Adware.Gexin.11550

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cha####.m.s####.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) kdhcod####.dftou####.com:80
TCP(HTTP/1.1) api.kxcon####.com:666
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) ursw####.n####.127.net:80
TCP(HTTP/1.1) sta####.itc.cn:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) cms-bu####.ws.126.####.com:80
TCP(HTTP/1.1) 3g.163.com.####.com:80
TCP(HTTP/1.1) gs.a.s####.com:80
TCP(HTTP/1.1) analy####.163.com:80
TCP(HTTP/1.1) sdk.lov####.com.####.com:80
TCP(TLS/1.0) 3g.163.com.####.com:443
TCP(TLS/1.0) cha####.m.s####.####.com:443
TCP(TLS/1.0) sta####.itc.cn:443
TCP(TLS/1.0) nex.s####.nt####.####.com:443
TCP(TLS/1.0) pg-a####.ws.126.####.com:443
TCP(TLS/1.0) ursw####.n####.127.net:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5227

Запросы DNS:

29e5534####.cdn.so####.com
39d0825####.cdn.so####.com
3g.1####.com
7j####.c####.z0.####.com
a####.u####.com
adv-sv-####.f####.cn
analy####.163.com
api.klaun####.com
api.kxcon####.com
c####.g####.ig####.com
c####.g####.ig####.com
c-h####.g####.com
cha####.m.163.com
cms-bu####.n####.127.net
cms-bu####.ws.126.net
g.1####.com
ipser####.3g.163.com
js.s####.com
kdhcod####.dftou####.com
m.s####.com
n####.163.com
pg-a####.ws.126.net
pub-####.qin####.com
pv.s####.com
s.go.s####.com
sdk.c####.ig####.com
sdk.lov####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
se####.s####.com
st####.ws.126.net
sta####.itc.cn
t####.s####.com
txt.go.s####.com
ursw####.n####.127.net
v2.s####.com
www.qchann####.cn
yt####.ws.126.net

Запросы HTTP GET:

3g.163.com.####.com/163/frontend/antnest/NTM-5AE0KFYY-2.js
3g.163.com.####.com/163/frontend/libs/antanalysis.min.js
3g.163.com.####.com/touch/all?nav=####&dataversion=####&version=####
3g.163.com.####.com/utf8/3g/touch/images/toast-download.png
analy####.163.com/ntes.js
analy####.163.com/ntes?_nacc=wap&_nvid=5d58d56ad3317e4698dcce225e977ae8&...
api.kxcon####.com:666/v1/config/funclist?cid=####&param=####
cha####.m.s####.####.com/data/d/iosTracking/lite_wap_dl_1/click?callback...
cha####.m.s####.####.com/data/d/iosTracking/lite_wap_dl_13/click?callbac...
cha####.m.s####.####.com/data/d/iosTracking/lite_wap_dl_14/click?callbac...
cha####.m.s####.####.com/data/d/iosTracking/lite_wap_dl_2/click?callback...
cms-bu####.ws.126.####.com/2019/04/03/0bd36036093941b5bc85434f72dd21f9.p...
cms-bu####.ws.126.####.com/2019/04/03/3c7c92dfeb8f43698c20ec2899a7538f.p...
cms-bu####.ws.126.####.com/2019/04/03/4c8b02df24354ec094794c72c601863c.p...
cms-bu####.ws.126.####.com/2019/04/03/b619f695ff8245e7840b27e5e5b0c936.j...
cms-bu####.ws.126.####.com/2019/04/03/dce4dd4d0f9145c8b6fce929be503163.p...
cms-bu####.ws.126.####.com/2019/04/03/f7659999d60b43e58e8494a3d9fed74b.p...
gs.a.s####.com/
gs.a.s####.com/limit
gs.a.s####.com/pv.js?_t=####
kdhcod####.dftou####.com/newskey_kdh/code
sdk.lov####.com.####.com/chksdkupdate.php?chid=####&sdkver=####&mainver=...
sta####.itc.cn/mobile/css/images/sicon-f14559e8.ttf
sta####.itc.cn/mobile/css/main-009a471d2b.css
sta####.itc.cn/mobile/js/lib-3b8927cf84.js
sta####.itc.cn/mobile/js/main-9f5d4a940c.js
sta####.itc.cn/mobile/sohu-logo-d.png
sta####.itc.cn/mobile/sohu-logo-festival.png
sta####.itc.cn/mobile/ucenter/images/ic_home_photo_gray.png
sta####.itc.cn/q_70,c_fill,w_640,h_320,g_faces/os/news/3d68139b6abc1dc73...
sta####.itc.cn/q_70,c_fill,w_640,h_320,g_faces/os/news/585a4c81816a9840f...
sta####.itc.cn/q_70,c_fill,w_640,h_320,g_faces/os/news/8009a749f46aa4daf...
sta####.itc.cn/q_70,c_fill,w_640,h_320,g_faces/os/news/85760508326e3426c...
sta####.itc.cn/q_70,c_fill,w_640,h_320,g_faces/os/news/cb27a40e44579cba7...
sta####.itc.cn/q_70,c_fill,w_640,h_320,g_faces/os/news/e9d4ff2dbf6aed82e...
sta####.itc.cn/q_70,c_fill,w_640,h_320,g_faces/os/news/ec3159fc1601403da...
sta####.itc.cn/spm/prod/js/1.0.1/index.js
sta####.itc.cn/static/images/mobile/home/20190329/high-price-job.png
sta####.itc.cn/static/images/mobile/home/20190329/house-making.png
sta####.itc.cn/static/images/mobile/home/20190329/house-move.png
sta####.itc.cn/static/images/mobile/home/20190329/local-service.png
sta####.itc.cn/static/images/mobile/home/20190329/pet-zone.png
sta####.itc.cn/static/images/mobile/home/20190329/rent-house.png
sta####.itc.cn/static/images/mobile/home/20190329/second-car.png
sta####.itc.cn/static/images/mobile/home/20190329/second-good.png
sta####.itc.cn/static/images/mobile/home/20190329/second-house.png
sta####.itc.cn/static/images/mobile/home/20190329/tv-repair.png
t####.c####.q####.####.com/tdata_AXX896
t####.c####.q####.####.com/tdata_BAI450
t####.c####.q####.####.com/tdata_Fus136
ti####.c####.l####.####.com/config/hz-hzv3.conf
ti####.c####.l####.####.com/tdata_EDT369
ursw####.n####.127.net/2018/10/25/73707e7dacb141cd8daa4ecb2ac59e58.jpeg?...

Запросы HTTP POST:

a####.u####.com/app_logs
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/5258fe921f05
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/knews-db-journal
/data/data/####/lebian_base.xml
/data/data/####/libjiagu.so
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/tdata_AXX896
/data/data/####/tdata_AXX896.jar
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_Fus136
/data/data/####/tdata_Fus136.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/01f6e1935ae9ea15cc4b5739c23fe19d394c85b65ca29c....0.tmp
/data/media/####/038579c1218e1251617def3c72258ae792d0e9c1611d27....0.tmp
/data/media/####/0635d9e330c22c16119c163471c152bddc2a55ed413a9d....0.tmp
/data/media/####/0fe05e479370457baa30d79fcda56139cc85e001d83222....0.tmp
/data/media/####/1.png
/data/media/####/10.png
/data/media/####/11.jpg
/data/media/####/11.png
/data/media/####/12.jpg
/data/media/####/12.png
/data/media/####/12a275280dca2a4a07fc9908521898339d19e8ea7cac43....0.tmp
/data/media/####/12eafe70813795ad6f552ebb6b7f56260ddcc3271a9c4b....0.tmp
/data/media/####/13.jpg
/data/media/####/13.png
/data/media/####/14.png
/data/media/####/1499530e4b348dfa9bf1cc095de6078d510ab3eeeed703....0.tmp
/data/media/####/15.png
/data/media/####/16.jpg
/data/media/####/17.jpg
/data/media/####/18.png
/data/media/####/1830d4ea17565899fd61a2e56662b0c6b01bc034face74....0.tmp
/data/media/####/19.jpg
/data/media/####/1a7e4e2817236a594910ae3a4d188a3ae47c595a905f72....0.tmp
/data/media/####/2.png
/data/media/####/20.jpg
/data/media/####/21.png
/data/media/####/22.jpg
/data/media/####/22.png
/data/media/####/23.jpg
/data/media/####/23.png
/data/media/####/24.jpg
/data/media/####/24.png
/data/media/####/25.jpg
/data/media/####/25.png
/data/media/####/26.jpg
/data/media/####/27.jpg
/data/media/####/273ec85a0197e9c053cef877424a66bce660bc9aabf553....0.tmp
/data/media/####/28.jpg
/data/media/####/29.png
/data/media/####/29b742052b6a0cd9d59abaeb09fa9a32280e9010ea1ec6....0.tmp
/data/media/####/29dabc85dbd6d52656dbed758ba457c9b6c908e8e53bab....0.tmp
/data/media/####/2b55cf8abd37bcf8dd6b07692ed6ac49b86b9f2abb3e67....0.tmp
/data/media/####/2d04bf824b22d5b63ea8d069b8d0911466bbf9b7e01d52....0.tmp
/data/media/####/3.jpg
/data/media/####/30.jpg
/data/media/####/31.png
/data/media/####/31867608846bf465370ddb1b4e087e9f1044a1255b534f....0.tmp
/data/media/####/32.png
/data/media/####/3261142ee8b516f003e4d09bb96e2de72233084c77b09c....0.tmp
/data/media/####/33.png
/data/media/####/34.png
/data/media/####/35.png
/data/media/####/3adfcd546677b3a536ec64ad330cd297553cfcba575553....0.tmp
/data/media/####/3b2ed784b3cbfdf0a0405c4cdfd273101f23ceed31ec9f....0.tmp
/data/media/####/3e430bec42ce5486049d01f6503dab9fe4ac0728f7dba6....0.tmp
/data/media/####/3e96d3146be4a7166632eeba7788dfe704d33f2c4729d3....0.tmp
/data/media/####/3f1da1b621f85e07b9124bc93516fa3842423c151c509d....0.tmp
/data/media/####/3fead764707b1db159b0bed4ab87d53fb25f0d452629ae....0.tmp
/data/media/####/4.jpg
/data/media/####/40b0beeb00c4a12c23bd6b68467eb09b6be4cc0fa4ed74....0.tmp
/data/media/####/4bf749e151e801027728872de87ceae02f9ed5519bab1a....0.tmp
/data/media/####/4d93374afab7d41161f7b81ef41ae460dddd08fe568337....0.tmp
/data/media/####/4e2fca3edc859c17fbca8fe23650cecca6d28c5f1cfb3d....0.tmp
/data/media/####/5.jpg
/data/media/####/592b1825000dd8c1ac9d262b69d75948d25bcbb606138c....0.tmp
/data/media/####/593c8b80453f147de0cbd4da8314cfce2cef00112120fe....0.tmp
/data/media/####/6.jpg
/data/media/####/6132883c8452e5a2d7ac90fb221902b1ba478ef681921d....0.tmp
/data/media/####/6ba6ddfde0bc3e0a39e5d8e59377a31285a0dbaba8d14d....0.tmp
/data/media/####/7.png
/data/media/####/8.png
/data/media/####/86213d717565e0f037be7bd67a96da979653dc8a926379....0.tmp
/data/media/####/885b2464844d868a65840746d41923eba14a17dde5071f....0.tmp
/data/media/####/9.jpg
/data/media/####/953dabb939bb46743908afe6387e60d4e93f5f7a9f3587....0.tmp
/data/media/####/968cf1a36f3541d08599cee1d98a5d1b1640c375cc59e6....0.tmp
/data/media/####/9dbea83d838f96e34507e3682b04a45ffa1d31acd38853....0.tmp
/data/media/####/a025493c58abbad7380e9197b08a3785e48aaf69d6d148....0.tmp
/data/media/####/a30cf638c69023406e1fc4d4173db2a98deccf2abda4a5....0.tmp
/data/media/####/a3c0319b0e6e79dfc13d19a9620284347144a40bbcd60b....0.tmp
/data/media/####/a4551edc643bf233a55b5c20779009d58decbfb44a1734....0.tmp
/data/media/####/a666d9e8a1f717beddc9d972a545d6dabac0eccfcadb15....0.tmp
/data/media/####/a7817e547557e135eadd7c1de2d9d47099df6328bfccca....0.tmp
/data/media/####/ae36de0348a4a3e6599f096ca951d136ab012fe8fc22df....0.tmp
/data/media/####/app.db
/data/media/####/b5d841f65278eabadcf3c7d460b0e889fadc2f8b532b1a....0.tmp
/data/media/####/befd519fc4d0ab2d332318425a43dd8493b934674fa938....0.tmp
/data/media/####/bfa1b8bba211cddf09fe2153f271bc48a6e63bc3f3284b....0.tmp
/data/media/####/c0f917f0e615634d3294128071a69b1677159478ff5957....0.tmp
/data/media/####/c4f112eed2f3859c88dd5240ea17cbb0e5ded129ba6250....0.tmp
/data/media/####/c79cae1bbe7f07393e1f7053b43291c30ebef82d3c0ec0....0.tmp
/data/media/####/c8222b4e5b13274b8f8b61e0520fa0e4697f54a445c85b....0.tmp
/data/media/####/caf892008a6fd2b710c58825d98a4f1d5b9c511b559b48....0.tmp
/data/media/####/cc334c150457327b2947d084b3618d6998e94af1f646e6....0.tmp
/data/media/####/ceb1cb51a7ffc575987a65d7df8ef7ff476f97fae9f459....0.tmp
/data/media/####/cf50a53add6a65967a39cc044bd3296d23e23aa3443134....0.tmp
/data/media/####/cfd3b471c575782ebda65a45c7d89ace5f2b147c4a4f43....0.tmp
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.tops.ytnews.bin
/data/media/####/com.tops.ytnews.db
/data/media/####/d4d8d99f8ba0263c5f00544180ff5288150ced017891e3....0.tmp
/data/media/####/e8726d230636819f6366a9dff62ecd39b45de372a26ed1....0.tmp
/data/media/####/eb0c09b27dbb14016b56e7d3588c2b64e5399c4b4bcf5d....0.tmp
/data/media/####/eda174b0a6d4ab4e3f2a9ddd870f1238f27fcd22859848....0.tmp
/data/media/####/f3a0bd5c53ce9fad816c7acfbf176327282f88c50cebfe....0.tmp
/data/media/####/f4962e405d92a246e691d91badfdfa6454a2c9a7e24c64....0.tmp
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/journal.tmp
/data/media/####/sdkinfo.txt
/data/media/####/tdata_AXX896
/data/media/####/tdata_BAI450
/data/media/####/tdata_Fus136
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.klauncher.knews.service.DemoPushService 24547 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.klauncher.knews.service.DemoPushService 24547 300 0

Загружает динамические библиотеки:

getuiext2
lbcrashhandler
libjiagu

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней