
- ce####.z####.com/img/index/i_37.png
- ce####.z####.com/img/index/i_41.png
- ce####.z####.com/img/index/i_43.png
- ce####.z####.com/img/index/i_45.png
- ce####.z####.com/img/index/i_47.png
- ce####.z####.com/img/index/i_49.png
- ce####.z####.com/img/index/i_55.png
- ce####.z####.com/img/index/i_56.png
- ce####.z####.com/img/index/i_57.png
- ce####.z####.com/img/index/i_58.png
- ce####.z####.com/img/index/i_59.png
- ce####.z####.com/img/index/i_65.png
- ce####.z####.com/img/index/logo.png
- ce####.z####.com/img/index/to_left.png
- ce####.z####.com/img/index/to_right.png
- ce####.z####.com/img/index/yinhao_03.png
- ce####.z####.com/img/jczs1218new.png
- ce####.z####.com/img/jyzn1218new.png
- ce####.z####.com/img/rightNav/app.png
- ce####.z####.com/img/rightNav/app_ewm.png
- ce####.z####.com/img/rightNav/close.png
- ce####.z####.com/img/rightNav/gzh.png
- ce####.z####.com/img/rightNav/gzh_ewm.png
- ce####.z####.com/img/rightNav/pay.png
- ce####.z####.com/img/rightNav/qq.png
- ce####.z####.com/img/rightNav/wx.png
- ce####.z####.com/img/s/dl_03.png
- ce####.z####.com/img/s/dl_05.png
- ce####.z####.com/img/s/dl_07.png
- ce####.z####.com/img/xgff1218new.png
- ce####.z####.com/img/zt/img/00.jpg
- ce####.z####.com/img/zt/img/icon1.png
- ce####.z####.com/img/zt/img/img1.png
- ce####.z####.com/img/zt/img/img10.png
- ce####.z####.com/img/zt/img/img2.png
- ce####.z####.com/img/zt/img/img3.png
- ce####.z####.com/img/zt/img/img4.png
- ce####.z####.com/img/zt/img/img5.png
- ce####.z####.com/img/zt/img/img6.png
- ce####.z####.com/img/zt/img/img7.png
- ce####.z####.com/img/zt/img/img8.png
- ce####.z####.com/img/zt/img/img9.png
- ce####.z####.com/img/zt/img/top3bg.png
- ce####.z####.com/img/zt/img/topbg.jpg
- ce####.z####.com/login/userinfo/?callback=####&rev=####
- ce####.z####.com/plugins/jquery-validation/js/customer-methods.js
- ce####.z####.com/plugins/jquery-validation/js/jquery.validate.min.js
- ce####.z####.com/plugins/jquery.browser.js
- ce####.z####.com/plugins/jquery.min.js
- ce####.z####.com/rest/json/?category=####&device_type=####&api_sig=####&...
- ce####.z####.com/rest/json/?device_type=####&api_sig=####&api_key=####&m...
- ce####.z####.com/rest/json/?device_type=####&api_sig=####&api_key=####&p...
- ce####.z####.com/zt/2018t4/
- o####.z####.com/avatar/10253-1ffc80d949431s.jpg
- o####.z####.com/avatar/1129903-24ea6f2c51724s.jpg
- o####.z####.com/avatar/1173097-29b4c8bdf1223.jpg
- o####.z####.com/avatar/1315775-298ec358d0e8cs.jpg
- o####.z####.com/avatar/1667765-2755bc520ce8bs.jpg
- o####.z####.com/avatar/1684667-273012fe69ab3s.jpg
- o####.z####.com/avatar/1707403-29a6a180d38dds.jpg
- o####.z####.com/avatar/17153-1ff0b37cffc40s.jpg
- o####.z####.com/avatar/1728659-29ccb48196e4f.jpg
- o####.z####.com/avatar/1744509-2987dfb55ebf6s.jpg
- o####.z####.com/avatar/1791321-29c6964cf1092.jpg
- o####.z####.com/avatar/18026070890-24ea6c8b19a00s.jpg
- o####.z####.com/avatar/1806086-29a6bd06a9c51s.jpg
- o####.z####.com/avatar/379781-2e6968d11801a.jpg
- o####.z####.com/avatar/641935-1fea36086ed39s.jpg
- o####.z####.com/banner/14-2c0606445b752.png
- o####.z####.com/banner/208-2c061b427a642.png
- o####.z####.com/banner/210-2c061b617d1c5.png
- o####.z####.com/banner/233-2c1e779e0d837.png
- o####.z####.com/banner/253-2c05f89412225.png
- o####.z####.com/banner/359-2c24a00f72258.png
- o####.z####.com/banner/399-2c3e88acdea84.png
- o####.z####.com/banner/400-2e69622e1d17e.png
- o####.z####.com/banner/401-2e69624a96893.png
- o####.z####.com/banner/403-2e6a4da095294.jpg
- o####.z####.com/banner/405-2e6a4dae4dcdb.jpg
- o####.z####.com/banner/48-2c06062ba4fec.png
- pass####.z####.com/img/avatar/00.png
- pass####.z####.com/sso/?command=####&broker=####&token=####&checksum=###...
Запросы HTTP POST:
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- ce####.z####.com/rest/json/
- sdk.o####.p####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/1b6e8da4ec1303da53ae7fc0de4de673ea9e638e1ea3d9a....0.tmp
- /data/data/####/3c8124bed6fbbb0f4355f3e564269c6674fad1bf999dd69....0.tmp
- /data/data/####/MultiDex.lock
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__send_data_1548686306534
- /data/data/####/baidu_mtj_sdk_record.xml
- /data/data/####/bugly_db_legu-journal
- /data/data/####/com.tencent.open.config.json.205998
- /data/data/####/com.zbmf.StockGroup-journal
- /data/data/####/com.zbmf.StockGroupGroup_SettingDefaultsManager.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/getui_sp.xml
- /data/data/####/group_chat_db
- /data/data/####/group_chat_db-journal
- /data/data/####/index
- /data/data/####/init_c1.pid
- /data/data/####/init_er.pid
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.1.1.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/security_info
- /data/data/####/stock_group-journal
- /data/data/####/thinkive.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/weibo_sdk_aid1
- /data/media/####/-1767985482.tmp
- /data/media/####/-1866806042.tmp
- /data/media/####/-312774211.tmp
- /data/media/####/-401834371.tmp
- /data/media/####/-683506728.tmp
- /data/media/####/-729636098.tmp
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.timestamp
- /data/media/####/2010754152.tmp
- /data/media/####/2018142320.tmp
- /data/media/####/2096641605.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.1.1.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.display.id
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.smartisan.version
- getprop ro.vivo.os.build.display.id
- getprop ro.vivo.os.version
- getprop ro.yunos.version
- logcat -d -v threadtime
Загружает динамические библиотеки:
- Bugly
- crash_analysis
- getuiext2
- libnfix
- libshella-2.9.1.1
- libufix
- nfix
- ufix
- weibosdkcore
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-GCM-NoPadding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию о настроках APN.
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
