Adware.Gexin.11847

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) l####.cc:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) app.feilo####.cn:80
TCP(HTTP/1.1) kln.g####.sina####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) a####.vc####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP sdk.o####.t####.####.com:5224
UDP 1####.168.117.1:137
TCP c####.g####.ig####.com:5226

Запросы DNS:

7j####.c####.z0.####.com
a####.exc.mob.com
a####.vc####.com
and####.b####.qq.com
app.feilo####.cn
c####.g####.ig####.com
c####.g####.ig####.com
c-h####.g####.com
img.ma####.w####.com
l####.cc
norma-e####.m####.com
plb####.u####.com
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sec.u####.com
u####.u####.com

Запросы HTTP GET:

app.feilo####.cn/index.php?m=####&c=####&a=####&key=####
kln.g####.sina####.com/client/2018/10/26/nQ2DDzyB.jpg
kln.g####.sina####.com/client/2018/11/10/ayXo8f4Z.jpg
kln.g####.sina####.com/client/2018/11/14/trWpyd6d.jpg
kln.g####.sina####.com/client/2018/11/16/Tup1gT7D.jpg
kln.g####.sina####.com/client/2018/11/26/qSvuZEAm.jpg
kln.g####.sina####.com/client/2018/12/04/BZVT40U2.jpg
kln.g####.sina####.com/client/2018/12/11/0CUWGxDH.jpg
kln.g####.sina####.com/client/2018/12/18/M5WMQdJQ.jpg
kln.g####.sina####.com/client/2018/12/19/Tf5n6023.png
kln.g####.sina####.com/client/2018/12/24/Z6g2cZmX.jpg
kln.g####.sina####.com/client/2019/01/08/5qUZeeM5.jpg
kln.g####.sina####.com/client/2019/01/08/6q7Z3TMC.jpg
kln.g####.sina####.com/client/2019/01/12/x02QT7xd.jpg
kln.g####.sina####.com/client/2019/01/18/6e11cqQ9.jpg
kln.g####.sina####.com/client/2019/01/18/zh6DByiT.jpg
kln.g####.sina####.com/client/2019/01/29/4vY8TVKG.jpg
kln.g####.sina####.com/client/2019/01/30/NlYjoxob.jpg
kln.g####.sina####.com/client/2019/02/11/ltGF8VlS.jpg
kln.g####.sina####.com/client/2019/02/16/Obrg0uUZ.jpg
kln.g####.sina####.com/client/2019/02/25/iMSTWE6z.jpg
kln.g####.sina####.com/client/2019/03/01/UuoJb9aO.jpg
kln.g####.sina####.com/client/2019/03/01/u8Tkd4MR.jpg
kln.g####.sina####.com/client/2019/03/04/pte5V0oY.jpg
kln.g####.sina####.com/client/2019/03/09/l4gN9Va5.jpg
kln.g####.sina####.com/client/2019/03/11/bhdTAWw4.jpg
kln.g####.sina####.com/client/2019/03/16/CALcSgEC.jpg
kln.g####.sina####.com/client/2019/03/18/2oe1JJcl.jpg
kln.g####.sina####.com/client/2019/03/21/vQbRogJg.jpg
kln.g####.sina####.com/client/2019/03/22/mar2I0L9.jpg
kln.g####.sina####.com/client/2019/03/22/qRoaJfFV.jpg
kln.g####.sina####.com/client/2019/03/22/tIeIF3SR.jpg
kln.g####.sina####.com/client/2019/03/28/Wv5FSqfc.jpg
kln.g####.sina####.com/client/2019/03/30/dRPwFcY1.jpg
kln.g####.sina####.com/client/2019/04/02/lV2LQfJX.jpg
kln.g####.sina####.com/client/2019/04/02/myxYN6iO.jpg
kln.g####.sina####.com/client/2019/04/04/1s40ejwK.jpg
kln.g####.sina####.com/client/2019/04/04/FzXqF63Y.jpg
kln.g####.sina####.com/client/2019/04/04/Mx3yYLNN.jpg
kln.g####.sina####.com/client/2019/04/04/QDIwzSNl.jpg
kln.g####.sina####.com/client/2019/04/04/hrqAhCSE.jpg
kln.g####.sina####.com/client/2019/04/04/tbfSq1rS.jpg
kln.g####.sina####.com/client/2019/04/05/pMRlSbv1.png
kln.g####.sina####.com/client/2019/04/06/Okbd1eov.jpg
kln.g####.sina####.com/hcover/2019/01/29/2662775391_j1twyD8p.jpg
l####.cc/i/sdk/is_gal?imei_md5=####&os=####&p_chklst_version=####&retry_...
norma-e####.m####.com/android/exchange/getpublickey.do
t####.c####.q####.####.com/tdata_Jga153
t####.c####.q####.####.com/tdata_Wqf010
t####.c####.q####.####.com/tdata_bca864
t####.c####.q####.####.com/tdata_duV457
ti####.c####.l####.####.com/config/hz-hzv3.conf
ti####.c####.l####.####.com/tdata_EDT369

Запросы HTTP POST:

a####.exc.mob.com/errconf
and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
l####.cc/i/sdk/install
norma-e####.m####.com/push/android/external/add.do
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.duid
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.lock
/data/data/####/.vpl_lock
/data/data/####/0181a10d2e0a543ebe2c653ab0be7b7fab9f095a6e42e9a....0.tmp
/data/data/####/05ba752ca64d2b00bad0d87e3b322c4539d15f7eea46ff3....0.tmp
/data/data/####/06e0cbc50943e4d24064834b118f520e076a2603b1281a0....0.tmp
/data/data/####/06e3eece1ad572865655f76fe25b287ee2e6a6fa2ef2421....0.tmp
/data/data/####/094b9596950d325c89b752759e69f0ae.0.tmp
/data/data/####/094b9596950d325c89b752759e69f0ae.1.tmp
/data/data/####/0d8ed4b63212ea82d189dc8d9116b5894f2807f71b89e35....0.tmp
/data/data/####/0e52cb946db31afe15203b980bb6572b262a426e6e0e68f....0.tmp
/data/data/####/1004
/data/data/####/1004b09103e4d2be7726858542849ae466d42da31ec430f....0.tmp
/data/data/####/17b229e5114fc2a9b443e41df07e0cbad5eb7c703206124....0.tmp
/data/data/####/1865366430675d9e98ee9e4698dd3d14a67e1d6211a44f9....0.tmp
/data/data/####/1948f680e5af891b123c52cc54a09c86.0.tmp
/data/data/####/1948f680e5af891b123c52cc54a09c86.1.tmp
/data/data/####/19a91aca0caa64c87955b76e874f659efa213798df4ae24....0.tmp
/data/data/####/1da00c339a671f2553c5e218f51455ba3d505a2f53b0802....0.tmp
/data/data/####/1e0cf95cb76970bf275fb4ef51f8306b2ad48f5163fbe81....0.tmp
/data/data/####/1e21fa7f92b11d5b34be3c86acff055468f9a41b5c18c2e....0.tmp
/data/data/####/2321ff043da28e668713cdd73e586831deadcdd506698ae....0.tmp
/data/data/####/257df84e14d846aca6baea3d791008fc510300f1841d535....0.tmp
/data/data/####/28b598193fd3c212c9297adeabb7b59f37f81f215f1dbf4....0.tmp
/data/data/####/292411d5af761a7074fae48dcb71f0bc69352c3fe902533....0.tmp
/data/data/####/2982e5067bef5ad95ee0f80d907c4dd74673660251fbb0c....0.tmp
/data/data/####/2d2de37e1aaf3d392970a58603a1af82a12e7713ac368cf....0.tmp
/data/data/####/2da2b280e4e0ac9506fecf716469c546.0.tmp
/data/data/####/2da2b280e4e0ac9506fecf716469c546.1.tmp
/data/data/####/2fe449f2a27c1e95c795993d5295a122da45e4b558f4a34....0.tmp
/data/data/####/317889ffac31f17b69bbd032c742fa38d71129bc7613073....0.tmp
/data/data/####/3c0218bf486d349791d06aceb7df5763d322b6cd571f185....0.tmp
/data/data/####/3e17d8b3577b4a111e0f0519dad66bfb2723c7a3688bb6f....0.tmp
/data/data/####/44b0931ac4e181885a42f22c6be09a237b119eff33d0843....0.tmp
/data/data/####/4a1ec54b88dc61270d820f5af486dce35c542257c973cdb....0.tmp
/data/data/####/4d0a754c4cdff0ae47059826f21845fc3515e4c8f16a458....0.tmp
/data/data/####/4d445fb6ac49cf6f08d1dbe5b406cf6110635c00d6a075d....0.tmp
/data/data/####/4e0b6abc3b71cb829613a5694c36165f67fe1c5c3ae0bf3....0.tmp
/data/data/####/4eb7418b594b19b66e7e52e6e710c6b4599413f751cce29....0.tmp
/data/data/####/509ef5633e6bfba426f9255fa3d8925bc94cab46afea6e5....0.tmp
/data/data/####/5657a57bbc278982a0af363dda5df6476de0aa5505b3c28....0.tmp
/data/data/####/5960348443c09c3e9755e1ec534e4c7d108e6dd359e931f....0.tmp
/data/data/####/5a6037c1063fd4348debd9af42abbbc799cf52e7f7e1a71....0.tmp
/data/data/####/5be6a6733ea9ea653b09f44e96190a0d0e279cd18195da5....0.tmp
/data/data/####/5c21af993fdaeeb21204a79c5f910691b4b403888cd6c70....0.tmp
/data/data/####/603e5c9e506702c7a0faebc52cca006f19af07f21cd32e6....0.tmp
/data/data/####/60a9eb4657c28536edaf564c516e394cd8c8840340a35fb....0.tmp
/data/data/####/63d66ef1c6ea618c0b0850c606326307fd94d3642e8e147....0.tmp
/data/data/####/63e303f16f3aff3aa1324880277febf24939dbb1d126248....0.tmp
/data/data/####/65b971097cc6ad6a7d6b42ffe20fcf1535f58d2f1045cef....0.tmp
/data/data/####/66441e3636723e4cbaa568c14a8711b85f24a473677a41e....0.tmp
/data/data/####/66478463175d884c5451b65b0539384cb24bb2a4b5ace68....0.tmp
/data/data/####/6fa8d3c012cfa75433c59f9e5fcdaaa4610f8bfe743f853....0.tmp
/data/data/####/713605c130b104044503f2eedfbd157e301886b597d2618....0.tmp
/data/data/####/73aacd27c61a8b20a07b942027c03238ad5a07aa0c2cd3a....0.tmp
/data/data/####/7560775acefa40e09e6abc72f5cbe208415a946f67804b7....0.tmp
/data/data/####/7d32bda63689e431b2cccb77027f5181207a5c7f0980107....0.tmp
/data/data/####/7f5c2bc57d4ddcc418c55bfadef0d93d8465cfdd4c23cf5....0.tmp
/data/data/####/84dd0dd08ca8ca426c3ba623559404d640d926e8e4dceb4....0.tmp
/data/data/####/857bac3e029dda88332670a35520f7486d8bfeaf858835b....0.tmp
/data/data/####/8887f5177406b2059ae8e2231f91e5f9e4defab74bea014....0.tmp
/data/data/####/8b621e3ed647b8519c013a174095f1250bfe9e8edef8f51....0.tmp
/data/data/####/8d96ab432284bda4f7efb9ca7aa9857aa8185d677eb51a9....0.tmp
/data/data/####/8ed197ab727f1a09f3ed1551a401b14df217f1ec06f2a59....0.tmp
/data/data/####/8f066a136a9cf8415f374cd924bcf1096eccd9e54d95e7e....0.tmp
/data/data/####/93108e95f48d2a1d9c3c22aa892fb06d3d8c61bdf199b7e....0.tmp
/data/data/####/94f5f75b29cd2f4dfeaa82f5c4f8b3bb8ec26257299399c....0.tmp
/data/data/####/97db344555a70edfa62756a82b680d2309029c0a251e946....0.tmp
/data/data/####/9effb34abbe33aadbc97f011c0c6888162939620f0fda86....0.tmp
/data/data/####/LKME_Server_Request_Queue.xml
/data/data/####/MULTIDEX.xml
/data/data/####/MultiDex.lock
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a170944393ac54c503ba46eacb8aa1c80817e95ef25e147....0.tmp
/data/data/####/a30392a22a4422cec5d57919741d58901edf1d424d7da89....0.tmp
/data/data/####/a6a03669b224e5407c1a34b7c1881b84.0.tmp
/data/data/####/a6a03669b224e5407c1a34b7c1881b84.1.tmp
/data/data/####/a6b80248f6932ee6e0219e886447ec12e404cb025ee34a1....0.tmp
/data/data/####/a835b6bac6fad15e218c014222bd0604.0.tmp
/data/data/####/a835b6bac6fad15e218c014222bd0604.1.tmp
/data/data/####/a8b9f6a92742090f66d6315472664245ef73fad6d1bba76....0.tmp
/data/data/####/a==7.5.4&&7.6.5_1554574507551_envelope.log
/data/data/####/acdfd0160aff7a2f9e2eaab2ae9c1c7ab11ba3f1fe1e629....0.tmp
/data/data/####/acf3d71d9a8fdfe449c00fa9229266853c8485c8cffb76f....0.tmp
/data/data/####/ae6ecf9894285def093c6b474d7c1021b48e5a9bde5f571....0.tmp
/data/data/####/aef16a67d3968f2237e26d951862ee2ae6e4773a1f31b12....0.tmp
/data/data/####/b669ae794db54bb39010464efdd8df9995c8091c46e4c38....0.tmp
/data/data/####/ba5695b2f820cfc70a3912437b5c78306c4ddfb16118f93....0.tmp
/data/data/####/bd5e22f1e3428c5fa45758383b3ad19d474ac326519d3d6....0.tmp
/data/data/####/be7b7b05-7ca6-433e-b4b8-e26585aa3a9b
/data/data/####/bugly_db_-journal
/data/data/####/c003a786fd6741bf0b32e9e4c5a46683ad785ed4c9ad948....0.tmp
/data/data/####/c5a53d42544079ee8bd8e35f3a3a41902fcbdd90c4fceaf....0.tmp
/data/data/####/c828720aef62c6eb789e43cfb2675422ddb8e2c72c06e4d....0.tmp
/data/data/####/cGVyc2lzdDpwcmltYXJ5.0.tmp
/data/data/####/ce0058ad08cc5f61abe5ab5591db6a355156c8fb1d2c1b9....0.tmp
/data/data/####/cmVkdWNlclZlcnNpb24=.0.tmp
/data/data/####/com.weibo.comic_preference.xml
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.2.xml
/data/data/####/crashrecord.xml
/data/data/####/d277bcc7b57452254dffaf3f05c843941b63601d97f52b9....0.tmp
/data/data/####/d6a62e1b19f2b6afb343d551997ee7c0718027ddfb2b0a9....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU0NTc0NDg5ODQ0;
/data/data/####/da894ace7e691efd9b3af5c0a2739d3c8f014138342288f....0.tmp
/data/data/####/dd3f343bb35c8d4b58e7b00f0ae5c631aa74249333aeff6....0.tmp
/data/data/####/df4383693bc6ba2bf8cd710e63d150846c72411ca4699db....0.tmp
/data/data/####/domain_1
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e0f293118d0250192d5de2f3602143ad41b9e517faaef6f....0.tmp
/data/data/####/e44e92863052e1c51a29f3658550fa6e.0.tmp
/data/data/####/e44e92863052e1c51a29f3658550fa6e.1.tmp
/data/data/####/e5293f966fbfcec7ad8fbc0d8615e9b9712ca550c3329c8....0.tmp
/data/data/####/e67bf63b7a5e6bdfc95e6075f23a7d4dff3fcf8be5ec686....0.tmp
/data/data/####/e7af0e87ac188157f4efc2d6582522aa987ce513964a49c....0.tmp
/data/data/####/e98d6173a08b19eb1680e7ce751b80129e0204c2794b1ea....0.tmp
/data/data/####/efa641615f4f322550d1b8dfc1acd24956af998d707d010....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f1c2f9769b949629456956abd84e29b44460c23fe5a0403....0.tmp
/data/data/####/f81dcd8deae343704a96369c6aef4df5b9836c8a4c94603....0.tmp
/data/data/####/f8c9407860334095249f68793741cbf9746486864346a8c....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/i==1.2.0&&7.6.5_1554574489848_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libjiagu170060376.so
/data/data/####/linkedme_referral_shared_pref.xml
/data/data/####/linkedme_referral_shared_pref.xml.bak
/data/data/####/linkedme_referral_shared_pref.xml.bak (deleted)
/data/data/####/local_crash_lock
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/multidex.version.xml
/data/data/####/mz_push_preference.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_Jga153
/data/data/####/tdata_Jga153.jar
/data/data/####/tdata_Wqf010
/data/data/####/tdata_Wqf010.jar
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.jar
/data/data/####/tdata_duV457
/data/data/####/tdata_duV457.jar
/data/data/####/tdid.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/weibo_anime.db
/data/data/####/weibo_anime.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.artc_lock
/data/media/####/.cca.dat
/data/media/####/.di
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.im_lock
/data/media/####/.lesd_lock
/data/media/####/.lm_device_info
/data/media/####/.mn_-1464060969
/data/media/####/.nomedia
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.rc_lock
/data/media/####/.slw
/data/media/####/.ss_lock
/data/media/####/.umm.dat
/data/media/####/.vcomicid
/data/media/####/2019-04-06.log.txt
/data/media/####/255633e1-f975-458f-b4f0-e0c2f879ad1f
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.weibo.comic.bin
/data/media/####/com.weibo.comic.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tdata_Jga153
/data/media/####/tdata_Wqf010
/data/media/####/tdata_bca864
/data/media/####/tdata_duV457
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.sina.anime.gt.PushService 24468 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop
getprop gsm.hw.operator.numeric
getprop gsm.operator.numeric
getprop gsm.sim.preiccid_1
getprop gsm.version.baseband
getprop oem.device.imeicache0
getprop persist.radio.balong0_iccid
getprop persist.radio.balong1_iccid
getprop persist.radio.factory_phone_sn
getprop persist.radio.iccid
getprop persist.radio.imei
getprop persist.radio.meid
getprop persist.radio.previousiccid0
getprop persist.radio.previousiccid1
getprop persist.radio.simswitch.iccid
getprop persist.sys.gnproperty
getprop persist.sys.updater.imei
getprop ril.c2kirat.ia
getprop ril.cdma.meid
getprop ril.gsm.imei
getprop ril.iccid.sim1
getprop ril.iccid.sim2
getprop ril.operator.numeric
getprop ril.serialnumber
getprop ro.com.google.clientidbase
getprop ro.com.google.gmsversion
getprop ro.ril.miui.imei0
getprop ro.ril.oem.imei1
getprop ro.ril.oem.meid
getprop wlan.driver.macaddr
ls /
ls /sys/class/thermal
mount
sh -c cat /proc/version
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.sina.anime.gt.PushService 24468 300 0

Загружает динамические библиотеки:

Bugly
getuiext3
gpuimage-library
libfb
libjiagu170060376
libreactnativejni
libyoga
securityenv

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней