Adware.Gexin.11835

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 2####.119.205.154:80
TCP(HTTP/1.1) cloud####.fengkon####.com:80
TCP(HTTP/1.1) e####.bs####.yy.com:80
TCP(HTTP/1.1) do.yy.du####.com:80
TCP(HTTP/1.1) short-y####.yy.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) zon####.bs####.yy.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) updat####.yy.com:80
TCP(HTTP/1.1) zon####.bs2.yy.com:80
TCP(HTTP/1.1) abtes####.yy.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) m####.h####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(HTTP/1.1) d####.3g.yy.com:80
UDP(TELNET) 61.1####.52.149:23
TCP(TELNET) 1####.242.117.100:23
UDP(TELNET) 2####.170.50.135:23
UDP(TELNET) 1####.242.117.100:23
UDP(TELNET) 61.1####.52.174:23
UDP(TELNET) 1####.20.84.154:23
TCP(TLS/1.0) cdn.h####.com:443
TCP(TLS/1.0) w####.yyst####.com:443
TCP(TLS/1.0) m####.h####.com:443
TCP(TLS/1.0) e####.bs####.yy.com:443
TCP(TLS/1.0) y####.du####.com:443
TCP(TLS/1.0) abtes####.yy.com:443
TCP(TLS/1.0) updat####.yy.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) web.yyst####.com:443
TCP(TLS/1.0) co####.h####.com:443
TCP(TLS/1.0) wap.cmpass####.com:8443
TCP(TLS/1.0) r####.yy.com:443
TCP(TLS/1.0) is.sn####.com:443
UDP 61.1####.73.130:80
TCP ope####.m.ta####.com:443
TCP 1####.239.231.113:8086
TCP 1####.247.249.98:5002
TCP 1####.25.94.163:8086
TCP sdk.o####.t####.####.com:5224
TCP 61.1####.29.221:6002
UDP 4####.56.75.12:4002
UDP 1####.247.249.98:5002
TCP 61.1####.29.190:86
TCP c####.g####.ig####.com:5225
TCP openj####.m.ta####.com:80
UDP 2####.194.67.7:6002
UDP 61.1####.29.221:6002
UDP 60.2####.219.164:4002
UDP 61.1####.29.190:86
UDP 1####.231.141.196:6002
UDP 1####.242.117.100:5002
UDP 2####.194.67.7:4002
UDP 2####.228.248.99:4002
UDP 1####.90.175.158:80
TCP 1####.9.223.59:84

Запросы DNS:

7j####.c####.z0.####.com
a####.3g.yy.com
a####.3g.yy.com
a####.man.aliy####.com
abtes####.yy.com
ag####.m.ta####.com
amdc####.m.ta####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.h####.com
cloud####.fengkon####.com
co####.h####.com
crash-r####.yy.com
d####.3g.yy.com
da####.yy.com
do.yy.du####.com
e####.bs####.yy.com
f####.fengkon####.com
gray-co####.yy.com
is.sn####.com
m####.h####.com
norma-e####.m####.com
plb####.u####.com
pub-####.qin####.com
r####.yy.com
screen####.dwst####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
short-y####.yy.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
updat####.yy.com
w####.yy.com
w####.yyst####.com
w####.yyst####.com
w####.yyst####.com
w-yy####.yy.com
wap.cmpass####.com
web.yyst####.com
y####.du####.com
y####.h####.com
zon####.bs####.yy.com
zon####.bs2.yy.com

Запросы HTTP GET:

abtes####.yy.com/shareLanguage/default?uid=####&yyVersion=####&os=####&m...
d####.3g.yy.com/ad/live?uid=####&yyVersion=####&os=####&model=####&osVer...
d####.3g.yy.com/schedule/offch?uid=####&yyVersion=####&os=####&model=###...
d####.3g.yy.com/search/hot?uid=####&yyVersion=####&os=####&model=####&os...
d####.3g.yy.com/speed/entrance?uid=####&yyVersion=####&os=####&model=###...
d####.3g.yy.com/speed/nav/speedIndex/idx?uid=####&yyVersion=####&os=####...
d####.3g.yy.com/speed/nav/speed_life/idx?uid=####&yyVersion=####&os=####...
d####.3g.yy.com/speed/nav/speed_watch/idx?uid=####&yyVersion=####&os=###...
d####.3g.yy.com/speed/navs?uid=####&yyVersion=####&os=####&model=####&os...
do.yy.du####.com/dynamic-shunt-data/type2/109/AudioengineConfig
do.yy.du####.com/dynamic-shunt-data/type2/109/Hw264Config
e####.bs####.yy.com/MTYzY2RhM2UtZWVkZi00MThlLTk1MTUtYTAxMDAwZGM1M2U5.png
e####.bs####.yy.com/NzM4ZjllY2QtNGYzNy00NWE5LWE5N2QtODg2MGFjZTc1ZWJm.png
e####.bs####.yy.com/OTA5YjlhZmUtNzc1OS00ZGI4LTljYTAtYjEwNjZmYzhkNDg4.png
e####.bs####.yy.com/ZTNhZjE5NjQtNWE3Ny00MzMwLTljYmUtY2EyYjYzYjBjZjkz.png
e####.bs####.yy.com/yysnapshot/0251bcc4f279e27cd8c0d64214afd71893f36b23?...
e####.bs####.yy.com/yysnapshot/11bc7cec1980d975001157341eb142923e0db4b2?...
e####.bs####.yy.com/yysnapshot/5b4ea7f26a1b29ca4bc91cb25f37fc81de1d0e3e?...
e####.bs####.yy.com/yysnapshot/72a23139ee11f2f62dcb13d126a1251b79e073d5?...
e####.bs####.yy.com/yysnapshot/871e240f4a430a32aabf1b2b47593d98aa33bfbc?...
e####.bs####.yy.com/yysnapshot/8d81acf3a1205450387b92991bf8ea4da7cea909?...
e####.bs####.yy.com/yysnapshot/f7c508bfdb4791ae5f7ef79ef598c37f29f6707c?...
e####.bs####.yy.com/yysnapshot/fbe21698154b33aaa9fc124648e5f193d150b81c?...
norma-e####.m####.com/android/exchange/getpublickey.do
qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/tdata_JNg986
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_iRz660
t####.c####.q####.####.com/tdata_zzW503
ti####.c####.l####.####.com/config/hz-hzv3.conf
updat####.yy.com/api/1/forceversion/getAll?user=####&nounce=####&time=##...
updat####.yy.com/c.gif?ot=####&dr2=####&nt=####&sr=####&sbd=####&sd=####...
updat####.yy.com/speed/android/activate?uid=####&yyVersion=####&os=####&...
zon####.bs####.yy.com/group16/M00/5556/20190402_141155047248.xml
zon####.bs2.yy.com/group16/M00/ad1fe03b9cdf47b1858805edc657ed29.jpg?imag...
zon####.bs2.yy.com/group16/M00/e7b042a04eae486ba8e671770804ff3b.jpg?imag...

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
c-h####.g####.com/api.php?format=####&t=####
cloud####.fengkon####.com/v2/device/conf
f####.fengkon####.com/v2/device/profile
m####.h####.com/c.gif?act=####&smkdata=####&EC=####&appkey=####&item=###...
norma-e####.m####.com/push/android/external/add.do
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
short-y####.yy.com/dau/reporting
updat####.yy.com/dau/reporting

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/009fd9de16a240ac9a38bb9f46c42769
/data/data/####/1554572217760mysharelanguage.txt
/data/data/####/20190402_141155047248.xml
/data/data/####/22f75106ac8c6a8a76957b3894231d1e763cc2d46899f02....0.tmp
/data/data/####/3214f57a2f07d21b04c2d769da67d5a0e28222a28d9344e....0.tmp
/data/data/####/375830d3081d
/data/data/####/3d6b6a3a78c4e94261c36b350460452007a68b415bff9ed....0.tmp
/data/data/####/4382bc7ec208fd628dae21974f2eeb73a6ea44f7d3eb22b....0.tmp
/data/data/####/75F0ED65DF2431A0DA6BB3D164054C01
/data/data/####/9c4999fdd312d70ac13b48c4352b57b78f3e6f41aebd3c4....0.tmp
/data/data/####/ACCS_BINDumeng;5a276a10f29d982f520000f1
/data/data/####/ACCS_SDK
/data/data/####/ACCS_SDK_CHANNEL
/data/data/####/AGOO_BIND
/data/data/####/Agoo_AppStore
/data/data/####/Alvin2
/data/data/####/AndroidManifest.xml
/data/data/####/AudioengineConfig
/data/data/####/ContextData
/data/data/####/DaemonServer
/data/data/####/HwCodecConfig
/data/data/####/KLog.mmap2
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PLUGIN_PREFERENCES
/data/data/####/RuntimeKit
/data/data/####/UM_PROBE_DATA
/data/data/####/UpgradePref
/data/data/####/abtest
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/cloudms.conf
/data/data/####/com.shumei
/data/data/####/com.x.y.1
/data/data/####/com.x.y.2
/data/data/####/com.yy.shortpushsvc.db-journal
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU0NTcyMjEzMTgz;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTU0NTcyMjI5MDE1;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default
/data/data/####/downloader.db-journal
/data/data/####/e972dbde8bb27c788bbc4bd328f09501e3a553bdfdf9614....0.tmp
/data/data/####/ec5f8267baa02d8a0f7e893cdb733113f093f0244362780....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f2c245dec1064f48ac9c41c9ddc19022
/data/data/####/f5bec572c77470bf5b778ce3b5ce857a74ac469e65e6788....0.tmp
/data/data/####/f98be5c67307e33dfe9b01d4adc4d8960ced5e480117253....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/fef404bc8a4d4ee3ac4148d8c6901da594755bdf465b896....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hd_default_pref
/data/data/####/hdcltid
/data/data/####/hdcommon_config_cache_pref
/data/data/####/hdid.bck
/data/data/####/hdid_v2
/data/data/####/hdstatis_cache_3ed8578c.db-journal
/data/data/####/hdstatis_cache_4b04df0e.db-journal
/data/data/####/hdstatis_cache_b6fa708d.db-journal
/data/data/####/hdstatis_cache_d6aa665f.db-journal
/data/data/####/hduuid_v1
/data/data/####/httpdns_config_cache
/data/data/####/i==1.2.0&&1.9.2_1554572213179_envelope.log
/data/data/####/index
/data/data/####/info
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/lbscache
/data/data/####/libbasenet.so
/data/data/####/libcom_yy_lite_plugin_im.apk
/data/data/####/libcom_yy_lite_plugin_liveextension.apk
/data/data/####/libcom_yy_lite_plugin_updateres.apk
/data/data/####/libgnustl_shared.so
/data/data/####/libim.so
/data/data/####/libjiagu708335345.so
/data/data/####/libyycrashreport.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version
/data/data/####/mz_push_preference
/data/data/####/nav_cache.txt
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/seq
/data/data/####/small-plugin
/data/data/####/splash_cache.txt
/data/data/####/table
/data/data/####/tdata_JNg986
/data/data/####/tdata_JNg986.jar
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_iRz660
/data/data/####/tdata_iRz660.jar
/data/data/####/tdata_zzW503
/data/data/####/tdata_zzW503.jar
/data/data/####/tracker.db-journal
/data/data/####/tt_sdk_settings
/data/data/####/ttopenadsdk
/data/data/####/ttopensdk.db-journal
/data/data/####/udbauthlooog-journal
/data/data/####/um_pri
/data/data/####/umdat
/data/data/####/umeng_common_config
/data/data/####/umeng_common_location
/data/data/####/umeng_general_config
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/yyabtest.db
/data/data/####/yyabtest.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.thumbcache_idx0
/data/media/####/.umm.dat
/data/media/####/2019-04-06.log.txt
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/Device
/data/media/####/Device_v2
/data/media/####/Global
/data/media/####/KLog_2019_04_06_17_36.txt
/data/media/####/LogPath.txt
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.yy.yylite.bin
/data/media/####/com.yy.yylite.db
/data/media/####/d2b08ce4-1e6c-4515-b320-680ecdd98da2
/data/media/####/deviceToken
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/hdcltid.ini
/data/media/####/hdstatis_20190406.log
/data/media/####/hduuid_v1
/data/media/####/imsdk.txt
/data/media/####/info.txt
/data/media/####/libcom_yy_lite_plugin_im.so
/data/media/####/libcom_yy_lite_plugin_liveextension.so
/data/media/####/libcom_yy_lite_plugin_updateres.so
/data/media/####/pushsvc_log.txt
/data/media/####/shumei.txt
/data/media/####/tdata_JNg986
/data/media/####/tdata_MkX219
/data/media/####/tdata_iRz660
/data/media/####/tdata_zzW503
/data/media/####/test.log
/data/media/####/uuid
/data/media/####/yysdk_adapter-04-06-17-36.txt

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a276a10f29d982f520000f1","utdid":"XKjjtAQh7NUDAGdzx1ERSNv7","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.yy.pushsvc.GTPush.GeTuiService 24325 300 0
cat /proc/self/cgroup
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls -l /system/bin/su
ls -l /system/xbin/su
ls /
ls /sys/class/thermal
mount
ps
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.yy.pushsvc.GTPush.GeTuiService 24325 300 0

Загружает динамические библиотеки:

DeviceIdentifier
androiditna
basenet
getuiext2
im
libgnustl_shared
libjiagu708335345
libyycrashreport
smsdk
tnet-3.1
yycrashreport
yylog
yyprotolitesdk

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
DES-ECB-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней