Adware.Gexin.11911

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) e####.bs####.yy.com:80
TCP(HTTP/1.1) short-y####.yy.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) updat####.yy.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) abtes####.yy.com:80
TCP(HTTP/1.1) zon####.bs####.yy.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) cloud####.fengkon####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) m####.h####.com:80
TCP(HTTP/1.1) d####.3g.yy.com:80
UDP(TELNET) 61.1####.52.149:23
UDP(TELNET) 14.2####.84.167:23
UDP(TELNET) 1####.231.141.196:23
UDP(TELNET) 1####.247.249.98:23
UDP(TELNET) 1####.20.84.154:23
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) co####.h####.com:443
TCP(TLS/1.0) y####.du####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) updat####.yy.com:443
TCP(TLS/1.0) abtes####.yy.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) wap.cmpass####.com:8443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) is.sn####.com:443
TCP 1####.247.249.82:8086
TCP 61.1####.73.148:5002
UDP 2####.170.50.135:80
TCP ope####.m.ta####.com:443
UDP 2####.194.67.7:6002
UDP 1####.90.175.158:4002
TCP sdk.o####.t####.####.com:5224
UDP 61.1####.52.174:4002
TCP c####.g####.ig####.com:5225
TCP openj####.m.ta####.com:80
UDP 61.1####.52.149:4002
UDP 61.1####.29.221:5002
UDP 1####.232.141.22:93
TCP 36.2####.19.6:8083
TCP 1####.185.109.45:8086
TCP 61.1####.29.221:5002
UDP 61.1####.73.148:5002
TCP 58.52.1####.53:94
TCP 1####.232.141.22:93
UDP 60.2####.219.164:6002
TCP 61.1####.73.199:88
UDP 14.2####.84.167:5002

Запросы DNS:

7j####.c####.z0.####.com
a####.3g.yy.com
a####.3g.yy.com
a####.man.aliy####.com
abtes####.yy.com
adser####.go####.com
ag####.m.ta####.com
amdc####.m.ta####.com
c####.g####.ig####.com
c-h####.g####.com
cloud####.fengkon####.com
co####.h####.com
crash-r####.yy.com
d####.3g.yy.com
da####.yy.com
do.yy.du####.com
e####.bs####.yy.com
f####.fengkon####.com
gray-co####.yy.com
is.sn####.com
k####.h####.com
m####.h####.com
norma-e####.m####.com
plb####.u####.com
pub-####.qin####.com
screen####.dwst####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
short-y####.yy.com
ssl.gst####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
updat####.yy.com
w-yy####.yy.com
wap.cmpass####.com
www.go####.com
www.go####.nl
www.gst####.com
y####.du####.com
zon####.bs####.yy.com

Запросы HTTP GET:

abtes####.yy.com/speed/nav/speed_chicken/idx?uid=####&yyVersion=####&os=...
abtes####.yy.com/speed/nav/speed_watch/idx?uid=####&yyVersion=####&os=##...
d####.3g.yy.com/schedule/offch?uid=####&yyVersion=####&os=####&model=###...
d####.3g.yy.com/speed/entrance?uid=####&yyVersion=####&os=####&model=###...
d####.3g.yy.com/speed/nav/speedIndex/idx?uid=####&yyVersion=####&os=####...
d####.3g.yy.com/speed/nav/speed_life/idx?uid=####&yyVersion=####&os=####...
d####.3g.yy.com/speed/nav/speed_sing/idx?uid=####&yyVersion=####&os=####...
d####.3g.yy.com/speed/nav/speed_watch/idx?uid=####&yyVersion=####&os=###...
d####.3g.yy.com/speed/navs?uid=####&yyVersion=####&os=####&model=####&os...
e####.bs####.yy.com/MTE5ZGQ1M2MtYzQxZi00YjIyLTllN2QtOTUzZDk3OGZmMmFh.png
e####.bs####.yy.com/Mjk5MmU3NDgtMGE2Zi00ODBhLWE1NDgtNWY5Y2E4Zjg0MGM4.jpg...
e####.bs####.yy.com/N2Q3ZTUxM2QtMzAwYi00ZDUxLWE0NDUtYzQwMTQ4MTc0ZWYx.jpg...
e####.bs####.yy.com/NDVhNDExYzYtNDBhNS00ZjE4LThlYjctZDNmMTRiNjNlY2E0.png
e####.bs####.yy.com/NTI2OWEzZDktNDQ3Zi00YWM5LWI1YjctOWJjZTdkMjRiMzhl.jpg...
e####.bs####.yy.com/NTc4ZTg3YTktOWYwYS00ODhjLTg3YTgtOTJiODUzMTgwMWQ2.jpg...
e####.bs####.yy.com/NTdjZTYzZWMtNTUxNS00ODM1LWFhZmYtNDE2MzFjZGY5OGEw.jpg...
e####.bs####.yy.com/NmI5Yjk4OGItNTZjNC00YWQzLWI5NTUtNjkzNGRhOTg1Yjg4.png
e####.bs####.yy.com/NmUyZWFlZmUtMDgzOS00ZjdiLTg1NTYtYzkwZmEzNzZjZDQ4.png
e####.bs####.yy.com/ODhhY2Q2YTEtYTQ0ZC00ZDA4LTg0ODUtMDEyYTFiZTdmNjcy.jpg...
e####.bs####.yy.com/ODliNjRkZTQtZjY2MS00OTU1LWE5ZmUtZmZjNGM5YTg3ZWM4.png
e####.bs####.yy.com/OGU3YzM2YmEtZTJkNi00ZmJhLWE2MDQtNDA2Yzc0ZWVjMzM3.png
e####.bs####.yy.com/YTY1OWM4OGUtN2M2MS00ZjQxLTk2MDktMWYzNTRlZDQ2OWQ2.png
e####.bs####.yy.com/YjI2OTkyNDMtM2YxNy00MjllLWI4NzgtZjQ1MzE1NjhjZmM4.png
e####.bs####.yy.com/ZTE5ZDAyNWYtNmQ3NC00ZjQ4LWFiZWYtZmU0NjAzN2Y1ZTJl.jpg...
e####.bs####.yy.com/ZjIzNmQ0MWUtMGYwMi00YTYwLWEwZTYtOTI0OGQ3MmMzMWQw.jpg...
norma-e####.m####.com/android/exchange/getpublickey.do
qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/tdata_JNg986
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_iRz660
t####.c####.q####.####.com/tdata_zzW503
ti####.c####.l####.####.com/config/hz-hzv3.conf
updat####.yy.com/api/1/forceversion/getAll?user=####&nounce=####&time=##...
updat####.yy.com/c.gif?ot=####&dr2=####&nt=####&sr=####&sbd=####&sd=####...
updat####.yy.com/speed/android/activate?uid=####&yyVersion=####&os=####&...
zon####.bs####.yy.com/group16/M00/5556/20190402_141155047248.xml

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
c-h####.g####.com/api.php?format=####&t=####
cloud####.fengkon####.com/v2/device/conf
f####.fengkon####.com/v2/device/profile
m####.h####.com/c.gif?act=####&smkdata=####&EC=####&appkey=####&item=###...
norma-e####.m####.com/push/android/external/add.do
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
short-y####.yy.com/dau/reporting
updat####.yy.com/dau/reporting

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1554612607169mysharelanguage.txt
/data/data/####/158ae778a174de38057ef2d736987c23d208a887ae75824....0.tmp
/data/data/####/20190402_141155047248.xml
/data/data/####/375830d3081d
/data/data/####/42472aa0d8385bd672030f9c07c585aa8af27ab805caa1f....0.tmp
/data/data/####/47c9e92f0e744318899e3bf6956962fd
/data/data/####/4fe13dbdb0d78cd62235857eeed093b399ec3b473bb6f81....0.tmp
/data/data/####/5b8854cbbe22f3460d8538f9b1ce6cd38b6168c069a3f64....0.tmp
/data/data/####/5b99d27d87a2fee5bd14aa52e0cc1c3ba8818f19465d200....0.tmp
/data/data/####/75F0ED65DF2431A0DA6BB3D164054C01
/data/data/####/840248ec0cdf882f335cdc3d9d5cad3ad855a9037869170....0.tmp
/data/data/####/86183b00a9609e3e1eecee7d97808bb8575fb43137697d1....0.tmp
/data/data/####/95ce72b5da2abe984af123ee2dcc0e8734661e31547f0ca....0.tmp
/data/data/####/9fd1487257287898860308663789d0cd0b46840b063734d....0.tmp
/data/data/####/ACCS_BINDumeng;5a276a10f29d982f520000f1
/data/data/####/ACCS_SDK
/data/data/####/ACCS_SDK_CHANNEL
/data/data/####/AGOO_BIND
/data/data/####/Agoo_AppStore
/data/data/####/Alvin2
/data/data/####/AndroidManifest.xml
/data/data/####/ContextData
/data/data/####/DaemonServer
/data/data/####/KLog$$com-yy-yylite.mmap2
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PLUGIN_PREFERENCES
/data/data/####/RuntimeKit
/data/data/####/UM_PROBE_DATA
/data/data/####/UpgradePref
/data/data/####/a30383f3178e528a0e203b89c6dce7d0d39af363d2fd788....0.tmp
/data/data/####/abtest
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/b77fc29ba54c34a9cf281ff84f3e21ad30de28bca565cb6....0.tmp
/data/data/####/b848728369e3413cb96d202b9ab86816
/data/data/####/cloudms.conf
/data/data/####/com.shumei
/data/data/####/com.x.y.1
/data/data/####/com.x.y.2
/data/data/####/com.yy.shortpushsvc.db-journal
/data/data/####/d785ad52de3c7b921d322f298af999e3a8410710099935b....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU0NjEyNTk4NDU4;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTU0NjEyNjE4MjE3;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1NTQ2MTI2MDcwODY=;
/data/data/####/da277c92c7783bf50c9887c52e1892844fdc144c181f56a....0.tmp
/data/data/####/db58a7f0bfe2fbe47262878e162e86f12cc6b3ed44b59c6....0.tmp
/data/data/####/default
/data/data/####/downloader.db-journal
/data/data/####/e6561859e110e923c636d4eb535ec53e4256949436908e2....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f035003361b0b21a1ec66e3903e5674b7cf7c8c84f355aa....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hd_default_pref
/data/data/####/hd_default_pref.tmp
/data/data/####/hdcltid
/data/data/####/hdcommon_config_cache_pref
/data/data/####/hdid.bck
/data/data/####/hdid_v2
/data/data/####/hdstatis_cache_3ed8578c.db-journal
/data/data/####/hdstatis_cache_4b04df0e.db-journal
/data/data/####/hdstatis_cache_b6fa708d.db-journal
/data/data/####/hdstatis_cache_d6aa665f.db-journal
/data/data/####/hduuid_v1
/data/data/####/httpdns_config_cache
/data/data/####/i==1.2.0&&2.2.0_1554612598563_envelope.log
/data/data/####/info
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/lbscache
/data/data/####/libbasenet.so
/data/data/####/libcom_yy_lite_plugin_im.apk
/data/data/####/libcom_yy_lite_plugin_liveextension.apk
/data/data/####/libcom_yy_lite_plugin_quiz.apk
/data/data/####/libcom_yy_lite_plugin_updateres.apk
/data/data/####/libgnustl_shared.so
/data/data/####/libim.so
/data/data/####/libjiagu708335345.so
/data/data/####/libyycrashreport.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version
/data/data/####/mz_push_preference
/data/data/####/nav_cache.txt
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/seq
/data/data/####/small-plugin
/data/data/####/splash_cache.txt
/data/data/####/table
/data/data/####/tdata_JNg986
/data/data/####/tdata_JNg986.jar
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_iRz660
/data/data/####/tdata_iRz660.jar
/data/data/####/tdata_zzW503
/data/data/####/tdata_zzW503.jar
/data/data/####/tracker.db-journal
/data/data/####/tt_sdk_settings
/data/data/####/ttopenadsdk
/data/data/####/ttopensdk.db-journal
/data/data/####/udbauthlooog-journal
/data/data/####/um_pri
/data/data/####/umdat
/data/data/####/umeng_common_config
/data/data/####/umeng_common_location
/data/data/####/umeng_general_config
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state
/data/data/####/yyabtest.db
/data/data/####/yyabtest.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.thumbcache_idx0
/data/media/####/.umm.dat
/data/media/####/2019-04-07.log.txt
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/Device
/data/media/####/Device_v2
/data/media/####/Global
/data/media/####/LogPath.txt
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.yy.yylite.bin
/data/media/####/com.yy.yylite.db
/data/media/####/d2b08ce4-1e6c-4515-b320-680ecdd98da2
/data/media/####/deviceToken
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/hdcltid.ini
/data/media/####/hdstatis_20190407.log
/data/media/####/hduuid_v1
/data/media/####/imsdk.txt
/data/media/####/info.txt
/data/media/####/libcom_yy_lite_plugin_im.so
/data/media/####/libcom_yy_lite_plugin_liveextension.so
/data/media/####/libcom_yy_lite_plugin_quiz.so
/data/media/####/libcom_yy_lite_plugin_updateres.so
/data/media/####/pushsvc_log.txt
/data/media/####/shumei.txt
/data/media/####/tdata_JNg986
/data/media/####/tdata_MkX219
/data/media/####/tdata_iRz660
/data/media/####/tdata_zzW503
/data/media/####/test.log
/data/media/####/uuid
/data/media/####/yysdk_adapter-04-07-04-49.txt

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a276a10f29d982f520000f1","utdid":"XKmBdQE05m4DAGdzx1FGuOTw","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.yy.pushsvc.GTPush.GeTuiService 24325 300 0
cat /proc/self/cgroup
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls -l /system/xbin/su
ls /
ls /sys/class/thermal
mount
ps
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.yy.pushsvc.GTPush.GeTuiService 24325 300 0

Загружает динамические библиотеки:

DeviceIdentifier
androiditna
basenet
getuiext2
im
libgnustl_shared
libjiagu708335345
libyycrashreport
smsdk
tnet-3.1
yycrashreport
yylog
yyprotolitesdk

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
DES-ECB-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней