Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) assets####.u####.cn:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) r####.uu.qq.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) f####.zc####.com:80
- TCP(HTTP/1.1) t####.qq.com:8080
- TCP(HTTP/1.1) t####.qq.com:14000
- TCP(HTTP/1.1) zc####.u####.cn:80
- TCP(HTTP/1.1) app.zc####.com:80
- TCP(HTTP/1.1) d####.zc####.com:80
- TCP(HTTP/1.1) 1####.55.186.26:80
- TCP(HTTP/1.1) m.zc####.com:80
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP t####.qq.com:8080
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5225
- TCP t####.qq.com:14000
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.u####.com
- app.zc####.com
- assets####.u####.cn
- c####.g####.ig####.com
- c####.g####.ig####.com
- c-h####.g####.com
- d####.zc####.com
- f####.zc####.com
- hm.b####.com
- m.zc####.com
- pi####.qq.com
- r####.uu.qq.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- t####.qq.com
- www.google-####.com
- www.googlet####.com
- zc####.u####.cn
Запросы HTTP GET:
- app.zc####.com/client/confs/list
- app.zc####.com/client/version?remindTimestamp=####
- assets####.u####.cn/im_client/cmps/My97DatePicker/WdatePicker.js?v=####
- assets####.u####.cn/im_client/cmps/My97DatePicker/skin/WdatePicker.css
- assets####.u####.cn/im_client/cmps/bootstrap/dist/css/bootstrap.min.css?...
- assets####.u####.cn/im_client/cmps/lightbox/dist/css/lightbox.css?v=####
- assets####.u####.cn/im_client/cmps/lightbox/dist/images/close.png
- assets####.u####.cn/im_client/cmps/lightbox/dist/images/loading.gif
- assets####.u####.cn/im_client/cmps/lightbox/dist/images/next.png
- assets####.u####.cn/im_client/cmps/lightbox/dist/images/prev.png
- assets####.u####.cn/im_client/css/build-feedback.css?v=####
- assets####.u####.cn/im_client/css/build-index.css?v=####
- assets####.u####.cn/im_client/css/build-index.mob.css?v=####
- assets####.u####.cn/im_client/js/build-feedback.js?v=####
- assets####.u####.cn/im_client/js/build-index.js?v=####
- f####.zc####.com/boss.cms.web/default/078581985cee4d92be72d67e15453fd3.jpg
- f####.zc####.com/boss.cms.web/default/3db8b5d1e9e84adbb4b52390c2c84ad6.png
- f####.zc####.com/boss.cms.web/default/45cd7c47fa3149fe97f51b372e3dbe93.jpg
- f####.zc####.com/boss.cms.web/default/4a0d256913da47f1a3bc0bd589c6bd7f.jpg
- f####.zc####.com/boss.cms.web/default/a2ff91b5a0754afca7726e12d5ea1398.jpg
- f####.zc####.com/boss.cms.web/default/a4a66e769770447dbe1cb02402ed3326.jpg
- f####.zc####.com/boss.cms.web/default/c0347d4aa10644f1b2c0557fe99e9394.jpg
- f####.zc####.com/boss.cms.web/default/c5c4db4830da4b499eb1ef6566a105c3.jpg
- f####.zc####.com/boss.cms.web/default/d5f4958941cd49d0a9b3655ca2f5eba9.jpg
- f####.zc####.com/boss.cms.web/default/d7401cc0722743f6a7755769be49cd2f.jpg
- f####.zc####.com/web.template/default/386b1be109504bd38ef619dbb3cbd671.png
- f####.zc####.com/web.template/default/4aecce5ddb7d49498b421332df6b82de.png
- f####.zc####.com/web.template/default/588fc1ee6bdc497e9cf466a16a76c758.png
- f####.zc####.com/web.template/default/b0c3c09be4a248d8863a88f15c0dc29d.gif
- f####.zc####.com/web.template/default/bc4278bf182b4ccfaedaf10243d1fc94.png
- f####.zc####.com/web.template/default/c0146888765a4d4bbb3a34131c0ea479.png
- f####.zc####.com/zcmall_subject/zcmall-fe/analytics.js?v=####
- hm.b####.com/hm.js?0123ab6####
- hm.b####.com/hm.js?f7eb951####
- m.zc####.com/css/app/base-8ffe63f106.css
- m.zc####.com/css/app/icons.css
- m.zc####.com/css/weui/style/weui.css
- m.zc####.com/images/public/sprite.png
- m.zc####.com/images/zcmall_logo-1c4a136177.png
- m.zc####.com/js/app/base-b69cd4f345.js?v=####
- m.zc####.com/js/app/config-02cb900414.js
- m.zc####.com/js/app/phoneRandom.js?v=####
- m.zc####.com/js/app/utils.js?v=####
- m.zc####.com/js/app/zcmall.js?v=####
- m.zc####.com/js/components/go2Top/go2Top.js?v=####
- m.zc####.com/js/components/lazyLoading/lazyLoading.js?v=####
- m.zc####.com/js/lib/Zepto.js?v=####
- m.zc####.com/js/lib/ejs.js?v=####
- m.zc####.com/js/lib/md5.js?v=####
- m.zc####.com/js/lib/share.js?v=####
- m.zc####.com/js/lib/zepto.all.js?v=####
- m.zc####.com/module/Product/list.css
- m.zc####.com/module/Product/productDesc-b485b57468.js?v=####
- m.zc####.com/module/Product/productDesc-b874e98b3c.css
- m.zc####.com/module/Product/productDesc-b874e98b3c.css?v=####
- m.zc####.com/module/public/template/slideMenu-6f54a548e3.js?v=####
- m.zc####.com/xz/xz_detail_17611.html?platform=####
- t####.c####.q####.####.com/tdata_SzD730
- t####.c####.q####.####.com/tdata_ZCi456
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- zc####.u####.cn/favicon
- zc####.u####.cn/favicon?access_token=####&user_id=####
- zc####.u####.cn/im_client/?platform=####
- zc####.u####.cn/im_client/audio/im_notify.mp3
- zc####.u####.cn/im_client/cmps/raven-js/dist/raven.min.js?_=####
- zc####.u####.cn/im_client/feedback.html?platform=####&deep=####&udesk_h5...
- zc####.u####.cn/im_client/fonts/iconfont.css?v=####
- zc####.u####.cn/im_client/fonts/iconfont.ttf?t=####
- zc####.u####.cn/im_client/images/black-list.png?v=####
- zc####.u####.cn/im_client/images/loading.gif?v=####
- zc####.u####.cn/im_client/locales/zh-cn.json
- zc####.u####.cn/im_client/log_filters/sentry.json
- zc####.u####.cn/im_client?platform=####
- zc####.u####.cn/simple_captcha?code=####&time=####
- zc####.u####.cn/spa1/im/im_customize/window
- zc####.u####.cn/spa1/im/im_customize/window?access_token=####&user_id=####
- zc####.u####.cn/spa1/im/web_im_feedbacks/captcha
- zc####.u####.cn/spa1/im/web_im_feedbacks/setting_templet?platform=####&d...
Запросы HTTP POST:
- a####.u####.com/app_logs
- app.zc####.com/client/device/binding
- app.zc####.com/client/index/v7
- app.zc####.com/client/roadshow/v2/column/list
- app.zc####.com/client/share/content
- c-h####.g####.com/api.php?format=####&t=####
- d####.zc####.com/analysis/app_event
- r####.uu.qq.com/rqd/sync
- sdk.o####.p####.####.com/api.php?format=####&t=####
- t####.qq.com:14000/203.205.146.122:14000/
- t####.qq.com:8080/203.205.146.122:8080/
- zc####.u####.cn/spa1/im_user
- zc####.u####.cn/spa1/im_user?access_token=####&user_id=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.com.zcmall.video;xg_service_v2.xg.stat..xml
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.tpns.xml.xml
- /data/data/####/.tpush_mta.xml
- /data/data/####/3xVTJJSTUXXiY6PcHGVJjZZoIPk.-891374447.tmp
- /data/data/####/6C0Yau2bO-cE4bE9EE8khuyI7lA.1219920985.tmp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/C1qj3_LCz8Fc9bmZWsmVU2E-W-M.209748208.tmp
- /data/data/####/CVwtzp9S0LfAeQOtLhh73LwiFbY.-438584589.tmp
- /data/data/####/Dd6KT_ZeQfg8Df65cdhxBo6vaZg.-697526500.tmp
- /data/data/####/EcpP4Pxi9r4Bn8hq_ZyESclKhEk.-384137390.tmp
- /data/data/####/N1URKrXrd-YreZBv0y57tnYLOuE.1177170074.tmp
- /data/data/####/PJEF6FikqB1atz22jijxZFv_w6I.-1842267485.tmp
- /data/data/####/PRxPcTD-savlB5Ml1WzlnrD9LYY.-920529202.tmp
- /data/data/####/QALConfigStore.dat
- /data/data/####/RHT8ZpYv2mDUVdM5uUpXz6idNOg.948496307.tmp
- /data/data/####/TLS_DEVICE_INFO.xml
- /data/data/####/WLOGIN_DEVICE_INFO.xml
- /data/data/####/Y7QdZTYaW6v8sY2HDsMca-j4PNs.-1682772182.tmp
- /data/data/####/app_update.xml
- /data/data/####/bugly_data.xml
- /data/data/####/bugly_db_imsdk-journal
- /data/data/####/com.zcmall.xml
- /data/data/####/d68bGjJ35zr6GVF4W8khX5XdD58.-503599397.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/device_id.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/hfUu5m21kZuXx5cQwGnrdpY4wDo.383977717.tmp
- /data/data/####/imei
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/libjiagu.so
- /data/data/####/message_dot_store.xml
- /data/data/####/mobclick_agent_cached_com.zcmall.video240
- /data/data/####/multidex.version.xml
- /data/data/####/oBK1Y2lzeU5gfF4lQ4NzD4BOP74.2056489018.tmp
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qQe6uyHbpsxh63CkCKIgFzh9-1A.1360187245.tmp
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/report_v5.msgstore-journal
- /data/data/####/run.pid
- /data/data/####/sf_app_config.xml
- /data/data/####/tdata_SzD730
- /data/data/####/tdata_SzD730.jar
- /data/data/####/tdata_ZCi456
- /data/data/####/tdata_ZCi456.jar
- /data/data/####/tls_device.dat
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize_qq.xml
- /data/data/####/wdEEI1o2FVGcIflW5HwovkPl7Nw.-1864193963.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/wlogin_device.dat
- /data/data/####/zcmallDefault.xml
- /data/media/####/1_log.txt
- /data/media/####/app.19.04.03.21.log
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.zcmall.video.db
- /data/media/####/com.zcmall.video.guopeng.model.b.cache
- /data/media/####/com.zcmall.video.guopeng.roadshow.list.b.b.cache
- /data/media/####/guid
- /data/media/####/imsdk_20190403.log
- /data/media/####/sdk.19.04.03.21.log
- /data/media/####/tdata_SzD730
- /data/media/####/tdata_ZCi456
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.board.platform
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24589 300 0
- <Package Folder>/lib/libtpnsWatchdog.so <Package>,2100182079; 55941 203.205.128.130 [{"idx":0,"ts":%d,"et":2000,"si":0,"ui":"<IMEI>","ky":"Axg%lu","mid":"0","ev":{"ov":"18","sr":"600*752","md":"<System Property>","lg":"en","sv":"2.43","mf":"unknown","apn":"%s"}}] 0 18
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop ro.board.platform
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24589 300 0
- sh <Package Folder>/lib/libtpnsWatchdog.so <Package>,2100182079; 55941 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : 0 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 2.43 , mf : unknown , apn : %s }}] 0 18
Загружает динамические библиотеки:
- Bugly
- _imcore_jni_gyp
- getuiext2
- gifimage
- imagepipeline
- libjiagu
- libwtcrypto
- qalcodecwrapper
- qalmsfboot
- tpnsSecurity
Использует следующие алгоритмы для шифрования данных:
- DES-CBC-PKCS5Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию о настроках APN.
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
