Adware.Gexin.9550

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.3.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) eco-pus####.me####.com:80
TCP(HTTP/1.1) api.compas####.hk:80
TCP(HTTP/1.1) pin####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(TLS/1.0) 1####.217.17.110:443
TCP(TLS/1.0) s3-qc####.me####.com.####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) eco####.me####.com.####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP sdk.o####.t####.####.com:5224
UDP 1####.168.126.1:137
TCP c####.g####.ig####.com:5225

Запросы DNS:

aexcep####.b####.qq.com
and####.b####.qq.com
api.compas####.hk
c####.g####.ig####.com
c-h####.g####.com
cdn.compas####.hk
eco####.me####.com
eco-pus####.me####.com
i####.compas####.hk
l####.compas####.hk
log.u####.com
mo####.compas####.hk
pi####.qq.com
pin####.qq.com
plb####.u####.com
pub-####.qin####.com
s3-qc####.me####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sec.u####.com
u####.u####.com
www.compas####.hk

Запросы HTTP GET:

api.compas####.hk/index.php/page/index/succ?id=####
api.compas####.hk/index.php/page/index/succs?id=####
api.compas####.hk/public/static/page/CSS/main.css?v=####
api.compas####.hk/public/static/page/CSS/mui.min.css
api.compas####.hk/public/static/page/JS/jquery-2.2.0.min.js
api.compas####.hk/public/static/page/JS/mui.min.js
api.compas####.hk/public/static/page/JS/vue.min.js
api.compas####.hk/upload/news/P190109181847.jpg
api.compas####.hk/upload/news/P190114105510.jpg
eco-pus####.me####.com/pusher/websocket?browser_id=####&ent_id=####&visi...
qin####.com.www.####.com/tdata_EDT356
ti####.c####.l####.####.com/11.jpg?imageVi####
ti####.c####.l####.####.com/24.jpg?imageVi####
ti####.c####.l####.####.com/285.jpg?imageVi####
ti####.c####.l####.####.com/43.jpg?imageVi####
ti####.c####.l####.####.com/45.jpg?imageVi####
ti####.c####.l####.####.com/banner-mid.jpg?imageMo####
ti####.c####.l####.####.com/config/hz-hzv3.conf
ti####.c####.l####.####.com/course/img_20190212143049.jpg
ti####.c####.l####.####.com/course/img_20190212144354.jpg
ti####.c####.l####.####.com/course/img_20190221103947.jpg
ti####.c####.l####.####.com/index-icons/1.png
ti####.c####.l####.####.com/index-icons/2.png
ti####.c####.l####.####.com/index-icons/3.png
ti####.c####.l####.####.com/index-icons/4.png
ti####.c####.l####.####.com/index-icons/5.png
ti####.c####.l####.####.com/lecture20190228174550.jpg?imageMo####
ti####.c####.l####.####.com/news/20180926172045.jpg?imageMo####
ti####.c####.l####.####.com/news/20180926173232.jpg?imageMo####
ti####.c####.l####.####.com/news/20180926173824.jpg?imageMo####
ti####.c####.l####.####.com/news/20180926174321.jpg?imageMo####
ti####.c####.l####.####.com/news/20180928135730.jpg?imageMo####
ti####.c####.l####.####.com/news/20180928142101.jpg?imageMo####
ti####.c####.l####.####.com/news/20181003134158.jpg?imageMo####
ti####.c####.l####.####.com/news/20181003134328.jpg?imageMo####
ti####.c####.l####.####.com/news1.jpg?imageVi####
ti####.c####.l####.####.com/news2.jpg?imageVi####
ti####.c####.l####.####.com/news3.jpg?imageVi####
ti####.c####.l####.####.com/to-meiqia.png?imageMo####
ti####.c####.l####.####.com/top20190212143456.jpg?imageMo####
ti####.c####.l####.####.com/top20190212143733.jpg?imageMo####
ti####.c####.l####.####.com/top20190301162752.jpg?imageMo####
ti####.c####.l####.####.com/upload/news/13891-20190301175140.png

Запросы HTTP POST:

aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
api.compas####.hk/index.php/api/v1/app/ads/landing
api.compas####.hk/index.php/api/v1/app/config
api.compas####.hk/index.php/api/v1/app/popup
api.compas####.hk/index.php/api/v1/article/show
api.compas####.hk/index.php/api/v1/index
c-h####.g####.com/api.php?format=####&t=####
pi####.qq.com/mstat/report/?index=####
pin####.qq.com/request
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/4e998a75c2fd
/data/data/####/6EduOLO3uyWHNwkShUag7ygz9QU.620948432.tmp
/data/data/####/7SiuaGGY8RB8ku7zEZ_gmxF9iog.907676591.tmp
/data/data/####/7orvhSxMhFHFQv5xQsB6UnySgRU.-1917000726.tmp
/data/data/####/7wsfAbWe9NjBfaq-MIUQsIdD7zM.cnt
/data/data/####/Alvin2.xml
/data/data/####/BRmk087V5pDyW7ePFs6tUrHfoPc.-1775238278.tmp
/data/data/####/BuglySdkInfos.xml
/data/data/####/ContextData.xml
/data/data/####/Dr61_S_A2PABAwFsx1VVJaJiqoo.1701940033.tmp
/data/data/####/F4sz-wmL1rGVbQ2ljI-fgIYJ_yY.cnt
/data/data/####/IEY0hdocYgudNJVk4o1VCyg1FbI.1433866507.tmp
/data/data/####/Meiqia.xml
/data/data/####/MeiqiaSDK.xml
/data/data/####/O0b9LjCRlXbdeARaKUHl9PoE6yU.1844968661.tmp
/data/data/####/PyjTZPLiCTgdd6zKZ4lXuc2IRxs.363306313.tmp
/data/data/####/R1OYisvnEmBAbsbyM-5YVrzykBc.1561630996.tmp
/data/data/####/RKStorage-journal
/data/data/####/S2vJ5T13iz4PSdcGxDT_C1O-iyw.-1368418340.tmp
/data/data/####/SG2Z6cNQFFyrjeQoN7mMa1WYOO8.-126904289.tmp
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WfVJ-kDkycs0fyd7KooQwDUdMSI.1668904710.tmp
/data/data/####/XmrBTut-f_UBEwG1z47Z8eshpA0.-1928810804.tmp
/data/data/####/ZU_FZVblxuqt0rQIh5EDeZpSyDY.985092839.tmp
/data/data/####/Zf-nchI8j04xR32JEOJuz7Sxi8Q.-740870324.tmp
/data/data/####/_w9munj1jXFp3-LKadKoZncq2PM.cnt
/data/data/####/a==7.5.3&&1.1.1_1551693038966_envelope.log
/data/data/####/a==7.5.3&&1.1.1_1551693089694_envelope.log
/data/data/####/am40L8ttWiwjBGYI8GekHUpGtdk.-1671363941.tmp
/data/data/####/b_IBQ1pk2XETV6EmobpR0hgqXeI.-1121412038.tmp
/data/data/####/be7b7b05-7ca6-433e-b4b8-e26585aa3a9b
/data/data/####/bugly_db_legu-journal
/data/data/####/com.google.InstanceId.properties
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.guideapp.mid.world.ro.xml
/data/data/####/com.guideapp_preferences.xml
/data/data/####/d==7.5.3&&1.1.1_1551693040625_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693043018_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693044807_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693045937_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693048663_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693051158_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693053998_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693056777_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693059546_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693060949_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693061525_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693063006_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693065762_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693068625_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693069365_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693070245_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693071627_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693073545_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693074857_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693077746_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693080496_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693082795_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693083565_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693084340_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693085868_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693087955_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693089235_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693089815_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693091439_envelope.log
/data/data/####/d==7.5.3&&1.1.1_1551693092765_envelope.log
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUxNjkzMDQxNDI2;
/data/data/####/dW1weF9zaGFyZV8xNTUxNjkzMDQwOTY1;
/data/data/####/dW1weF9zaGFyZV8xNTUxNjkzMDQxMTE2;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/fnjZZTjMfpx64FS0nkyxKZAFnb0.cnt
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/i==1.2.0&&1.1.1_1551693041509_envelope.log
/data/data/####/iiabUQkxLkGtZj59mM0SvpSFqMI.2126752314.tmp
/data/data/####/index
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/ldONGexYub1SqfoWy5ovwNMv53A.638057664.tmp
/data/data/####/legu_tencent_analysis.db_com.guideapp-journal
/data/data/####/lf5cU7LyCwsC0mAwc7GNQUwE7jM.821171880.tmp
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.5.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/meiqia.db
/data/data/####/meiqia.db-journal
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/oAFEH64YiP-5T3DNL3OhvgEA_cA.52098390.tmp
/data/data/####/pdIf-C24ftPEPn0_jH6xrfiWv9I.-1829650379.tmp
/data/data/####/pri_legu_tencent_analysis.db_com.guideapp-journal
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qRXPK0MOo28Ewwtcnya_YwejEdM.2063341584.tmp
/data/data/####/qRXPK0MOo28Ewwtcnya_YwejEdM.cnt
/data/data/####/qZGTvy_sMx44aO-6f8o4HRbIeJc.-615453981.tmp
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/share.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/vyljksy8-k36HbostjbH9zSSOx8.-228638801.tmp
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/xZp33AU1PFCgpYVQniRB3bYY3M0.cnt
/data/data/####/yprtfmL8mW-e34NmOjI_-eh9pnQ.-1471573087.tmp
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.mid.txt
/data/media/####/.mid.txt1000001
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/255633e1-f975-458f-b4f0-e0c2f879ad1f
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.db
/data/media/####/com.guideapp.bin
/data/media/####/com.guideapp.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.getui.PushCustomService 24212 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.5.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.getui.PushCustomService 24212 300 0

Загружает динамические библиотеки:

Bugly
MtaNativeCrash
getuiext2
imagepipeline
libfb
libnfix
libreactnativejni
libshella-2.9.0.5
libufix
libyoga
nfix
securityenv
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding
RSA-NONE-PKCS1PADDING

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней