Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) vc.m####.com:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) log.so.hun####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) 0####.h####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) st.bz.m####.com:80
- TCP(HTTP/1.1) d####.t####.m####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) com####.m####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) x.da.m####.com:80
- TCP(HTTP/1.1) o####.ar####.api.####.com:80
- TCP(HTTP/1.1) 1####.h####.com:80
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) mob.bz.m####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) cou####.pe####.m####.com:80
- TCP(HTTP/1.1) o####.ac####.api.####.com:80
- TCP(HTTP/1.1) s5.hun####.com:80
- TCP(TLS/1.0) 2####.58.212.206:443
- TCP(TLS/1.0) qq.i####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP 43.2####.145.65:5226
- TCP t####.nz4.ig####.com:5224
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- a####.u####.com
- ap####.v0.m####.com
- api####.a####.com
- c-h####.g####.com
- com####.m####.com
- cou####.pe####.m####.com
- d####.t####.m####.com
- g####.hun####.com
- imgal####.res.m####.com
- log.da.hun####.com
- log.so.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.i####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- mob.bz.m####.com
- o####.ac####.api.####.com
- o####.ar####.api.####.com
- pl####.log.hun####.com
- pub-####.qin####.com
- rc.m####.com
- s5.hun####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st.bz.m####.com
- t####.nz4.g####.net
- t####.nz4.ge####.com
- t####.nz4.ig####.com
- use####.api.max.####.com
- v2.log.hun####.com
- v2.res.log.####.com
- vc.m####.com
- www.qchann####.cn
- x.da.hun####.com
- x.da.m####.com
Запросы HTTP GET:
- 0####.h####.com/preview/cms_icon/2019/3/30/03/20190330210549824.jpg_366x...
- 0####.h####.com/preview/cms_icon/2019/4/2/04/20190402114726969.jpg_366x2...
- 0####.h####.com/preview/cms_icon/2019/4/2/04/20190402115528417.jpg_750x3...
- 0####.h####.com/preview/cms_icon/2019/4/2/04/20190402134239201.jpg_366x2...
- 0####.h####.com/preview/cms_icon/2019/4/2/04/20190402204429621.gif
- 0####.h####.com/preview/cms_icon/2019/4/2/04/20190402215507182.jpg_750x3...
- 0####.h####.com/preview/cms_icon/2019/4/3/04/20190403005620650.gif
- 0####.h####.com/preview/sp_images/2018/zongyi/323564/4457296/20180709091...
- 1####.h####.com/preview/channel_images/20190313104401743.jpg_366x206.jpg
- 1####.h####.com/preview/channel_images/20190402180928698.jpg_738x416.jpg
- 1####.h####.com/preview/cms_icon/2019/3/23/03/20190323114752234.jpg_366x...
- 1####.h####.com/preview/cms_icon/2019/3/30/03/20190330183057652.jpg_366x...
- 1####.h####.com/preview/cms_icon/2019/3/30/03/20190330210845511.jpg_750x...
- 1####.h####.com/preview/cms_icon/2019/4/1/04/20190401113833664.jpg_750x3...
- 1####.h####.com/preview/cms_icon/2019/4/1/04/20190401135034390.jpg_750x3...
- 1####.h####.com/preview/cms_icon/2019/4/2/04/20190402143056563.jpg_366x2...
- 1####.h####.com/preview/cms_icon/2019/4/2/04/20190402180002651.gif
- 1####.h####.com/preview/cms_icon/2019/4/2/04/20190402202723966.jpg_750x3...
- 1####.h####.com/preview/cms_icon/2019/4/2/04/20190402232957432.gif
- 1####.h####.com/preview/cms_icon/2019/4/3/04/20190403010957078.gif
- 1####.h####.com/preview/sp_images/2018/12/25/dianshiju/323323/4863265/20...
- ap####.v0.m####.com/buffer.php?td=####&net=####&istry=####&aver=####&tim...
- ap####.v0.m####.com/hb.php?ht=####&net=####&istry=####&aver=####&time=##...
- ap####.v0.m####.com/pv.php?nt=####&cpid=####&md=####&tst=####&gps=####&s...
- ap####.v0.m####.com/pv.php?nt=####&ftl=####&cpid=####&md=####&tst=####&g...
- com####.m####.com/video_comment/getcount?type=####&subject_id=####
- cou####.pe####.m####.com/message/poll?uid=####&osVersion=####&did=####&m...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&svrip=####&ver=#...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&ver=####&chk=####
- g####.hun####.com/mobile/distribute.do?deviceid=####
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.so.hun####.com/a.gif?collcnt=####&v5=####&query=####&mod=####&did=##...
- log.so.hun####.com/a.gif?du=####&v5=####&hw=####&query=####&relatedstar=...
- log.so.hun####.com/a.gif?idx=####&cache=####&v5=####&query=####&tp=####&...
- mob.bz.m####.com/odin/c1/channel/list?uid=####&osVersion=####&mac=####&o...
- o####.ac####.api.####.com/artist/getRecommendCollectArtist?uid=####&osVe...
- o####.ar####.api.####.com/artist/getArtistListByIds?artistIds=####&type=...
- o####.ar####.api.####.com/artist/getArtistListByIds?uid=####&type=####&t...
- pl####.log.hun####.com/playerQuality.gif?first_frame_time=####&seeking_t...
- qin####.com.www.####.com/tdata_EDT369
- s5.hun####.com/channel/live?uid=####&osVersion=####&ticket=####&appVersi...
- s5.hun####.com/mobile/like?did=####&uid=####&vid=####&c=####
- s5.hun####.com/mobile/rank?c=####
- s5.hun####.com/mobile/rank?uid=####&osVersion=####&c=####&mac=####&osTyp...
- s5.hun####.com/mobile/uip?uid=####&osVersion=####&ticket=####&appVersion...
- s5.hun####.com/mobile/user?uid=####&c=####&mac=####
- s5.hun####.com/recommend?uid=####&platform=####&osVersion=####&mac=####&...
- s5.hun####.com/user/getActivity?uid=####&osVersion=####&ticket=####&appV...
- s5.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v1/config/play?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v5/listconfig?uid=####&platform=####&osVersion=####&mac=#...
- s5.hun####.com/v6/search/getResult?uid=####&du=####&sort=####&osVersion=...
- s5.hun####.com/v6/search/recommend?uid=####&osVersion=####&ticket=####&a...
- s5.hun####.com/v7/playlist/list?clipId=####&abroad=####
- s5.hun####.com/v7/video/getSource?uid=####&osVersion=####&mac=####&osTyp...
- s5.hun####.com/v8/video/info?uid=####&osVersion=####&mac=####&osType=###...
- s5.hun####.com/v8/video/list?uid=####&appVersion=####&ticket=####&fstlvl...
- s5.hun####.com/v8/video/relative?uid=####&appVersion=####&ticket=####&fs...
- st.bz.m####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
- t####.c####.q####.####.com/tdata_AXX896
- t####.c####.q####.####.com/tdata_BAI450
- t####.c####.q####.####.com/tdata_Fus136
- ti####.c####.l####.####.com/config/bj-bjv6.conf
- ti####.c####.l####.####.com/config/hz-bjv6.conf
- use####.api.max.####.com/person59b2a3c7612aa.jpg
- use####.api.max.####.com/person5a82567c46ff9.jpg
- use####.api.max.####.com/person5ad6eea479eeb.png@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5b1b72e5b9d13.jpg@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/preview/channel_images/20190318092137392.jpg_36...
- use####.api.max.####.com/preview/cms_icon/2019/3/30/03/20190330123918630...
- use####.api.max.####.com/preview/cms_icon/2019/4/2/04/20190402092832561....
- use####.api.max.####.com/preview/cms_icon/2019/4/2/04/20190402104233858....
- use####.api.max.####.com/preview/cms_icon/2019/4/3/04/20190403003652193....
- use####.api.max.####.com/preview/crop/2018/12/26/3530433/crop_500x284_12...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2017/zongyi/31...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2018/zongyi/32...
- use####.api.max.####.com/preview/sp_images/2018/11/20/zongyi/326364/4745...
- use####.api.max.####.com/preview/sp_images/2019/3/12/zongyi/328322/52963...
- use####.api.max.####.com/preview/sp_images/2019/3/25/dianshiju/328307/53...
- use####.api.max.####.com/preview/sp_images/2019/4/1/dianshiju/328819/540...
- use####.api.max.####.com/preview/sp_images/2019/4/2/dianshiju/328307/540...
- v2.log.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- vc.m####.com/v2/dynamicinfo?uid=####&osVersion=####&mac=####&pid=####&os...
Запросы HTTP POST:
- a####.u####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- mo####.log.hun####.com/data.cgi
- o####.ac####.api.####.com/global/config
- o####.ar####.api.####.com/artist/getArtistListByIds
- res####.a####.com/v3/log/init
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- vc.m####.com/v2/watch
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/m/page
- x.da.hun####.com/video/player
- x.da.m####.com/m/page
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-613446739
- /data/data/####/.imprint
- /data/data/####/06a6f1c9760ff3ac1c2dc38579bba50ffde21af5d2be455....0.tmp
- /data/data/####/12aff1b2dda90e95dcb3da38ff959bb74a28929078ebc1c....0.tmp
- /data/data/####/16cc43660839b8b9d46fcda954851c0bad4fad5f0fa11a0....0.tmp
- /data/data/####/16f65bd2f2aae6069e3cbc338037759d
- /data/data/####/1703720991
- /data/data/####/177db8976e8ae0f1bd0c58e4c33762fd5f1820cefb44192....0.tmp
- /data/data/####/1868d53b40311d5f88beb2b9173896505355d7e7b20d529....0.tmp
- /data/data/####/257306020
- /data/data/####/257306024
- /data/data/####/257306028
- /data/data/####/35d0ab16b2f9ea4bf25df2cbbe592cc98510807a2631ba9....0.tmp
- /data/data/####/36f090790d6dfb49e77389d611fafc302e7b95d3abc5d99....0.tmp
- /data/data/####/3c054868f76f7a3db2e5630d5de7f6dbde078db8daab904....0.tmp
- /data/data/####/3e304289cd3b71103d37ee2fb132cfb0037512e71267254....0.tmp
- /data/data/####/3ea7f75e9319667acd3688a0292a937907c735b66bdce56....0.tmp
- /data/data/####/460631495cd2655888efac79f84177cba3d3d71cd5396d4....0.tmp
- /data/data/####/4675f7d50a4e13236537ba37f1694a626601a5c8cd1ec97....0.tmp
- /data/data/####/4675f7d50a4e13236537ba37f1694a626601a5c8cd1ec97...b53f.0
- /data/data/####/50d159367e79f0710371a900e70ac297c44668234361818....0.tmp
- /data/data/####/53df6232bbff6218fbc49d0f37debc75ebada58456fd063....0.tmp
- /data/data/####/53fc1bf9e3dfdc0699e380914e1e36c59d28927b2f4728e....0.tmp
- /data/data/####/59f81c8374feb83fb96c0bbaec620e3d1ef19b174ae96d7....0.tmp
- /data/data/####/5b36ca142e05f4a65a7fbd0feed1a2003e45cdde4e1fbeb....0.tmp
- /data/data/####/5cbea168c8979af6e3d300a22ee0afe77d96757dac3e2d8....0.tmp
- /data/data/####/60902b237da78daa5cfff1e68d96f8913f76748866f9ffb....0.tmp
- /data/data/####/614108960
- /data/data/####/6164488808ecdfe1bb669cf1488d6e4f
- /data/data/####/6e4fc2ca617cc666b5893c40e4f6b4f8e9f84c5fb3bd93b....0.tmp
- /data/data/####/6e4fc2ca617cc666b5893c40e4f6b4f8e9f84c5fb3bd93b...7dfc.0
- /data/data/####/7115a56b634554a215dea44ee35ec98cbb6dbff42b37696....0.tmp
- /data/data/####/729eba43b7115f6bd7c6328adeea23fb0fbe7ce89dda01d....0.tmp
- /data/data/####/85d2d889843333afa1f8839dc62dc0660831a7ff8324086....0.tmp
- /data/data/####/870ed4b4504884c406639a714b65e8a1fd0bc542da0c0c7....0.tmp
- /data/data/####/92f1dfd3c759ed178a21a15fe62df71a3d9f6605800a329....0.tmp
- /data/data/####/933978904
- /data/data/####/9628cafe9294c2ac719f7353d2096e98
- /data/data/####/99ba33c5b3d6607b5bdf2f9522a73f7f6a8acb805299f5f....0.tmp
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MGTVCommon.xml.bak
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/a3cf82daee9710953b74b1549e5843bd85a93775a4b9c3e....0.tmp
- /data/data/####/a7770a65fdd549a7c2d85f9e9de903283335476d7936628....0.tmp
- /data/data/####/a918c9c02c578a4afc894a6e53bcb8f5
- /data/data/####/acb81c0fb695377afcf1d6e34b27791941449b4bc1744e1....0.tmp
- /data/data/####/arch.xml
- /data/data/####/b5899076f90a340e7bc42f83894d0f5fe2273849f526687....0.tmp
- /data/data/####/ba1fae70b949cea63c9506ba64f9161537113beb03c9821....0.tmp
- /data/data/####/bce16e8dc824668ec9befdd6d6f805c1f3fa5eeaee5bc22....0.tmp
- /data/data/####/be77ab49293b194a2691668352fa7750f49f365d6fb5a4c....0.tmp
- /data/data/####/c8649a8cca726f3e4693a0a71e7e0c3e
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/d3774993ff06178ed614bc5116977f53f2f7687006feb32....0.tmp
- /data/data/####/d47f74cbfa4378964c9b5d8331de94ed
- /data/data/####/d4a61dedf35199386d1dce4fb0aa03ae
- /data/data/####/d70571736d7f799df6321c768ebb0b82866819239a6c2ba....0.tmp
- /data/data/####/dbad6ce0d3124746450c94f35bfbfc90
- /data/data/####/df599a1c055cfe9d449932465f0d5606f2df7e908cc5d09....0.tmp
- /data/data/####/e7b5c74b248d2bb50688221386d599e6a0c3494e6bd775c....0.tmp
- /data/data/####/e9a77f5edf1580d46262cfc4554d0427
- /data/data/####/exchangeIdentity.json
- /data/data/####/f2772655e9623fa2ee363e195b872dd236ce24a8915f946....0.tmp
- /data/data/####/f3afcf912a6b7b8f964979f4eb0dad59ba1ba89e6534cb5....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/hmt_agent_commonutill_com.henghua.tv.today.xml
- /data/data/####/hmt_agent_commonutill_device_id.xml
- /data/data/####/hmt_agent_online_setting_com.henghua.tv.today.xml
- /data/data/####/hmt_analytics
- /data/data/####/hmt_analytics-journal
- /data/data/####/hmt_init_savetime.xml
- /data/data/####/hmt_irsuid.xml
- /data/data/####/hmt_session_id.xml
- /data/data/####/hmt_session_id_savetime.xml
- /data/data/####/hmt_session_id_savetime.xml.bak
- /data/data/####/hmt_session_id_savetime.xml.bak (deleted)
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu298812144.so
- /data/data/####/multidex.version.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/root.db-journal
- /data/data/####/run.pid
- /data/data/####/tdata_AXX896
- /data/data/####/tdata_AXX896.jar
- /data/data/####/tdata_BAI450
- /data/data/####/tdata_BAI450.jar
- /data/data/####/tdata_Fus136
- /data/data/####/tdata_Fus136.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
- /data/media/####/1_log.txt
- /data/media/####/89921a201494c7be3eb5e20f7fb56328
- /data/media/####/AN.csv-20190403020305
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1554256987356
- /data/media/####/UA.csv-20190403020308
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/ae756fdd03bf3d7214bd7c1291df4204
- /data/media/####/apge.csv-20190403020353
- /data/media/####/apge.csv-20190403020403
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.henghua.tv.today.bin
- /data/media/####/com.henghua.tv.today.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/d7050efcb2cbb2498c4fa4f2f2e40dfd
- /data/media/####/ed70e2ce4b13272b6d5e60df4775a520
- /data/media/####/ede64ac47a4a9df40754b810918d4523
- /data/media/####/fc56dee3ec7305683dff288e1f541fde
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/journal.tmp
- /data/media/####/qt.csv.1554256983797.txt
- /data/media/####/tdata_AXX896
- /data/media/####/tdata_BAI450
- /data/media/####/tdata_Fus136
- /data/media/####/test.log
- /data/media/####/uuid
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 24972 300 0
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 24972 300 0
Загружает динамические библиотеки:
- CdnAuth
- ImgoFfmpeg
- ImgoHelp
- ImgoMediaPlayer_V3.0.3
- getuiext2
- libjiagu298812144
Использует следующие алгоритмы для шифрования данных:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
