Adware.Gexin.9237

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) m####.h####.com:80
TCP(HTTP/1.1) do.yy.du####.com:80
TCP(HTTP/1.1) 2####.119.214.17:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) kingsof####.b####.yy.####.com:80
TCP(HTTP/1.1) updat####.yy.com:80
TCP(HTTP/1.1) zon####.bs2.yy.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) cloud####.fengkon####.com:80
TCP(HTTP/1.1) short-y####.yy.com:80
TCP(HTTP/1.1) e####.bs####.yy.com:80
TCP(HTTP/1.1) m####.h####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) f####.fengkon####.com:80
UDP(TELNET) 1####.90.175.158:23
UDP(TELNET) 2####.170.50.135:23
TCP(TLS/1.0) cdn.h####.com:443
TCP(TLS/1.0) w####.yyst####.com:443
TCP(TLS/1.0) m####.h####.com:443
TCP(TLS/1.0) e####.bs####.yy.com:443
TCP(TLS/1.0) co####.h####.com:443
TCP(TLS/1.0) y####.du####.com:443
TCP(TLS/1.0) short-y####.yy.com:443
TCP(TLS/1.0) abtes####.yy.com:443
TCP(TLS/1.0) updat####.yy.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) web.yyst####.com:443
TCP(TLS/1.0) wap.cmpass####.com:8443
TCP(TLS/1.0) r####.yy.com:443
TCP(TLS/1.0) is.sn####.com:443
TCP 2####.119.215.161:80
UDP 58.52.1####.230:94
TCP ope####.m.ta####.com:443
UDP 61.1####.52.149:80
TCP 1####.29.177.103:6888
UDP 61.1####.52.174:6002
TCP sdk.o####.t####.####.com:5224
TCP 1####.239.231.125:8092
UDP 4####.56.75.12:4002
UDP 61.1####.73.148:6002
UDP 60.2####.219.164:5002
TCP 1####.247.249.123:8088
TCP c####.g####.ig####.com:5227
UDP 61.1####.29.215:6002
TCP 1####.247.249.98:6002
TCP 1####.6.25.9:8080
UDP 60.2####.219.164:80
TCP 1####.185.109.74:89
UDP 1####.242.117.100:5002
TCP 1####.242.117.100:5002
UDP 61.1####.73.148:5002
TCP 58.52.1####.230:94
TCP 1####.9.223.59:86
UDP 1####.247.249.98:6002

Запросы DNS:

7j####.c####.z0.####.com
a####.3g.yy.com
a####.3g.yy.com
a####.man.aliy####.com
abtes####.yy.com
ag####.m.ta####.com
amdc####.m.ta####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.h####.com
cloud####.fengkon####.com
co####.h####.com
crash-r####.yy.com
d####.3g.yy.com
da####.yy.com
do.yy.du####.com
e####.bs####.yy.com
f####.fengkon####.com
gray-co####.yy.com
is.sn####.com
k####.h####.com
m####.h####.com
mobilel####.b####.yy.com
norma-e####.m####.com
p####.yy.com
plb####.u####.com
r####.yy.com
screen####.dwst####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
short-y####.yy.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
updat####.yy.com
w####.yy.com
w####.yyst####.com
w####.yyst####.com
w####.yyst####.com
w-yy####.yy.com
wap.cmpass####.com
web.yyst####.com
y####.du####.com
y####.h####.com
zon####.bs####.yy.com
zon####.bs2.yy.com

Запросы HTTP GET:

do.yy.du####.com/dynamic-shunt-data/type2/109/AudioengineConfig
do.yy.du####.com/dynamic-shunt-data/type2/109/Hw264Config
e####.bs####.yy.com/NTg0MzMzNGQtZjRlMi00YmNlLThiODEtMjUzZGE2ZDM1N2Qw.jpg...
e####.bs####.yy.com/NmU4MjMzZWEtNzMwNy00OWZmLWE3NmEtN2ZhZWE2YmNmNGU5.jpg...
e####.bs####.yy.com/NzQwYjYwNWMtZWU2YS00NjRjLWIxM2EtZmI3YWFkN2U1NTY0.png...
e####.bs####.yy.com/YTUxYjA0OTUtM2MxMi00OTZhLTk2ZjEtOTM0MDgwZTM4N2Jh.jpg...
e####.bs####.yy.com/YTgxY2RhODItODFmNC00YzFmLTk1YzgtMTY4OTY3NzMyZmU5.png...
e####.bs####.yy.com/YTliNmU3NGMtNjdjYS00MjQ3LTk3YTEtZjI1NmU5OTlhMWIx.gif
e####.bs####.yy.com/group16/M00/9327/20190218_1722087834426.xml
e####.bs####.yy.com/yysnapshot/412df27cc22534a5a1baebb4473c899d071b0277?...
e####.bs####.yy.com/yysnapshot/4cf69abff54c8934a1752816ea60c71b90abbb00?...
e####.bs####.yy.com/yysnapshot/afaf3ffe203ee3c1011efce1a1c107d3207dec65?...
e####.bs####.yy.com/yysnapshot/c5503354623e74cfad983e38cb2d838721a5b21d?...
e####.bs####.yy.com/yysnapshot/fc3a615b3786654784a657703e385e683067f636?...
kingsof####.b####.yy.####.com/1844810489_1542894694.jpg?ips_thumbnail/3/...
kingsof####.b####.yy.####.com/2359273255_1546418815.829783.jpg?ips_thumb...
m####.h####.com/c.gif?act=####&time=####&key=####&appid=####&scene=####&...
norma-e####.m####.com/android/exchange/getpublickey.do
t####.c####.q####.####.com/tdata_JNg986
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_nxn539
t####.c####.q####.####.com/tdata_zzW503
ti####.c####.l####.####.com/config/hz-hzv3.conf
updat####.yy.com/api/1/forceversion/getAll?user=####&nounce=####&time=##...
updat####.yy.com/c.gif?ot=####&dr2=####&nt=####&sr=####&sbd=####&sd=####...
updat####.yy.com/schedule/offch?uid=####&yyVersion=####&os=####&model=##...
updat####.yy.com/speed/android/activate?uid=####&yyVersion=####&os=####&...
updat####.yy.com/speed/entrance?uid=####&yyVersion=####&os=####&model=##...
updat####.yy.com/speed/module/speedIndex/idx/1622?page=####&uid=####&yyV...
updat####.yy.com/speed/nav/speedIndex/idx?uid=####&yyVersion=####&os=###...
updat####.yy.com/speed/nav/speed_watch/idx?uid=####&yyVersion=####&os=##...
updat####.yy.com/speed/navs?uid=####&yyVersion=####&os=####&model=####&o...
zon####.bs2.yy.com/group16/M00/91215f47328d4d5985a14347c611ab94.jpg?ips_...

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
c-h####.g####.com/api.php?format=####&t=####
cloud####.fengkon####.com/v2/device/conf
f####.fengkon####.com/v2/device/profile
m####.h####.com/c.gif?act=####&smkdata=####&EC=####&appkey=####&item=###...
norma-e####.m####.com/push/android/external/add.do
sdk.o####.p####.####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
short-y####.yy.com/dau/reporting
updat####.yy.com/dau/reporting

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1144f37d5e989d0817e46bec5fb854b3b605dc2b7878da9....0.tmp
/data/data/####/1551219507701mysharelanguage.txt
/data/data/####/20190218_1722087834426.xml
/data/data/####/3c34461e826c1968fb15ac197e91c5ab3fcad33881bf20c....0.tmp
/data/data/####/3f2af7298d334f26b11bf5afc38d5373
/data/data/####/450896f18643671a445fbc84cd533afcb3471f1d21f13fd....0.tmp
/data/data/####/75F0ED65DF2431A0DA6BB3D164054C01
/data/data/####/771b9ce4f7dc9d21f19d70dae3a8f591fac8d551b4a02a5....0.tmp
/data/data/####/7a1adc2e5dd7fb6c44a7865f04ebb83f7ce7d221b3fe481....0.tmp
/data/data/####/8282c2efb1eaad6ee8731f22e3e5e854c675a045f549b0d....0.tmp
/data/data/####/8577c77dee067e7763294798c50adde622d5bf8f25c04bf....0.tmp
/data/data/####/ACCS_BINDumeng;5a276a10f29d982f520000f1
/data/data/####/ACCS_SDK
/data/data/####/ACCS_SDK_CHANNEL
/data/data/####/AGOO_BIND
/data/data/####/Agoo_AppStore
/data/data/####/Alvin2
/data/data/####/AndroidManifest.xml
/data/data/####/AudioengineConfig
/data/data/####/ContextData
/data/data/####/DaemonServer
/data/data/####/HwCodecConfig
/data/data/####/KLog$$com-yy-yylite.mmap2
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PLUGIN_PREFERENCES
/data/data/####/RuntimeKit
/data/data/####/UM_PROBE_DATA
/data/data/####/UpgradePref
/data/data/####/abtest
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/b09451f94ffcd8510d70c6a38e7475bbbee6334fa0783d4....0.tmp
/data/data/####/c1a52fcf726a1d9d50107b154a1d4f07e5e49b2fefe5d40....0.tmp
/data/data/####/cloudms.conf
/data/data/####/com.shumei
/data/data/####/com.x.y.1
/data/data/####/com.x.y.2
/data/data/####/com.yy.shortpushsvc.db-journal
/data/data/####/d3027a58c6a57dc04b271e5fbca11e5a33474f4e03b611d....0.tmp
/data/data/####/d41e714aa387c67f913510319e2c7a9ec3166a7e39abae1....0.tmp
/data/data/####/d9b2a926dc1a4ac8beac6d1e5e13f16a
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUxMjE5NTAzMzAw;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTUxMjE5NTE4MzI1;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1NTEyMTk1MDkyODg=;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default
/data/data/####/downloader.db-journal
/data/data/####/e903884d34e38fe31bf1e2907de5674497847d1e7986cb4....0.tmp
/data/data/####/edc2231b43edbbeb909c9e9e85ec14eda277356bc99bad2....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f4f67397eaaf2334f89c5ebcbc81f3cd052d5204e7f921f....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hd_default_pref
/data/data/####/hd_default_pref.tmp
/data/data/####/hdcltid
/data/data/####/hdcommon_config_cache_pref
/data/data/####/hdid.bck
/data/data/####/hdid_v2
/data/data/####/hdstatis_cache_3ed8578c.db-journal
/data/data/####/hdstatis_cache_4b04df0e.db-journal
/data/data/####/hdstatis_cache_b6fa708d.db-journal
/data/data/####/hdstatis_cache_d6aa665f.db-journal
/data/data/####/hduuid_v1
/data/data/####/httpdns_config_cache
/data/data/####/i==1.2.0&&1.10.4_1551219503270_envelope.log
/data/data/####/index
/data/data/####/info
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/lbscache
/data/data/####/libcom_yy_lite_plugin_liveextension.apk
/data/data/####/libcom_yy_lite_plugin_quiz.apk
/data/data/####/libjiagu708335345.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version
/data/data/####/mz_push_preference
/data/data/####/nav_cache.txt
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/seq
/data/data/####/small-plugin
/data/data/####/splash_cache.txt
/data/data/####/table
/data/data/####/tdata_JNg986
/data/data/####/tdata_JNg986.jar
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_nxn539
/data/data/####/tdata_nxn539.jar
/data/data/####/tdata_zzW503
/data/data/####/tdata_zzW503.jar
/data/data/####/tracker.db-journal
/data/data/####/tt_sdk_settings
/data/data/####/ttopenadsdk
/data/data/####/ttopensdk.db-journal
/data/data/####/udbauthlooog-journal
/data/data/####/um_pri
/data/data/####/umdat
/data/data/####/umeng_common_config
/data/data/####/umeng_common_location
/data/data/####/umeng_general_config
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/yyabtest.db
/data/data/####/yyabtest.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.thumbcache_idx0
/data/media/####/.umm.dat
/data/media/####/2019-02-26.log.txt
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/Device
/data/media/####/Device_v2
/data/media/####/Global
/data/media/####/LogPath.txt
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.yy.yylite.bin
/data/media/####/com.yy.yylite.db
/data/media/####/d2b08ce4-1e6c-4515-b320-680ecdd98da2
/data/media/####/deviceToken
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/hdcltid.ini
/data/media/####/hdstatis_20190226.log
/data/media/####/hduuid_v1
/data/media/####/info.txt
/data/media/####/libcom_yy_lite_plugin_im.so
/data/media/####/libcom_yy_lite_plugin_liveextension.so
/data/media/####/libcom_yy_lite_plugin_quiz.so
/data/media/####/libcom_yy_lite_plugin_updateres.so
/data/media/####/pushsvc_log.txt
/data/media/####/shumei.txt
/data/media/####/tdata_JNg986
/data/media/####/tdata_MkX219
/data/media/####/tdata_nxn539
/data/media/####/tdata_zzW503
/data/media/####/test.log
/data/media/####/uuid
/data/media/####/yysdk_adapter-02-26-22-18.txt

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a276a10f29d982f520000f1","utdid":"XHW7LhfxidIDAGdzx1Hb0yao","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.yy.pushsvc.GTPush.GeTuiService 24325 300 0
cat /proc/self/cgroup
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls -l /system/bin/su
ls -l /system/xbin/su
ls /
ls /sys/class/thermal
ps
sh

Загружает динамические библиотеки:

DeviceIdentifier
androiditna
getuiext2
libjiagu708335345
smsdk
tnet-3.1
yycrashreport
yylog
yyprotolitesdk

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
DES-ECB-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней