Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) v2.g####.qq.com:80
- TCP(HTTP/1.1) c.g####.qq.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) v.g####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) cx.ika####.cn:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) j####.ika####.cn:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) z####.ika####.cn:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) 1####.134.99.111:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) sh####.me####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.u####.com
- c####.g####.ig####.com
- c####.ika####.cn
- c-h####.g####.com
- c.g####.qq.com
- cdn.ika####.cn
- cx.ika####.cn
- hm.b####.com
- i####.ika####.cn
- imgc####.qq.com
- j####.ika####.cn
- log.u####.com
- mi.g####.qq.com
- mo####.b####.com
- p####.ugd####.com
- pub-####.qin####.com
- qzones####.g####.cn
- s####.e.qq.com
- s####.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sh####.me####.com
- v.g####.qq.com
- v2.g####.qq.com
- z####.ika####.cn
- z####.ika####.cn
Запросы HTTP GET:
- c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
- cx.ika####.cn//cx/bookdetail?cnid=####&uid=####&bookid=####&ufrom=####&c...
- cx.ika####.cn/cx/getAdv?width=####&height=####&cnid=####&umeng=####&vers...
- cx.ika####.cn/cx/index?cnid=####&umeng=####&version=####&vercode=####&im...
- cx.ika####.cn/cx/itf/bookshelflist?updatetime=####&cnid=####
- cx.ika####.cn/cx/itf/checkVersion?cnid=####&umeng=####&version=####&verc...
- cx.ika####.cn/cx/itf/getvolume?bookId=####
- cx.ika####.cn/cx/itf/gtInfo?cid=####&cnid=####&umeng=####&version=####&v...
- cx.ika####.cn/cx/itf/taskInfo
- cx.ika####.cn/pages/flindex.jsp?cnid=####&umeng=####&version=####&vercod...
- cx.ika####.cn/static/css/animate.css?d86e540####&version=####
- cx.ika####.cn/static/css/style.css?3b19f4f####&version=####
- cx.ika####.cn/static/css/toast.css?b176d97####&version=####
- cx.ika####.cn/static/images/author@2x.png
- cx.ika####.cn/static/images/cate-down1-ff9f37.png
- cx.ika####.cn/static/images/change_icon.png
- cx.ika####.cn/static/images/change_mulu.png
- cx.ika####.cn/static/images/change_nav.png
- cx.ika####.cn/static/images/classify_b1.png
- cx.ika####.cn/static/images/classify_b2.png
- cx.ika####.cn/static/images/classify_b3.png
- cx.ika####.cn/static/js/base.js?1bfcf56####
- cx.ika####.cn/static/js/book.js?70e7f6a####
- cx.ika####.cn/static/js/jquery-1.7.min.js?25721ce####
- cx.ika####.cn/static/js/myself.js?392b358####
- cx.ika####.cn/static/js/swipeSlide.js?c89247d####
- cx.ika####.cn/static/js/swiper-3.3.1.jquery.min.js?5bbd6ca####
- cx.ika####.cn/static/js/touch.js?cb8099c####
- cx.ika####.cn/static/js/zepto.min.js?1abd55c####
- d####.c####.l####.####.com/book_covers/3001818442.jpg
- d####.c####.l####.####.com/book_covers/320891.jpg
- d####.c####.l####.####.com/book_covers/359087.jpg
- d####.c####.l####.####.com/book_covers/50003627.jpg
- d####.c####.l####.####.com/book_covers/60002299.jpg
- d####.c####.l####.####.com/book_covers/60033230.jpg
- d####.c####.l####.####.com/book_covers/60450278.jpg
- d####.c####.l####.####.com/book_covers/60560865.jpg
- d####.c####.l####.####.com/book_covers/60683478.jpg
- d####.c####.l####.####.com/book_covers/60733674.jpg
- d####.c####.l####.####.com/book_covers/60799440.jpg
- d####.c####.l####.####.com/book_covers/60809432.jpg
- d####.c####.l####.####.com/book_covers/60813250.jpg
- d####.c####.l####.####.com/book_covers/60884139.jpg
- d####.c####.l####.####.com/book_covers/80001431.jpg
- d####.c####.l####.####.com/book_covers/80001459.jpg
- d####.c####.l####.####.com/book_covers/80001460.jpg
- d####.c####.l####.####.com/book_covers/80001544.jpg
- d####.c####.l####.####.com/book_covers/80002074.jpg
- d####.c####.l####.####.com/book_covers/80002315.jpg
- d####.c####.l####.####.com/book_covers/80002319.jpg
- d####.c####.l####.####.com/book_covers/80002406.jpg
- d####.c####.l####.####.com/book_covers/80002410.jpg
- d####.c####.l####.####.com/book_covers/80002628.jpg
- d####.c####.l####.####.com/book_covers/80010976.jpg
- d####.c####.l####.####.com/book_covers/802000173.jpg
- d####.c####.l####.####.com/book_covers/803201598.jpg
- d####.c####.l####.####.com/book_covers/803201706.jpg
- d####.c####.l####.####.com/book_covers/803201752.jpg
- d####.c####.l####.####.com/book_covers/803202701.jpg
- d####.c####.l####.####.com/book_covers/803202911.jpg
- d####.c####.l####.####.com/book_covers/805200062.jpg
- d####.c####.l####.####.com/book_covers/805900053.jpg
- d####.c####.l####.####.com/book_covers/807000060.jpg
- d####.c####.l####.####.com/book_covers/808500172.jpg
- d####.c####.l####.####.com/book_covers/808500508.jpg
- d####.c####.l####.####.com/book_covers/808800165.jpg
- d####.c####.l####.####.com/book_covers/810300044.jpg
- d####.c####.l####.####.com/book_covers/810300063.jpg
- d####.c####.l####.####.com/book_covers/810300267.jpg
- d####.c####.l####.####.com/book_covers/810300685.jpg
- d####.c####.l####.####.com/book_covers/812100012.jpg
- d####.c####.l####.####.com/book_covers/812300041.jpg
- d####.c####.l####.####.com/book_covers/813600107.jpg
- d####.c####.l####.####.com/book_covers/814800001.jpg
- d####.c####.l####.####.com/book_covers/814800002.jpg
- d####.c####.l####.####.com/book_covers/814800003.jpg
- d####.c####.l####.####.com/book_covers/814800005.jpg
- d####.c####.l####.####.com/book_covers/814800006.jpg
- d####.c####.l####.####.com/book_covers/814800011.jpg
- d####.c####.l####.####.com/book_covers/816400016.jpg
- d####.c####.l####.####.com/book_covers/817000004.jpg
- d####.c####.l####.####.com/book_covers/817000005.jpg
- d####.c####.l####.####.com/book_covers/817000010.jpg
- d####.c####.l####.####.com/book_covers/817000012.jpg
- d####.c####.l####.####.com/book_covers/817400445.jpg
- d####.c####.l####.####.com/book_covers/817400452.jpg
- d####.c####.l####.####.com/book_covers/817400694.jpg
- d####.c####.l####.####.com/book_covers/817400749.jpg
- d####.c####.l####.####.com/cx/endimgs/0538a40d6b754849965046b7249c5e6a.jpg
- d####.c####.l####.####.com/cx/endimgs/258a047fbcd14d2ebc33aa6bbee56774.jpg
- d####.c####.l####.####.com/cx/endimgs/2b8c9442294c4488ad9e988f421ca218.jpg
- d####.c####.l####.####.com/cx/endimgs/33e2280d13fb4cb8bfd4e31e72c3e8e7.jpg
- d####.c####.l####.####.com/cx/endimgs/7d2d5e46286144408eda3535b2d6ca52.jpg
- d####.c####.l####.####.com/cx/endimgs/86513d8c51904218ad4e91a72c64f203.jpg
- d####.c####.l####.####.com/cx/endimgs/91758051f1db4b5f8adbe592fa8602d2.jpg
- d####.c####.l####.####.com/cx/endimgs/cb769f1a401440c19486e836c93611a9.jpg
- d####.c####.l####.####.com/cx/endimgs/f59663d723ce4e9b9e9692aa568ab8e8.jpg
- hm.b####.com/hm.gif?hca=####&cc=####&ck=####&cl=####&ds=####&vl=####&ep=...
- hm.b####.com/hm.gif?hca=####&cc=####&ck=####&cl=####&ds=####&vl=####&et=...
- hm.b####.com/hm.js?a1e24e5####
- j####.ika####.cn/log.js?cnid=####&uid=####&bookid=####&cnid=####&imsi=##...
- j####.ika####.cn/log.js?cnid=####&uid=####&cnid=####&imsi=####&imei=####...
- mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- qin####.com.www.####.com/tdata_EDT369
- s####.tc.qq.com/gdt/0/DAAESbhAQ4AeAABiBcCkMoDxOwjPgv.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAe36hAMgASwABaBcIz9iDG3bKDnA.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAeZLeAMgASwABgBbWBL-DLhJ-6I5.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAiN6qAEsAEsAAbBb6PlpDrQrNYmj.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAiou3AEsAEsAASBb5AA6BacLCnTv.png/0?ck=####
- t####.c####.q####.####.com/tdata_Rnl693
- t####.c####.q####.####.com/tdata_Soq141
- t####.c####.q####.####.com/tdata_siA393
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- v2.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####
- z####.ika####.cn/log.js?cnid=####&uid=####&cnid=####&imsi=####&imei=####...
Запросы HTTP POST:
- 1####.134.99.111/api.php?format=####&t=####
- a####.u####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- cx.ika####.cn/cx/itf/clickAdLog
- cx.ika####.cn/cx/itf/loadingChapter
- cx.ika####.cn/cx/itf/mySidebar
- j####.ika####.cn/proto/parseLog
- s####.e.qq.com/activate
- s####.e.qq.com/click
- s####.e.qq.com/msg
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
- v.g####.qq.com/gdt_stats.fcg
- z####.ika####.cn/book/chapterUpdate?ids=####&cnid=####&umeng=####&versio...
- z####.ika####.cn/validate!validateData.xhtml
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1670433904
- /data/data/####/-18840332331462689164
- /data/data/####/-19618087431776070699
- /data/data/####/-2012115410
- /data/data/####/-908322109
- /data/data/####/-998889220659548291
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1551890098048.log
- /data/data/####/17kAppPrefs.xml
- /data/data/####/1825113284-1779931011
- /data/data/####/1825113284933825702
- /data/data/####/28f9cb25a7c6
- /data/data/####/339204258
- /data/data/####/5ead7c1916e321af3ee0d7d6aa595238.temp
- /data/data/####/7631f3ce1066c876bee5583477893c70.temp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/__xadsdk__remote__final__running__.jar
- /data/data/####/baidu_mobads_shoubailp.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/config.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/finalcore.jar
- /data/data/####/finalcore.jar.tmp
- /data/data/####/freebook_comm.db-journal
- /data/data/####/gdaemon_20161017
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/http_cx.ikanshu.cn_0.localstorage-journal
- /data/data/####/http_cx.ikanshu.cn_0.localstorage-journal (deleted)
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/libjiagu.so
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/sdk_config.xml
- /data/data/####/tdata_Rnl693
- /data/data/####/tdata_Rnl693.jar
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_siA393
- /data/data/####/tdata_siA393.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-1006829624.tmp
- /data/media/####/-1901295708.tmp
- /data/media/####/-2053317259.tmp
- /data/media/####/-576146247.tmp
- /data/media/####/-67183002.tmp
- /data/media/####/-832410140.tmp
- /data/media/####/-932851909.tmp
- /data/media/####/.cer
- /data/media/####/.fb
- /data/media/####/.sfp
- /data/media/####/.testf
- /data/media/####/.ygzhang
- /data/media/####/1096257968.tmp
- /data/media/####/1920440290.tmp
- /data/media/####/320891_-1
- /data/media/####/457558
- /data/media/####/457559
- /data/media/####/457560
- /data/media/####/457561
- /data/media/####/457562
- /data/media/####/457563
- /data/media/####/457564
- /data/media/####/457565
- /data/media/####/457566
- /data/media/####/457567
- /data/media/####/457568
- /data/media/####/457569
- /data/media/####/457570
- /data/media/####/457571
- /data/media/####/457572
- /data/media/####/457573
- /data/media/####/457574
- /data/media/####/457575
- /data/media/####/457576
- /data/media/####/457577
- /data/media/####/457578
- /data/media/####/457579
- /data/media/####/457580
- /data/media/####/457581
- /data/media/####/457582
- /data/media/####/457583
- /data/media/####/457584
- /data/media/####/457585
- /data/media/####/457586
- /data/media/####/457587
- /data/media/####/457588
- /data/media/####/457589
- /data/media/####/457590
- /data/media/####/457591
- /data/media/####/457592
- /data/media/####/457593
- /data/media/####/457594
- /data/media/####/796777571.tmp
- /data/media/####/884699791.tmp
- /data/media/####/91086930.tmp
- /data/media/####/921061191.tmp
- /data/media/####/989596579.tmp
- /data/media/####/V310_com.mianfeizs.book_dir.ski
- /data/media/####/V310_com.mianfeizs.book_dir.ski.tmp
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.mianfeizs.book.bin
- /data/media/####/com.mianfeizs.book.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/tdata_Rnl693
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_siA393
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.chineseall.reader.util.IGeTuiService 24804 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- mount
Загружает динамические библиотеки:
- getuiext2
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
- RSA-None-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
