Adware.Gexin.10156

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) app.luobosh####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) q####.a####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) wx.q####.cn:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) tvaxw####.g####.sina####.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) img1-do####.b0.a####.com:443
TCP(TLS/1.0) i####.doub####.com:443
TCP(TLS/1.0) api.feeli####.com:443
TCP(TLS/1.0) s####.cn.ron####.com:443
TCP c####.g####.ig####.com:5227
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
7x####.c####.z0.####.com
a####.b####.qq.com
a####.u####.com
aexcep####.b####.qq.com
and####.b####.qq.com
api.feeli####.com
app.luobosh####.com
c####.g####.ig####.com
c-h####.g####.com
i####.doub####.com
i####.doub####.com
i####.luobosh####.com
nav.cn.ron####.com
pub-####.qin####.com
q.q####.cn
s####.cn.ron####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
t####.sin####.cn
thi####.q####.cn
thi####.q####.cn
www.luobosh####.com
wx.q####.cn

Запросы HTTP GET:

app.luobosh####.com/app/Agreement.html
q####.a####.com//excerptBG/lowerBG/1043/hdpi
q####.a####.com//excerptBG/lowerBG/1086/hdpi
q####.a####.com/56ba9784e4b01e60e7f936c2/149503415773807.jpg
q####.a####.com/578e4003e4b0a743964a8a89/149667315147761.jpg
q####.a####.com/58288821e4b04124f4f91af9/152529921542651.jpg
q####.a####.com/58319250e4b04d7562607526/147971521867702.jpg
q####.a####.com/5831bc8be4b04d756261664e/155107050949605.jpg
q####.a####.com/586f4cd7e4b07fa822bb9251/154086242074495.jpg
q####.a####.com/5874feeae4b07fa822c99870/152099873794401.jpg
q####.a####.com/588b3898e4b0ca4f94985a0a/148552131226424.jpg
q####.a####.com/5997185ae4b03f37f0bf50a0/154472325528005.jpg
q####.a####.com/59b7d505e4b0273735a13b9c/153285454845273.jpg
q####.a####.com/59bf4c46e4b0b0b5cae9431a/154600048729474.jpg
q####.a####.com/59ef6307e4b0a8f16966bb96/153482230586451.jpg
q####.a####.com/5a064fb2e4b0ec13347fb610/151036313042352.jpg
q####.a####.com/5aa356bee4b006c4947f0aee/152518309343762.jpg
q####.a####.com/5ad9ed5ce4b062ec8a030801/154381275368396.jpg
q####.a####.com/5b59db29e4b0507a8eba79da/154919969021431.jpg
q####.a####.com/5bea183be4b0c0c7ef6e3c71/154229770635553.jpg
q####.a####.com/5c386f7ae4b0e19faf7478ea/154942828205464.jpg
q####.a####.com/5c4078a9e4b0dcf57f5c6ad2/154886275522379.jpg
q####.a####.com/5c89e733e4b088630bb733e4/155254159431873.jpg
q####.a####.com/defaultProfileImage.jpg
q####.a####.com/excerptBG/CPUrl/1043/hdpi
q####.a####.com/excerptBG/CPUrl/1080/hdpi
q####.a####.com/excerptBG/CPUrl/1086/hdpi
q####.a####.com/excerptBG/NSPUrl/1043/hdpi
q####.a####.com/excerptBG/NSPUrl/1080/hdpi
q####.a####.com/excerptBG/NSPUrl/1086/hdpi
q####.a####.com/excerptBG/PSDUrl/1043/hdpi
q####.a####.com/excerptBG/PSDUrl/1080/hdpi
q####.a####.com/excerptBG/PSDUrl/1086/hdpi
q####.a####.com/excerptBG/PSUUrl/1043/hdpi
q####.a####.com/excerptBG/PSUUrl/1080/hdpi
q####.a####.com/excerptBG/PSUUrl/1086/hdpi
q####.a####.com/excerptBG/firstTitleBG/1043/hdpi
q####.a####.com/excerptBG/lowerBG/1043/hdpi
q####.a####.com/excerptBG/lowerBG/1086/hdpi
q####.a####.com/excerptBG/perceptionBG/1043/hdpi
q####.a####.com/excerptBG/perceptionBG/1080/hdpi
q####.a####.com/excerptBG/perceptionBG/1086/hdpi
q####.a####.com/excerptBG/secondTitleBG/1043/hdpi
q####.a####.com/excerptBG/tiledBG/1043/hdpi
q####.a####.com/excerptBG/tiledBG/1080/hdpi
q####.a####.com/excerptBG/tiledBG/1086/hdpi
q####.a####.com/excerptBG/upperBG/1043/hdpi
q####.a####.com/excerptBG/upperBG/1080/hdpi
q####.a####.com/excerptBG/upperBG/1086/hdpi
q####.a####.com/luobooms/longArticle/154659903699942.jpg
q####.a####.com/luobooms/longArticle/15465991069219.jpg
q####.a####.com/luobooms/longArticle/154874076064541.jpg
q####.a####.com/luobooms/longArticle/15487407875237.jpg
q####.a####.com/luobooms/longArticle/15495267692023.jpg
q####.a####.com/luobooms/longArticle/154952684758588.jpg
q####.a####.com/luobooms/longArticle/155227408607844.jpg
q####.a####.com/luobooms/longArticle/155227412373414.jpg
q####.a####.com/luobooms/longArticle/155244520457753.jpg
q####.a####.com/splashAd/1052/hdpi
qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/5c7fd7c0e4b011568a87c764/155188253186106.jpg
t####.c####.q####.####.com/tdata_Rnl693
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_fEV688
t####.c####.q####.####.com/tdata_siA393
thi####.q####.cn/g?b=####&k=####&s=####
thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTKPKywXblNzu3icoNoanLv0lMwugBDhhw...
thi####.q####.cn/mmopen/vi_32/qia3ujDMNj5v20AbIicOD3pnG0BayDV71j4IDfCzkD...
thi####.q####.cn/mmopen/vi_32/uRDHR1f9YWH3dpz88OuO5RBXwoG3ZOPALtrthog3YC...
thi####.q####.cn/qqapp/1104888272/088404804AD3B9A1A7246B33DB86141A/100
thi####.q####.cn/qqapp/1104888272/B09B3102B891DC0A4686C4057B1A95F8/100
thi####.q####.cn/qqapp/1104888272/EEC7B77180C543E301E46736CBB0DE65/100
ti####.c####.l####.####.com/config/hz-hzv3.conf
tvaxw####.g####.sina####.com/crop.0.0.1002.1002.180/006Gv5gXly8g0aqevd14...
wx.q####.cn/mmopen/PiajxSqBRaEJW2LHV1hXpbOANZaDic3SpRykptyfjAW4GZxLTM7tB...
wx.q####.cn/mmopen/a9soDuZsxlHrsiaj1GXZ9jmWoxmp6LIT93AoEQhG54wlQmarUBG8C...

Запросы HTTP POST:

a####.u####.com/app_logs
aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
app.luobosh####.com/luoboserver/discover/list
app.luobosh####.com/luoboserver/excerpt/bgBlockList
app.luobosh####.com/luoboserver/excerpt/layout
app.luobosh####.com/luoboserver/excerpt/select
app.luobosh####.com/luoboserver/excerpt/unlockBG
app.luobosh####.com/luoboserver/parameter/list
app.luobosh####.com/luoboserver/recommend/bookSet
app.luobosh####.com/luoboserver/user/activate
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1490355015
/data/data/####/-2015697543
/data/data/####/-2141744983
/data/data/####/.imprint
/data/data/####/1004
/data/data/####/1056642461
/data/data/####/1437647836
/data/data/####/78af617c8170
/data/data/####/832993036
/data/data/####/947181164
/data/data/####/APP_GAOSHOU_KEY.xml
/data/data/####/BLOOMLIFE.xml
/data/data/####/COUNTLY_STORE.xml
/data/data/####/RongPush.xml
/data/data/####/Statistics.xml
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/crashrecord.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libnfix.so
/data/data/####/libshella-2.10.5.9.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/luobo-journal
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/push_daemon
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_Rnl693
/data/data/####/tdata_Rnl693.jar
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_fEV688
/data/data/####/tdata_fEV688.jar
/data/data/####/tdata_siA393
/data/data/####/tdata_siA393.jar
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/10v8x1egamha5c8e4iwcqvu0.tmp
/data/media/####/14kiilpgdz5zphttzn0gmuk8k.tmp
/data/media/####/1769izx1sopqfqba2vmylzggw.tmp
/data/media/####/19-03-14.html
/data/media/####/19tljvq64ib6qlxiqahfg9frq.tmp
/data/media/####/1efh7anrjnjajayeu58oefyam.tmp
/data/media/####/1f88zs3oczpkltzyhq2l9sf10.tmp
/data/media/####/1kxbov9rw3o61sb4ymipnxnel.tmp
/data/media/####/1n5xjeqvv3siojr7l9jrie2h1.tmp
/data/media/####/1pqu6yfocvuodthqhc8fl7brs.tmp
/data/media/####/1r4cdwwblayodctddqz7vai88.tmp
/data/media/####/1smypu3wwmv8pv5zf0njsi3ye.tmp
/data/media/####/1vh0e21u3x294fo1xrz3y2klq.tmp
/data/media/####/1vta4f4qvlde9evdus53q5p3l.tmp
/data/media/####/1wf54lfg9n76gl1uja1lzuv7n.tmp
/data/media/####/1xv6bh0l3hcv8pypxlzf4bf8a.tmp
/data/media/####/202hldozn4yvoln3wdo1hu1mz.tmp
/data/media/####/2101wxhzf9mdn4zm664n1ibm9.tmp
/data/media/####/229i1v925z2de84zgzrneijvd.tmp
/data/media/####/22wskagtev3zuiwhqnj81sy3u.tmp
/data/media/####/234ceaflsc8g2fc2jcqsfywmf.tmp
/data/media/####/23u1pgohhf2tmpmbbge2i9dao.tmp
/data/media/####/2a2bvhrmumtk5ivv097xkm35c.tmp
/data/media/####/2dnsejw6igk0n7av7mn8pks6o.tmp
/data/media/####/2joln0hogwompf6lpsr4ym1oh.tmp
/data/media/####/2lfnxs8xv3481fzzjt8d7msz.tmp
/data/media/####/2naok6m5qq6dwitponqely4xe.tmp
/data/media/####/2ouwwym29eiqsb2c87ujqn3xs.tmp
/data/media/####/2px4qu0917m0jzjwpa0w3vy00.tmp
/data/media/####/2uhx9sz9vu3u4bb9yclxf4z1z.tmp
/data/media/####/2wnhnk3fop3k9btqb13tatdpv.tmp
/data/media/####/2zcjyfcwld70jktpvky4pzlmj.tmp
/data/media/####/30f9hlmcgoh71y54vmjilzk4l.tmp
/data/media/####/35x948g5raxxmv0hc06a566se.tmp
/data/media/####/36mu5w7knvtnzj7jh2b2c8zyj.tmp
/data/media/####/3aglayey21omuy2xdkosbzh93.tmp
/data/media/####/3qfnaessp884afi7wrgdb1kqy.tmp
/data/media/####/3vv9qf2r2r7wfx9dosc4ypva8.tmp
/data/media/####/3zuelpsofhhhbmsr9pc33m0vd.tmp
/data/media/####/41jonwedttpz03ucam53dac1t.tmp
/data/media/####/43nsljjemsgu7q1vwtzs6516n.tmp
/data/media/####/44qbs4vsgwobiejypw37giik6.tmp
/data/media/####/45lsksnmtmvctmbac6ia27hco.tmp
/data/media/####/471hdux8k3nr9ec8vuuv38qfh.tmp
/data/media/####/48lguymrxvsyw8fl3cv7wy9cp.tmp
/data/media/####/4d7psdcgqahfnhr2shy2cync4.tmp
/data/media/####/4fcqr0o5ztf78qdolixo960y2.tmp
/data/media/####/4i631i5cc8ac91f0gzoaoxr0u.tmp
/data/media/####/4mvoc2pwlzj4yse9ufmk579nb.tmp
/data/media/####/4orhzgh01tos4lv99dx5p0wq2.tmp
/data/media/####/4pbxs56bth4plvbue33bzfsan.tmp
/data/media/####/4sh0k29b00yrvsszwvj6ooe53.tmp
/data/media/####/4tm82emio4pt5f88r9a2wumpt.tmp
/data/media/####/4yukxgbwz1hxu3w51ffdye6lp.tmp
/data/media/####/51s357uq2d3qnls9hntkt546u.tmp
/data/media/####/567cb3tu5xd6clat39ba2d4u8.tmp
/data/media/####/5fclcueactxs1pig5bk64410o.tmp
/data/media/####/5gftqsmcbuptjuchh2psvpl9f.tmp
/data/media/####/5k0ooljciadyrj7fxbpoe8phe.tmp
/data/media/####/5n30o6u31qwq25hivdzq4757c.tmp
/data/media/####/5ob97td2bwfu9j6yy8mkqk4jz.tmp
/data/media/####/5pfj934z8i109feyy9ukeyncp.tmp
/data/media/####/5qqhywc5i5hiq4gmjz62rlujb.tmp
/data/media/####/5td5ka7qu9gcrh3c4uuwf6a5m.tmp
/data/media/####/5v2o3q1iapy06hh61449qukfa.tmp
/data/media/####/68fuox03snoyuxiylj1ap7b9w.tmp
/data/media/####/6cg2t6e435qxeuk8oshvb02tm.tmp
/data/media/####/6i65kycfx80z1ut0h9iglw50i.tmp
/data/media/####/6qb4km5hnpaw060xmjg7gazs8.tmp
/data/media/####/6qcuf0rckxta6rtjnfv6djvvf.tmp
/data/media/####/6qhxobhv3oonq0y1n4mhf9mb.tmp
/data/media/####/6sjacanld382fpp7adkcz4xz.tmp
/data/media/####/74vkwjxohjry0pl22s6oje4cy.tmp
/data/media/####/7cjwwgszym7ep5xuk5hukh9bp.tmp
/data/media/####/7k2w923bmsnxjub2a43cxl86x.tmp
/data/media/####/9ikdve0vc7iaqmm2f65zou65.tmp
/data/media/####/RongLog_2_8_13.log
/data/media/####/anm5hi8be8rzfmry5maivbgl.tmp
/data/media/####/app.db
/data/media/####/bnkyb71x1zznc85y5b1a4554.tmp
/data/media/####/com.bloomlife.luobo.bin
/data/media/####/com.bloomlife.luobo.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/eop10xv7yqpjeqjq1b1w0i1e.tmp
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/i0ky67uus1ycm85pn39ho05m.tmp
/data/media/####/p4cuthha1m4i19bf4sdaqtc3.tmp
/data/media/####/pv1yyngcb0m84yqobw5zivyg.tmp
/data/media/####/sz3d2a8nwz3szzrw37maapxv.tmp
/data/media/####/tdata_Rnl693
/data/media/####/tdata_Soq141
/data/media/####/tdata_fEV688
/data/media/####/tdata_siA393
/data/media/####/test.log
/data/media/####/v8n6xgpnmzywvbbnth4e91mp.tmp
/data/media/####/xkktbxh4i0gvlgiwtoldkiv.tmp
/data/media/####/zocm9q7wifo8xuud88mtoyql.tmp

Другие:

Запускает следующие shell-скрипты:

/system/bin/chmod 777 <Package Folder>/app_lib/x86/push_daemon
/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/app_lib/x86/push_daemon <Package> io.rong.push.PushService /storage/emulated/0/.rongLock
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GeTuiPushService 24909 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.5.9.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GeTuiPushService 24909 300 0

Загружает динамические библиотеки:

Bugly
RongIMLib
getuiext2
libnfix
libshella-2.10.5.9
libufix
nfix
push
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней