Adware.Gexin.9730

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.c####.com.cn:80
TCP(HTTP/1.1) z####.z####.com.cn:80
TCP(HTTP/1.1) oss.newairc####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) d####.c####.com.cn:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) ta.8####.cn:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) zjo####.z####.com.cn:80
TCP(HTTP/1.1) mep####.z####.com.cn:80
TCP(TLS/1.0) s####.ml####.cc:443
TCP(TLS/1.0) oss.newairc####.com:443
TCP(TLS/1.0) h5.newairc####.com:443
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
a####.b####.qq.com
a####.u####.com
aexcep####.b####.qq.com
and####.b####.qq.com
c####.g####.ig####.com
c-h####.g####.com
d####.c####.com.cn
h5.newairc####.com
img.newairc####.com
l####.tbs.qq.com
mep####.z####.com.cn
oss.newairc####.com
pub-####.qin####.com
s####.ml####.cc
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
ta.8####.cn
www.c####.com.cn
www.z####.com.cn
z####.z####.com.cn

Запросы HTTP GET:

d####.c####.com.cn/ad/ad.gif
d####.c####.com.cn/ad/ad.js
d####.c####.com.cn/dnsb/html/2019-03/01/node_156.htm
d####.c####.com.cn/dnsb/images/2019-03/01/A1/dnsb20190301A1_b.jpg
d####.c####.com.cn/dnsb/paperindex.htm
d####.c####.com.cn/dnsb/tplimg/bg-2.gif
d####.c####.com.cn/dnsb/tplimg/bg-2.jpg
d####.c####.com.cn/dnsb/tplimg/bg_banmian.jpg
d####.c####.com.cn/dnsb/tplimg/bg_banner.jpg
d####.c####.com.cn/dnsb/tplimg/bg_bar2.jpg
d####.c####.com.cn/dnsb/tplimg/bg_bmt.jpg
d####.c####.com.cn/dnsb/tplimg/cal_b1.jpg
d####.c####.com.cn/dnsb/tplimg/calendarp.js
d####.c####.com.cn/dnsb/tplimg/d.gif
d####.c####.com.cn/dnsb/tplimg/d1.gif
d####.c####.com.cn/dnsb/tplimg/dnsbnew.gif
d####.c####.com.cn/dnsb/tplimg/epaper_bg00.jpg
d####.c####.com.cn/dnsb/tplimg/formap.js
d####.c####.com.cn/dnsb/tplimg/hengdian.gif
d####.c####.com.cn/dnsb/tplimg/icon.gif
d####.c####.com.cn/dnsb/tplimg/image129.gif
d####.c####.com.cn/dnsb/tplimg/index_02.jpg
d####.c####.com.cn/dnsb/tplimg/index_03.jpg
d####.c####.com.cn/dnsb/tplimg/index_04.jpg
d####.c####.com.cn/dnsb/tplimg/jquery.jscrollpane.css
d####.c####.com.cn/dnsb/tplimg/mp.js
d####.c####.com.cn/dnsb/tplimg/mpcore.js
d####.c####.com.cn/dnsb/tplimg/paper_blu.css
d####.c####.com.cn/dnsb/tplimg/pdf.gif
d####.c####.com.cn/dnsb/tplimg/period.js
d####.c####.com.cn/dnsb/tplimg/search.js
d####.c####.com.cn/dnsb/tplimg/swfobject.js
d####.c####.com.cn/dnsb/tplimg/xdjb.gif
mep####.z####.com.cn/szb/css/allApp.css
mep####.z####.com.cn/szb/images/css_sprites.png
mep####.z####.com.cn/szb/images/onload.png
mep####.z####.com.cn/szb/js/fastclick.js
mep####.z####.com.cn/szb/js/jquery-1.11.1.min.js
mep####.z####.com.cn/szb/js/zjrb_hd.js
mep####.z####.com.cn/szb/laydate/laydate.js
mep####.z####.com.cn/szb/laydate/theme/default/laydate.css
mep####.z####.com.cn/szb/swiper/swiper.css
mep####.z####.com.cn/szb/swiper/swiper.jquery.min.js
mep####.z####.com.cn/szb/zjrb_hd.html?theDate=####&link=####
oss.newairc####.com/global/app/v1/common/css/amazeui.min.css
oss.newairc####.com/global/app/v1/common/js/third.combine.min.js
oss.newairc####.com/global/user/yzxw/mobile/config/news_read.html
oss.newairc####.com/yzxw/pic/201703/14/2e9be320-8240-45a1-ac82-c7962ebf7...
oss.newairc####.com/yzxw/pic/201810/21/11801b86-c6b1-4750-b96d-32c167a99...
oss.newairc####.com/yzxw/pic/201810/21/df62c9ed-16d1-49fe-a3a4-7933fd2b3...
oss.newairc####.com/yzxw/pic/201811/05/082700b8-1fb7-485c-9ba2-ea09b947f...
oss.newairc####.com/yzxw/pic/201811/05/3ba806fb-0a9d-483e-8988-d4e9bbb09...
oss.newairc####.com/yzxw/pic/201811/05/41fb4a58-6cf1-48e3-b542-f98ea277e...
oss.newairc####.com/yzxw/pic/201811/05/4924999d-41ed-4279-a426-a464dc7e1...
oss.newairc####.com/yzxw/pic/201811/05/585ebb7c-e7e9-41b8-8dd2-eb3394228...
oss.newairc####.com/yzxw/pic/201811/05/5e0450cf-454e-4e69-ad9b-017983eb0...
oss.newairc####.com/yzxw/pic/201811/05/66d77aab-8692-4d8a-a33a-89bca57be...
oss.newairc####.com/yzxw/pic/201811/05/81077cf8-67e1-44e3-bcb7-719b23555...
oss.newairc####.com/yzxw/pic/201811/05/9065832e-1b61-4654-b65e-ac071fad8...
oss.newairc####.com/yzxw/pic/201811/05/90f28b54-2167-4c6c-8aa7-70c6406b3...
oss.newairc####.com/yzxw/pic/201811/05/a8169946-1096-45bb-a904-849a5f80c...
oss.newairc####.com/yzxw/pic/201811/05/c3718572-7331-49e1-9c87-3c9871b09...
oss.newairc####.com/yzxw/pic/201811/05/c97bf9d7-bfe3-45a8-86d0-92eefe294...
oss.newairc####.com/yzxw/pic/201811/05/d4c4dd05-f904-4839-af2b-5b39b50e0...
oss.newairc####.com/yzxw/pic/201811/05/f952134f-38f1-4203-8efa-81b432c0f...
oss.newairc####.com/yzxw/pic/201811/05/f962143d-dd2d-40f9-9bad-787b7290a...
oss.newairc####.com/yzxw/pic/201811/05/fd40e9f9-84ae-4913-b5b6-00570dd9b...
oss.newairc####.com/yzxw/pic/201812/04/eb2188be-b49a-418c-9eac-3862f9ba5...
qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/tdata_Rnl693
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_fEV688
t####.c####.q####.####.com/tdata_siA393
ta.8####.cn/c/js/ta.js?mpid=####
ti####.c####.l####.####.com/config/hz-hzv3.conf
www.c####.com.cn/inc/foot/foot_dzb.html
z####.z####.com.cn/
z####.z####.com.cn/05zjol/adcode/js/epaper/ed-left-text1.js
z####.z####.com.cn/05zjol/adcode/js/epaper/ed-left-text2.js
z####.z####.com.cn/05zjol/adcode/js/epaper/ed-left-text3.js
z####.z####.com.cn/05zjol/adcode/js/epaper/ed-left-text4.js
z####.z####.com.cn/05zjol/adcode/js/epaper/ed-left-text5.js
z####.z####.com.cn/05zjol/adcode/js/epaper/top-ad.js
z####.z####.com.cn/html/2019-03/06/node_18.htm
z####.z####.com.cn/tplimg/calendar2.js
z####.z####.com.cn/tplimg/jquery-1.3.2.min.js
z####.z####.com.cn/tplimg/mpNewPower.js
z####.z####.com.cn/tplimg/newPower2.js
z####.z####.com.cn/tplimg/newpower1.js
z####.z####.com.cn/tplimg/style.css
zjo####.z####.com.cn/05zjol/system/2016/02/17/021024737.shtml
zjo####.z####.com.cn/homezb/right/201607/t20160722_1787070.shtml

Запросы HTTP POST:

a####.u####.com/app_logs
aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
d####.c####.com.cn/dnsb/html/2019-03/period.xml
l####.tbs.qq.com/ajax?c=####&k=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1312716470
/data/data/####/-1382212414
/data/data/####/-1382929202
/data/data/####/-1383137891
/data/data/####/-1384060261
/data/data/####/.imprint
/data/data/####/00e4b90df64adf4a8db0ed3de645f4e1d594563a268d664....0.tmp
/data/data/####/01b655aa843ebb49e385e6295ce6b57264c9e077e7ac827....0.tmp
/data/data/####/061d76eb835236f03415913258232347951e52e7dfc38eb....0.tmp
/data/data/####/08526264012e510178a45caaebb5da239920f488ce35fe8....0.tmp
/data/data/####/1180820770
/data/data/####/1389023919
/data/data/####/1601092246
/data/data/####/1695857311
/data/data/####/1957047657
/data/data/####/19f2094086048f3fbd435ae6b15459c21a029b28aa84af4....0.tmp
/data/data/####/1ed3e8261c282e84c2ba7cf7230f69b6e39e4f414501d86....0.tmp
/data/data/####/2014116873
/data/data/####/2015247937
/data/data/####/22b46b93b3dbcf4681df96bc5efc84c21d4648e5dc0fce8....0.tmp
/data/data/####/22b46b93b3dbcf4681df96bc5efc84c21d4648e5dc0fce8...87c4.0
/data/data/####/23ccb68137b113bc0f141468441ac68b30b8cc5a77b2354....0.tmp
/data/data/####/23dee73c96e36cd4391721414f30544247448bf97d40c33....0.tmp
/data/data/####/255dcadbe2f6dbc81e62d741926c4765c1b20f8c7150b97....0.tmp
/data/data/####/2e37cc9b8cd631e9271dd1e71cd25c4895b232f780a8998....0.tmp
/data/data/####/2efdbe55e3dad536f4cd763c6b06be7b78cedea5499d856....0.tmp
/data/data/####/2f324776b5cc
/data/data/####/3240b517a9a317e523094dcbe9e101d679a6351cd8b0e0d....0.tmp
/data/data/####/34a7d696c781737843f65b3def7bd58e0b4fdf9b3907e18....0.tmp
/data/data/####/386967948
/data/data/####/392c94e9709f0db1a50f0f62951f7a5a28d2bd61234dab9....0.tmp
/data/data/####/394ebf617ad1dda5a0c27a902986a2e7788215d619ba645....0.tmp
/data/data/####/3e0dc87d6945df005cac97a8891e716c3eaa5c7b273ccbb....0.tmp
/data/data/####/4202269d93b71232fcd83a25d5c81622d8b8cd532d7c19f....0.tmp
/data/data/####/43316c6a3821252b5e1f3fb3178f55cb93e5f291cb39c6e....0.tmp
/data/data/####/45b13a5b31477a40bf18c41553fa979ea2eb32a15f8ef25....0.tmp
/data/data/####/492055135
/data/data/####/4936239f9184c334ed5a40bf801a423fdbd1e091b53d04c....0.tmp
/data/data/####/4d968f0d12d7858ddc456aa49165a0e84bd034b8b42dd69....0.tmp
/data/data/####/4fa611de433f73c675dc74d69caae3fa950d092f5f64a09....0.tmp
/data/data/####/505ee3e4150c70a6a74f9ee885eb50f79b0c883af82203b....0.tmp
/data/data/####/55dd5b5b9378705604f256d1395183bc6d820be69e3a06f....0.tmp
/data/data/####/59a723c6a74a3bc70e227ea5b9249325287bb9120755998....0.tmp
/data/data/####/5d41750942b4eecd8dbfa58306f596c848196ddf40a7edf....0.tmp
/data/data/####/624304295
/data/data/####/6514bc78b51cac33a990c133a9bfc2134020ef45a08b4be....0.tmp
/data/data/####/659b164c66b3e30c2751c77d8ac7c635cd29aaa6397b97a....0.tmp
/data/data/####/6c94b41ed1ff1c810a4b6299dca3b92744bd0a99c14ffed....0.tmp
/data/data/####/71690958038775fdff41c6eef3e23f7b10d3ec9d535f833....0.tmp
/data/data/####/71c10339e0a0784823c2a1799ed44319a3f6a5cd8151400....0.tmp
/data/data/####/722462662
/data/data/####/746bdcfdd070f263dc1ec6c2dee2795a1c27db9192b327c....0.tmp
/data/data/####/79ca191eace3743ed4c448f3ee908e106fcc5eafbd5cb93....0.tmp
/data/data/####/7aa3577d3679619849b54f28392616f8433b45d5299759c....0.tmp
/data/data/####/860bf8622381494930ed4a393ff40176bb4d61874df0aa7....0.tmp
/data/data/####/89c038f808564d6aa4b22ba9b3b65b531d705fedd0c740c....0.tmp
/data/data/####/8e6df45bd6bb9eb8d060c7b3ed21e1ec2e811d0fd8764a3....0.tmp
/data/data/####/8fd43a07a4c1acb3b5ae0a22a4944f9a615084f68148c26....0.tmp
/data/data/####/943fc5e8c8006de9df00ae59a2c91ecb2d4289a8973668b....0.tmp
/data/data/####/9a96e6dfd276c1c0b627f89d5cc9c70b606c2c7d65c213e....0.tmp
/data/data/####/FZLTXHK-GBK_YS.ttf
/data/data/####/a8e2a46c7e1a5f7756c747b4e4fb0cf4c0b353f01fe2d3b....0.tmp
/data/data/####/a99804dfacec0ed2a7218434e904318bd2863583637c7e3....0.tmp
/data/data/####/amazeui.min.css
/data/data/####/amazeui.min.js
/data/data/####/angular1.4.6.min.js
/data/data/####/base.css
/data/data/####/bugly_db_legu-journal
/data/data/####/c3f2a37e20b8871ab746e0c8e47372d3dc04bc502ed6bc2....0.tmp
/data/data/####/c4a998a9ed999e5c6595d24b2db6b4290704de069262ba3....0.tmp
/data/data/####/c7150d393f48619f9fa01405ae0eb1317e10d803ba48c47....0.tmp
/data/data/####/ca7338bb0d74abcc7c873a607bc0a6f7bd76b652ae42f8e....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cc4c246992578a81210a3c8acbe16fd6943e844a3cfc306....0.tmp
/data/data/####/columnId.xml
/data/data/####/com.founder.yinzhou-1.apk.classes-1239446955.zip
/data/data/####/core_info
/data/data/####/d9bee897872c97b76e76ec0af27ddc64abab5f96ce52c44....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_founder0-journal
/data/data/####/dbdabe013d6be11706a5f4f199cc06508142fec60726fc3....0.tmp
/data/data/####/dc51e4696093333fd8522f6a590d69961058748281de3b7....0.tmp
/data/data/####/dd5237282db0ba256c463696c69b7fd9543540750744b1b....0.tmp
/data/data/####/de2e1c2008b17b2fd8318720f493ea91f1c5563e7f1e09c....0.tmp
/data/data/####/debug.conf
/data/data/####/e6c1edfb6d700544d86bdd70e7ac55b73a2b7e18216f13f....0.tmp
/data/data/####/efdf7a576064e5e875587b48c37d1880dc9f09496081bf1....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f14d8208b47f5b47c71ffc0b773ff22db24a73d6be44d81....0.tmp
/data/data/####/f457dfb58edbeceef66b9fe37271aa0845d6d1c4027c6ab....0.tmp
/data/data/####/f9739dcad6f707c811882d33c4780607ff620e951bc844c....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/ffe49f04af67859d40bff62d5ec4492ae5e1ad3562e523e....0.tmp
/data/data/####/fontawesome-webfont.ttf
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/great_button.png
/data/data/####/great_cancel_button.png
/data/data/####/gx_sp.xml
/data/data/####/helpMsg.xml
/data/data/####/icon-images.png
/data/data/####/icon_audio_play.png
/data/data/####/icon_file.png
/data/data/####/icon_file_down.png
/data/data/####/icon_meta_voice.png
/data/data/####/icon_selector_normal.png
/data/data/####/icon_selector_press.png
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/jquery.min2.2.0.js
/data/data/####/js.combine.min.js
/data/data/####/libnfix.so
/data/data/####/libshella-2.10.3.1.so
/data/data/####/libufix.so
/data/data/####/loading.png
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/mwsdk_analytics.db-journal
/data/data/####/native_record_lock
/data/data/####/news_detail.html
/data/data/####/persistent_data.xml
/data/data/####/play.png
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/reader.db-journal
/data/data/####/run.pid
/data/data/####/sanjiaoxing.png
/data/data/####/security_info
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_Rnl693
/data/data/####/tdata_Rnl693.jar
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_fEV688
/data/data/####/tdata_fEV688.jar
/data/data/####/tdata_siA393
/data/data/####/tdata_siA393.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/video.png
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/app.db
/data/media/####/com.founder.yinzhou.bin
/data/media/####/com.founder.yinzhou.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/journal.tmp
/data/media/####/localTemplate.zip
/data/media/####/tdata_Rnl693
/data/media/####/tdata_Soq141
/data/media/####/tdata_fEV688
/data/media/####/tdata_siA393
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.GeTuiPushService 24956 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.3.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
mount

Загружает динамические библиотеки:

Bugly
getuiext2
libnfix
libshella-2.10.3.1
libufix
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней