Adware.Gexin.9516

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ap####.v0.m####.com:80
TCP(HTTP/1.1) a####.aaa.m####.com:80
TCP(HTTP/1.1) imgal####.res.m####.com:80
TCP(HTTP/1.1) 0####.h####.com:80
TCP(HTTP/1.1) g####.hun####.com:80
TCP(HTTP/1.1) use####.api.max.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) st.bz.m####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) o####.hun####.com:80
TCP(HTTP/1.1) x.da.m####.com:80
TCP(HTTP/1.1) o####.ar####.api.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) m####.api.m####.com:80
TCP(HTTP/1.1) x.da.hun####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) mob.bz.m####.com:80
TCP(HTTP/1.1) log.da.hun####.com:80
TCP(HTTP/1.1) cou####.pe####.m####.com:80
TCP(HTTP/1.1) 3####.h####.com:80
TCP(HTTP/1.1) o####.ac####.api.####.com:80
TCP(HTTP/1.1) s5.hun####.com:80
TCP(TLS/1.0) h####.m####.com:443
TCP(TLS/1.0) i####.com:443
TCP(TLS/1.0) qq.i####.com:443
TCP(TLS/1.0) app.h####.com:443
TCP sdk.o####.t####.####.com:5224
TCP 43.2####.145.4:5226
TCP t####.nz4.ig####.com:5224

Запросы DNS:

0####.h####.com
1####.h####.com
2####.h####.com
3####.h####.com
4####.h####.com
7j####.c####.z0.####.com
a####.aaa.m####.com
a####.u####.com
ap####.v0.m####.com
api####.a####.com
app.h####.com
c-h####.g####.com
cou####.pe####.m####.com
g####.hun####.com
h####.m####.com
i####.com
i5.hun####.com
imgal####.res.m####.com
log.da.hun####.com
m####.api.m####.com
m.i####.com
mo####.api.hun####.com
mob.bz.m####.com
o####.ac####.api.####.com
o####.ar####.api.####.com
o####.hun####.com
pub-####.qin####.com
rc.m####.com
s5.hun####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st.bz.m####.com
t####.nz4.g####.net
t####.nz4.ge####.com
t####.nz4.ig####.com
use####.api.max.####.com
www.qchann####.cn
x.da.hun####.com
x.da.m####.com

Запросы HTTP GET:

0####.h####.com/preview/channel_images/20190213161130991.jpg_366x206.jpg
0####.h####.com/preview/cms_icon/2019/2/13/02/20190213221339489.jpg_130x...
0####.h####.com/preview/cms_icon/2019/3/1/03/20190301193945379.jpg_130x1...
0####.h####.com/preview/sp_images/2018/zongyi/323564/4457296/20180709091...
3####.h####.com/preview/channel_images/20190220103623352.jpg_366x206.jpg
3####.h####.com/preview/cms_icon/2019/2/26/02/20190226093308713.jpg_130x...
3####.h####.com/preview/cms_icon/auto_gif/2019/02/27/211017987367532837....
a####.aaa.m####.com/audit_mpp.html?pagename=####&net=####&aver=####&time...
ap####.v0.m####.com/pv.php?nt=####&cpid=####&md=####&tst=####&gps=####&s...
ap####.v0.m####.com/pv.php?nt=####&ftl=####&cpid=####&md=####&tst=####&g...
ap####.v0.m####.com/pv.php?nt=4&ftl=&cpid=http://order.hunantv.com/pay/a...
cou####.pe####.m####.com/message/poll?uid=####&osVersion=####&did=####&m...
g####.hun####.com/mobile/distribute.do?deviceid=####
imgal####.res.m####.com/mediafiles/wiad_creative/1008/15508350931413.jpg
imgal####.res.m####.com/mediafiles/wiad_creative/458/15512634053874.jpg
mob.bz.m####.com/odin/c1/channel/list?uid=####&osVersion=####&mac=####&o...
o####.ac####.api.####.com/artist/getRecommendCollectArtist?uid=####&osVe...
o####.ar####.api.####.com/artist/getArtistListByIds?uid=####&type=####&t...
o####.hun####.com/pay/android/product.html?userId=####&osVersion=####&se...
qin####.com.www.####.com/tdata_EDT369
s5.hun####.com/channel/live?uid=####&osVersion=####&ticket=####&appVersi...
s5.hun####.com/mobile/rank?c=####
s5.hun####.com/mobile/rank?uid=####&osVersion=####&c=####&mac=####&osTyp...
s5.hun####.com/mobile/user?uid=####&c=####&mac=####
s5.hun####.com/recommend?uid=####&platform=####&osVersion=####&mac=####&...
s5.hun####.com/user/couponList?uid=####&osVersion=####&ticket=####&appVe...
s5.hun####.com/user/getActivity?uid=####&osVersion=####&ticket=####&appV...
s5.hun####.com/user/getLibraries?uid=####&osVersion=####&ticket=####&app...
s5.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=####&appVer...
s5.hun####.com/v1/config/play?uid=####&osVersion=####&ticket=####&appVer...
s5.hun####.com/v5/listconfig?uid=####&platform=####&osVersion=####&mac=#...
s5.hun####.com/v6/search/recommend?uid=####&osVersion=####&ticket=####&a...
st.bz.m####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
t####.c####.q####.####.com/tdata_AXX896
t####.c####.q####.####.com/tdata_BAI450
t####.c####.q####.####.com/tdata_Fus136
ti####.c####.l####.####.com/config/bj-bjv6.conf
ti####.c####.l####.####.com/config/hz-bjv6.conf
use####.api.max.####.com/person57fb6062d84a5.png
use####.api.max.####.com/person5ad6eea479eeb.png@1wh_1e_1c_0o_0l_130h_13...
use####.api.max.####.com/person5b1b72e5b9d13.jpg@1wh_1e_1c_0o_0l_130h_13...
use####.api.max.####.com/person5c22237087396.jpg
use####.api.max.####.com/preview/channel_images/20180126144432796.jpg_73...
use####.api.max.####.com/preview/channel_images/20190110115242539.jpg_73...
use####.api.max.####.com/preview/cms_icon/2019/1/12/01/20190112142330405...
use####.api.max.####.com/preview/cms_icon/2019/1/6/01/20190106123235829....
use####.api.max.####.com/preview/cms_icon/2019/1/6/01/20190106123329836....
use####.api.max.####.com/preview/cms_icon/2019/2/28/02/20190228121117716...
use####.api.max.####.com/preview/cms_icon/2019/3/1/03/20190301112502271....
use####.api.max.####.com/preview/cms_icon/2019/3/1/03/20190301172918955....
use####.api.max.####.com/preview/cms_icon/2019/3/2/03/20190302234637671....
use####.api.max.####.com/preview/cms_icon/2019/3/3/03/20190303115331089....
use####.api.max.####.com/preview/sp_images/2018/12/25/dianshiju/323323/4...
use####.api.max.####.com/preview/sp_images/2019/3/1/zongyi/328111/524285...
use####.api.max.####.com/preview/sp_images/2019/3/1/zongyi/328186/524284...
use####.api.max.####.com/preview/sp_images/2019/3/2/zongyi/327224/524749...
use####.api.max.####.com/s1/2015/wmjqxsbw/phone.png

Запросы HTTP POST:

a####.u####.com/app_logs
c-h####.g####.com/api.php?format=####&t=####
log.da.hun####.com/v1/t
m####.api.m####.com/mpns/parseLog
o####.ac####.api.####.com/global/config
res####.a####.com/v3/log/init
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
www.qchann####.cn/center/adj
www.qchann####.cn/center/adj?appkey=####
x.da.hun####.com/json/app/boot
x.da.m####.com/m/page

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-613446676
/data/data/####/.imprint
/data/data/####/0a7683c3f2eb7261e8e7626883bf34ef5f6796e6077e76e....0.tmp
/data/data/####/15e4c9e11457450dea09c51934556ea21535acf8111ef36....0.tmp
/data/data/####/16cc43660839b8b9d46fcda954851c0bad4fad5f0fa11a0....0.tmp
/data/data/####/1703720991
/data/data/####/18d3d83b3bef2deb4fd1d7c18305cbd280d5132318cbc1c....0.tmp
/data/data/####/19c81c18bbb336bdc330a7dbedeca969888c1b7394c53f2....0.tmp
/data/data/####/2068cb5908d333a42a9a19e2bb1c188233eaf087863f651....0.tmp
/data/data/####/257306020
/data/data/####/257306024
/data/data/####/257306028
/data/data/####/3d8cfd3f0059caa77d9da965ad65a6f9
/data/data/####/3e304289cd3b71103d37ee2fb132cfb0037512e71267254....0.tmp
/data/data/####/4f7cf7af656f2846f78bb7c9ac1e13ceda7228ede682608....0.tmp
/data/data/####/51998ecddb483c544d9ef8a21eb8b9f812a1346c6c02cf9....0.tmp
/data/data/####/5a5b277776b3e731fbb7d727c492cd1be7476baf241c6ac....0.tmp
/data/data/####/613da8d63b13cb30c3c7636cee3fe7c11f48330f1596ddd....0.tmp
/data/data/####/614108960
/data/data/####/6164488808ecdfe1bb669cf1488d6e4f
/data/data/####/66aac667b11d3287692fcdeba4aab7a6bfe76130fe5b514....0.tmp
/data/data/####/6a45520ac52a5729ed0743eb48632fc3
/data/data/####/7115a56b634554a215dea44ee35ec98cbb6dbff42b37696....0.tmp
/data/data/####/73ffd793a52c5d027c6251f65c4ec5e25cbeea8b4a767c0....0.tmp
/data/data/####/7c59aa07c0c757239defcfd6698915314171bbf73329384....0.tmp
/data/data/####/7e4390158c9a70f4a0fef178e8bd9b51
/data/data/####/84f8ee43e5bce0b3d32ab92fd62ac5d44c44758583dcdfb....0.tmp
/data/data/####/85cd1acf144ce1d1cfd8bb55a0b54557
/data/data/####/86a78705eea62c3cbf53f643132c60f335e38df6bbcd0c9....0.tmp
/data/data/####/8855d789c7a58356284a33c25b00c8ed
/data/data/####/933978904
/data/data/####/95f21cb14535
/data/data/####/9b348d6234af8d2ced0c38467d744d088b4b84b78c245b5....0.tmp
/data/data/####/ApplicationCache.db-journal
/data/data/####/ApplicationCache.db-journal (deleted)
/data/data/####/ImgoPad-journal
/data/data/####/MGTVCommon.xml
/data/data/####/MV3Plugin.ini
/data/data/####/MV3Plugin_Default.ini
/data/data/####/QT.xml
/data/data/####/ad4ef28192d9053cd66935ebf69ccc13
/data/data/####/arch.xml
/data/data/####/b6525d34c2a510e9593b0ed01f43972a
/data/data/####/c09af1e212d4b0aec773f55b0df44086264de539f74b1a5....0.tmp
/data/data/####/c327b6fc2737484c2e67105c447000780e6470540d7800a....0.tmp
/data/data/####/c5ec429129ce5f638d33da5ddac6386e
/data/data/####/c80c4f388c34efba4f9be3a809af192e275b0d8dd5ab052....0.tmp
/data/data/####/cdb5353e6247be04c3f1a59daf6e4d12f18478aa10859ff....0.tmp
/data/data/####/cn.com.mma.mobile.tracking.other.xml
/data/data/####/d591d6d80012a95951b84df071c65b00ed9c2e5d0a09b97....0.tmp
/data/data/####/d6273d897d8745c76b33eb7b16effa814ba6d4920bf07f0....0.tmp
/data/data/####/d7f54ce08e7b6b44c65e6056862595b2f88de256fc6f7ee....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/e7b5c74b248d2bb50688221386d599e6a0c3494e6bd775c....0.tmp
/data/data/####/ed4017c9ccc641e99eb9320c9532e1a408fdbbfdc6ef575....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/f69d0ba8973a86c3a9ca6f75df3dfd8c42ff01d92bfec10....0.tmp
/data/data/####/f_000001
/data/data/####/fdf1919d2c6fb361ebd9adb98849b9ef19d47e729f16cf7....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hmt_agent_commonutill_com.tianyou.play.kuaikan.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting_com.tianyou.play.kuaikan.xml
/data/data/####/hmt_analytics
/data/data/####/hmt_analytics-journal
/data/data/####/hmt_init_savetime.xml
/data/data/####/hmt_irsuid.xml
/data/data/####/hmt_session_id.xml
/data/data/####/hmt_session_id_savetime.xml
/data/data/####/hmt_session_id_savetime.xml.bak
/data/data/####/hmt_session_id_savetime.xml.bak (deleted)
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/last_know_location.xml
/data/data/####/libjiagu1430661464.so
/data/data/####/multidex.version.xml
/data/data/####/openudid_prefs.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qtsession.xml
/data/data/####/root.db-journal
/data/data/####/run.pid
/data/data/####/tdata_AXX896
/data/data/####/tdata_AXX896.jar
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_Fus136
/data/data/####/tdata_Fus136.jar
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/2f2c2f02c1168edadb9b80c2c927d0fd
/data/media/####/5ac331745e7715f7a37161e66bd2c182
/data/media/####/AN.csv-20190303213605
/data/media/####/TruthInfo.csv-1551648966028
/data/media/####/UA.csv-20190303213606
/data/media/####/UnicomTrafficFree.log
/data/media/####/apge.csv-20190303213618
/data/media/####/apge.csv-20190303213630
/data/media/####/app.db
/data/media/####/b3f793e4b5fa8e9194b3dd5f79132400
/data/media/####/bb5745b286dd68cc55172c6d81c5e418
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.tianyou.play.kuaikan.bin
/data/media/####/com.tianyou.play.kuaikan.db
/data/media/####/dcaf33b4539f916bdd8d151281025a1f
/data/media/####/fcb3926cd183f026ba0b19257b7264fd
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/journal.tmp
/data/media/####/qt.csv.1551648964268.txt
/data/media/####/tdata_AXX896
/data/media/####/tdata_BAI450
/data/media/####/tdata_Fus136
/data/media/####/test.log
/data/media/####/uuid

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25412 300 0
cat /proc/cpuinfo
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25412 300 0

Загружает динамические библиотеки:

getuiext2
libjiagu1430661464

Использует следующие алгоритмы для шифрования данных:

AES-CFB-NoPadding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней