Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) and####.cl####.miqings####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) i####.miqings####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(TLS/1.0) 2####.58.212.238:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.u####.com
- and####.cl####.miqings####.com
- c####.g####.ig####.com
- c-h####.g####.com
- i####.miqings####.com
- l####.tbs.qq.com
- log.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
Запросы HTTP GET:
- and####.cl####.miqings####.com//Bookajax/getUserMsgNum.do?&version=####&...
- and####.cl####.miqings####.com/bookajax/replycomment/version/1.4.8.do?P2...
- and####.cl####.miqings####.com/commentdetail/3164/20494.do?version=####&...
- et2-na6####.wagbr####.ali####.####.com/bar/get/5982befd7f2c741f3a001470/...
- i####.miqings####.com/Public/Client/android/1.4.8/css/style.css?ver=####
- i####.miqings####.com/Public/Client/android/1.4.8/images/ic_pl.png
- i####.miqings####.com/Public/Client/android/1.4.8/images/ic_zan.png
- i####.miqings####.com/Public/Client/android/1.4.8/js/conf/do_config.js?v...
- i####.miqings####.com/Public/Client/android/1.4.8/js/mod/functions.js?ve...
- i####.miqings####.com/Public/Client/common/js/conf/do_config.js?ver=####
- i####.miqings####.com/Public/Client/common/js/lib/do.js?ver=####
- i####.miqings####.com/Public/Client/common/js/lib/fastclick.js?ver=####
- i####.miqings####.com/Public/Client/common/js/lib/lazyload.js?ver=####
- i####.miqings####.com/Public/Client/common/js/lib/template.js?ver=####
- i####.miqings####.com/Public/Client/common/js/lib/templatehelper.js?ver=...
- i####.miqings####.com/Public/Client/common/js/lib/zepto.min.js?ver=####
- i####.miqings####.com/Public/Client/common/js/mod/common.js?ver=####
- i####.miqings####.com/Public/Client/common/js/mod/functions.js?ver=####
- i####.miqings####.com/avatar/001/94/38/99_avatar_middle.jpg?_t=####
- i####.miqings####.com/avatar/default/pic_05.jpg
- i####.miqings####.com/avatar/noavatar_big.gif
- i####.miqings####.com/bookface/0/13/1323_middle.jpg
- i####.miqings####.com/bookface/0/13/1395_large.jpg
- i####.miqings####.com/bookface/0/25/2502_middle.jpg
- i####.miqings####.com/bookface/0/29/2980_large.jpg
- i####.miqings####.com/bookface/0/29/2980_middle.jpg
- i####.miqings####.com/bookface/0/31/3148_middle.jpg
- i####.miqings####.com/bookface/0/31/3164_large.jpg
- i####.miqings####.com/bookface/0/38/3833_large.jpg
- i####.miqings####.com/bookface/0/42/4245_middle.jpg
- i####.miqings####.com/bookface/0/44/4439_large.jpg
- i####.miqings####.com/bookface/0/46/4626_large.jpg
- i####.miqings####.com/bookface/0/50/5086_large.jpg
- i####.miqings####.com/client/ic_ds_fenxiang.png
- i####.miqings####.com/client/ic_ds_lingqian.png
- i####.miqings####.com/client/ic_ds_xiazai.png
- i####.miqings####.com/img/bangdan/2019.01.31.540.jpg
- i####.miqings####.com/img/bangdan/2019.02.15.3164.540.jpg
- i####.miqings####.com/img/bangdan/jifen20180910150213.jpg
Запросы HTTP POST:
- a####.u####.com/app_logs
- and####.cl####.miqings####.com//ajax/getpopup.do?&P29=####&version=####&...
- and####.cl####.miqings####.com//ajax/getpopupconfig.do?&version=####&P27...
- and####.cl####.miqings####.com//listmodules?pageconfig=####&version=####...
- and####.cl####.miqings####.com//startread.do?&version=####&P27=####&P30=...
- and####.cl####.miqings####.com/Bookajax/getversion.do?&P27=####&P30=####...
- and####.cl####.miqings####.com/Pushajax/addUserBehavior?&version=####&P2...
- and####.cl####.miqings####.com/Pushajax/bindDevice?sex_flag=####&version...
- and####.cl####.miqings####.com/clientGetAuthorOtherBook?version=####&P27...
- and####.cl####.miqings####.com/clientGetBookComment?version=####&P27=###...
- and####.cl####.miqings####.com/clientGetBookInfo?version=####&P27=####&P...
- and####.cl####.miqings####.com/clientGetBookStatus?version=####&P27=####...
- and####.cl####.miqings####.com/clientGetRecommendBook?version=####&P27=#...
- and####.cl####.miqings####.com/clientbanner?version=####&P27=####&P30=##...
- c-h####.g####.com/api.php?format=####&t=####
- l####.tbs.qq.com/ajax?c=####&k=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/0b9e3cb6b2a5f4eab3959b6c180de3dfbbc38308d97562a....0.tmp
- /data/data/####/3bd3f48d70b339351865da5d2d1ab503cc3608ac3d9f9a8....0.tmp
- /data/data/####/429c4daf696e81a338c0d4f417be9c85b3ed2a651b30130....0.tmp
- /data/data/####/4899c12e2a06214278d79470d7398e586ed1fb26a45b17b....0.tmp
- /data/data/####/4ed8618081bb97cec4db3d99043b94bff0c936654d296e8....0.tmp
- /data/data/####/4f283f1ecb4d7218d2e99988dc2acec372595d2210db78f....0.tmp
- /data/data/####/58c64742f8b08381095a6e18398419481d668ebee24334f....0.tmp
- /data/data/####/5f67f5bd66e87cc214e880c4f60cf505a708eafc4a93845....0.tmp
- /data/data/####/63102705e9b8e63c1c7bade4c9e57c35b6a48be25ab66ae....0.tmp
- /data/data/####/716275d278c143771316ff5009178e6322a74a428a58153....0.tmp
- /data/data/####/7e273af928981ef49e0721796940f2a3abf77aedffee81c....0.tmp
- /data/data/####/88035715ce2afbcf7c892c7808f82ed67b411d0fbc1e2ce....0.tmp
- /data/data/####/8bff308a61e207f26764692954546f7a3f40edbf0da8b65....0.tmp
- /data/data/####/8cca3480f805b8b1f0cd482ee4a580953cac0011a0de338....0.tmp
- /data/data/####/94b4e95269525ca914a2727fbaa7f662062b79ba8f97b84....0.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/MiscDATA.xml
- /data/data/####/ReadSetting.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/a8e2d8b7be2ec286e49f895719e0cb4885d39facb48a689....0.tmp
- /data/data/####/b46ba5f8f1dcbf60af86f8f38d03815b8d0eb54a9d743ce....0.tmp
- /data/data/####/b745f4f8a5d666d7005e5c33e2bbfb7cbc761c826787277....0.tmp
- /data/data/####/ba0f72806bebd839cd4ac045222e0d6aca1efe118ce8db7....0.tmp
- /data/data/####/bb887a4e7ad8e3a7bff632a7e7216b787f2cb75037fa93c....0.tmp
- /data/data/####/c8c05a478180327c5cc6a7a01ce53a10083402735680ba3....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/core_info
- /data/data/####/d00cd4c7532ced65e5a387520d10f5dd7f7c8a509a1f1da....0.tmp
- /data/data/####/d57d066aba21085c6a06153acd4d83799776e7412e337d6....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/eb4e07df76de2a2d15c771e08315457383a33c0e74ff777....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f555e16507eb705bfd3ee2107cbf52786d556a60c817562....0.tmp
- /data/data/####/f_000001
- /data/data/####/fistInstall.xml
- /data/data/####/getui_sp.xml
- /data/data/####/hong.db
- /data/data/####/hong.db-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu415964623.so
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-2038076717
- /data/media/####/-882893688
- /data/media/####/.nomedia
- /data/media/####/360292.sht
- /data/media/####/360293.sht
- /data/media/####/360294.sht
- /data/media/####/360295.sht
- /data/media/####/360296.sht
- /data/media/####/360297.sht
- /data/media/####/360298.sht
- /data/media/####/360299.sht
- /data/media/####/360300.sht
- /data/media/####/360301.sht
- /data/media/####/452810.sht
- /data/media/####/452811.sht
- /data/media/####/452812.sht
- /data/media/####/452813.sht
- /data/media/####/452814.sht
- /data/media/####/452815.sht
- /data/media/####/452816.sht
- /data/media/####/452817.sht
- /data/media/####/452818.sht
- /data/media/####/452819.sht
- /data/media/####/725625527
- /data/media/####/859852.sht
- /data/media/####/859853.sht
- /data/media/####/859854.sht
- /data/media/####/859855.sht
- /data/media/####/859856.sht
- /data/media/####/859857.sht
- /data/media/####/859858.sht
- /data/media/####/859859.sht
- /data/media/####/859860.sht
- /data/media/####/859861.sht
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.miqingshucheng.bin
- /data/media/####/com.miqingshucheng.db
- /data/media/####/store_cache_grilzh_TW
- /data/media/####/store_category_grilzh_TW
- /data/media/####/store_free_grilzh_TW
- /data/media/####/store_rank_grilzh_TW
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu415964623.so
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- getuiext2
- libjiagu415964623
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- RSA-ECB-NoPadding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
