Adware.Gexin.8135

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) o####.pape####.cn:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 2c52####.cdn.uc####.####.cn:80
TCP(HTTP/1.1) 2####.107.1.1:80
TCP(TLS/1.0) schedul####.yo####.com:443
TCP(TLS/1.0) bbl.xueb####.com:443
TCP(TLS/1.0) 1####.217.20.78:443
TCP c####.g####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
7x####.c####.z0.####.com
bbl.xueb####.com
c####.g####.ig####.com
c-h####.g####.com
o####.pape####.cn
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
tj.youza####.com
wb####.u####.uc####.####.cn

Запросы HTTP GET:

2c52####.cdn.uc####.####.cn/2ea025991362c8bb50dc91b4f0d6055c.apk
2c52####.cdn.uc####.####.cn/4f6bf9061211c831b0b2a452a9ef649c.apk
2c52####.cdn.uc####.####.cn/65515251ff01dd7eb97e3c8f7dcbc6eb.apk
2c52####.cdn.uc####.####.cn/763509a7cf31552133d7ccf16c8c3141.apk
2c52####.cdn.uc####.####.cn/979be035e116c22dd1d007c13681077e.apk
2c52####.cdn.uc####.####.cn/9c00271c997bae45b1748165e408d442.apk
2c52####.cdn.uc####.####.cn/ab614bce2bdc3193adf8395318bc6e18.apk
2c52####.cdn.uc####.####.cn/b11b04dc6fda379d3573be42581c8753.apk
2c52####.cdn.uc####.####.cn/b704d4634ca35a90467d6e56e6182648.apk
2c52####.cdn.uc####.####.cn/c5d26ea482f4e1d4ddc333966ec9b62c.apk
2c52####.cdn.uc####.####.cn/c79723b6faa6bf4c536826d79c1b3523.apk
2c52####.cdn.uc####.####.cn/c91d89e56c45301a91b87029ee3992c3.apk
2c52####.cdn.uc####.####.cn/cb25437e0b99191a244cac40ea299cf7.apk
2c52####.cdn.uc####.####.cn/eff3cff84607b852e9ffed54403bec12.apk
t####.c####.q####.####.com/android_theme_special_christmas.apk
t####.c####.q####.####.com/android_theme_special_newyear.apk
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_IKl114
t####.c####.q####.####.com/tdata_RbW195
t####.c####.q####.####.com/tdata_hqM577

Запросы HTTP POST:

c-h####.g####.com/api.php?format=####&t=####
o####.pape####.cn/api/v1/ClientCheck
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/.setting
/data/data/####/UUID
/data/data/####/UUID_N
/data/data/####/_nohttp_cache_db.db
/data/data/####/_nohttp_cache_db.db-journal
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.wenba.bangbang_prefs.xml
/data/data/####/com.youzan.mobile.AnalyticsPrefs.xml
/data/data/####/events
/data/data/####/events-journal
/data/data/####/gdaemon_20161017
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c.pid
/data/data/####/libjiagu53689302.so
/data/data/####/mobclick_agent_cached_com.wenba.bangbang5004001
/data/data/####/multidex.version.xml
/data/data/####/p_comp-1007002-false.apk.nohttp
/data/data/####/p_message-1006002-false.apk.nohttp
/data/data/####/p_scanword-1006004-false.apk.nohttp
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/setting.xml
/data/data/####/shuzilm.db
/data/data/####/special_christmas-5004001.temp
/data/data/####/special_christmas-5004001.temp.nohttp
/data/data/####/special_newyear-5004001.temp
/data/data/####/special_newyear-5004001.temp.nohttp
/data/data/####/tdata_IKl114
/data/data/####/tdata_IKl114.jar
/data/data/####/tdata_RbW195
/data/data/####/tdata_RbW195.jar
/data/data/####/tdata_hqM577
/data/data/####/tdata_hqM577.jar
/data/data/####/umeng_general_config.xml
/data/data/####/update_p_comp-1007002-false.apk
/data/media/####/.nomedia
/data/media/####/UUID
/data/media/####/UUID_N
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.wenba.bangbang.db
/data/media/####/event_9fa49a73f716438bbdc9f439673203c3.args
/data/media/####/event_9fa49a73f716438bbdc9f439673203c3.log
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/lut
/data/media/####/sequence_number
/data/media/####/tdata_IKl114
/data/media/####/tdata_RbW195
/data/media/####/tdata_hqM577
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24752 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
ls /dev/socket
netstat
service call iphonesubinfo 1
sh -c cat /proc/cpuinfo
sh -c cat /proc/net/arp
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid