Adware.Gexin.11927

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) publish####.b####.com.####.com:80
TCP(HTTP/1.1) pc.suishe####.net:80
TCP(HTTP/1.1) wlnovel####.b0.a####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) r####.n####.127.net:80
TCP(HTTP/1.1) ads.ku####.cn:80
TCP(HTTP/1.1) 06img####.eas####.com.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) client####.suishe####.cn:80
TCP(HTTP/1.1) api.ku####.cn.####.com:80
TCP(HTTP/1.1) marke####.et####.cn:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i1.g####.com.####.cn:80
TCP(HTTP/1.1) 65a4####.cdn.uc####.####.cn:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) p.yi####.com.####.com:80
TCP(HTTP/1.1) i####.g####.com.####.net:80
TCP(HTTP/1.1) tinyali####.c####.l####.####.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) s####.ml####.cc:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5227

Запросы DNS:

06img####.eas####.com
7j####.c####.z0.####.com
a####.u####.com
a.appj####.com
ads.ku####.cn
api.ku####.cn
c####.g####.ig####.com
c-h####.g####.com
client####.suishe####.cn
i####.com
i####.g####.com
i1.g####.com
im####.9l####.com
log.u####.com
marke####.et####.cn
mo####.b####.com
mobads-####.b####.com
p.yi####.com
pc.suishe####.net
pub-####.qin####.com
publish####.b####.com
r####.n####.127.net
s####.ml####.cc
s####.u####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.et####.cn
wlnovel####.weilin####.net

Запросы HTTP GET:

06img####.eas####.com.####.com/mobile/20190407/20190407144001_b634354afd...
65a4####.cdn.uc####.####.cn/apps/peacock/v90/suishen_exitpage.zip
api.ku####.cn.####.com/km_task/api/v1/articles/29?city_key=####&app_key=...
api.ku####.cn.####.com/km_task/api/v1/articles/55?city_key=####&app_key=...
api.ku####.cn.####.com/km_task/api/v1/articles/57?city_key=####&app_key=...
api.ku####.cn.####.com/km_task/api/v1/articles/59?city_key=####&app_key=...
api.ku####.cn.####.com/km_task/api/v1/articles/61?city_key=####&app_key=...
api.ku####.cn.####.com/km_task/api/v1/articles/65?city_key=####&app_key=...
api.ku####.cn.####.com/km_task/api/v1/articles/67?city_key=####&app_key=...
api.ku####.cn.####.com/km_task/api/v1/category/all?city_key=####&app_key...
api.ku####.cn.####.com/km_task/api/v1/search/keyword/box?city_key=####&a...
api.ku####.cn.####.com/km_task/api/v1/search/keyword/hot?city_key=####&a...
api.ku####.cn.####.com/km_task/api/v1/timeline/recommend?city_key=####&a...
api.ku####.cn.####.com/km_task/api/v1/user/setTags?city_key=####&app_key...
api.ku####.cn.####.com/km_task/api/v2/article/addition/5133833744?city_k...
i####.g####.com.####.net/newsapp_bt/0/8224011452/641
i####.g####.com.####.net/newsapp_bt/0/8224013717/641
i####.g####.com.####.net/newsapp_bt/0/8393073598/641
i####.g####.com.####.net/newsapp_bt/0/8441242936/641
i####.g####.com.####.net/newsapp_bt/0/8453070991/641
i####.g####.com.####.net/newsapp_bt/0/8453071616/641
i####.g####.com.####.net/newsapp_bt/0/8453072155/641
i####.g####.com.####.net/newsapp_bt/0/8460388291/641
i####.g####.com.####.net/newsapp_bt/0/8461058594/641
i####.g####.com.####.net/newsapp_bt/0/8461063579/641
i####.g####.com.####.net/newsapp_bt/0/8461072327/641
i####.g####.com.####.net/newsapp_bt/0/8463518490/641
i####.g####.com.####.net/newsapp_bt/0/8463520464/641
i####.g####.com.####.net/newsapp_bt/0/8463523195/641
i####.g####.com.####.net/newsapp_bt/0/8463818000/641
i####.g####.com.####.net/newsapp_bt/0/8463819070/641
i####.g####.com.####.net/newsapp_bt/0/8463819270/641
i####.g####.com.####.net/newsapp_bt/0/8463858724/641
i####.g####.com.####.net/newsapp_bt/0/8463859101/641
i####.g####.com.####.net/newsapp_bt/0/8463863413/641
i####.g####.com.####.net/newsapp_bt/0/8463867731/641
i####.g####.com.####.net/newsapp_bt/0/8463870285/641
i####.g####.com.####.net/newsapp_bt/0/8463887569/641
i1.g####.com.####.cn/corpimage.php?url=####&type=####&source=####
marke####.et####.cn/api/ckver?pkg=####&dev=####&epid=####
p.yi####.com.####.com/2019-04-07/bjh1554616917/a715739e58fa11e9958f000c2...
p.yi####.com.####.com/2019-04-07/bjh1554620239/62a26f8f590211e9bd55000c2...
p.yi####.com.####.com/2019-04-07/ttbs3a15546168185.png
pc.suishe####.net/peacock/api/adspool?&appid=####&publisher=####&dex=###...
pc.suishe####.net/peacock/api/gate?&pkg=####&appid=####&dex=####&channel...
publish####.b####.com.####.com/505cf37b-8587-4f59-bd4c-e1f89adaf287.png@...
r####.n####.127.net/icovr-20190407-00157c21d0c0bb165d90886d9f62e1c3.jpg
r####.n####.127.net/icovr-20190407-06a70e409a87f795734b8c65d4ebd381.jpg
r####.n####.127.net/icovr-20190407-12fa9f1dde4c7ea36146395514c70875.jpg
r####.n####.127.net/icovr-20190407-1be8922eb5086694943a05be0c710ca8.jpg
r####.n####.127.net/icovr-20190407-2be2ecfee8de5ae9a73cb2706bbb9d87.jpg
r####.n####.127.net/icovr-20190407-40c06edd0e45bdb33bc70a9a08a41a01.jpg
r####.n####.127.net/icovr-20190407-62a03fe1990a431cec1c809df92bbb96.jpg
r####.n####.127.net/icovr-20190407-bcbacc3c222c40110472c5b62f71c1b4.jpg
r####.n####.127.net/icovr-20190407-cc598debc4c42a06e7b8491eae249691.jpg
r####.n####.127.net/icovr-20190407-d209428b8dc8046a420a693d3e1a8411.jpg
r####.n####.127.net/icovr-20190407-efe4928c07f4e3da6de1479b2db7d468.jpg
r####.n####.127.net/icovr-20190407-fc0a416f83f31d1c0df23a8525881851.jpg
t####.c####.q####.####.com/km_task/api/v1/articles/63?city_key=####&app_...
t####.c####.q####.####.com/tdata_AXX896
t####.c####.q####.####.com/tdata_BAI450
t####.c####.q####.####.com/tdata_Fus136
ti####.c####.l####.####.com/config/hz-hzv3.conf
ti####.c####.l####.####.com/tdata_EDT369
tinyali####.c####.l####.####.com/image/201904/07/09b275a1da5fefb4fefc68f...
tinyali####.c####.l####.####.com/image/201904/07/2094636d9eb798a01919129...
tinyali####.c####.l####.####.com/image/201904/07/2a68b7afe9918a8af713e3a...
tinyali####.c####.l####.####.com/image/201904/07/4ef1af6d712a43a509321b0...
tinyali####.c####.l####.####.com/image/201904/07/64a22c2b0d0bdd4b9a632e2...
tinyali####.c####.l####.####.com/image/201904/07/a4a19eab0cd774c525ba136...
tinyali####.c####.l####.####.com/image/201904/07/bbe548a5c91a1e24fbac56c...
tinyali####.c####.l####.####.com/image/201904/07/bde27adf98b67f5cc03c641...
tinyali####.c####.l####.####.com/image/201904/07/f25377ac6eaccc4e91f6dcf...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/1307d8895536a2...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/2f05c105a0dca9...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/37275585f017cb...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/4a63bf3e5d73f4...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/743cdc6ed067ba...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/a19f623a0b1f47...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/bf4119942d2fec...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/c3e81c74ed8b4f...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/c8342032020fb1...
wlnovel####.b0.a####.com/2e7b036ee8c3a728cb8ccab243231c02/e3b5bc405b1a6f...

Запросы HTTP POST:

a####.u####.com/app_logs
a.appj####.com/ad-service/ad/mark
ads.ku####.cn/kuaima_ads/api/ad/get
c-h####.g####.com/api.php?format=####&t=####
client####.suishe####.cn/ssy-dmp/api/app/feedback?
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/1554633141984.log
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DownloadMarket.db-journal
/data/data/####/ECalendarPreferences.xml
/data/data/####/KM_preference.xml
/data/data/####/SuishenAd_prf.xml
/data/data/####/SuishenExitPageSDK_v72.apk
/data/data/####/SuishenExitPageSDK_v90.apk
/data/data/####/Update.db.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/b8a2fecc5472
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/mwsdk_analytics.db-journal
/data/data/####/persistent_data.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/suishen_ad.db-journal
/data/data/####/suishen_ad_pramas.xml
/data/data/####/tdata_AXX896
/data/data/####/tdata_AXX896.jar
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_Fus136
/data/data/####/tdata_Fus136.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/media/####/02eb8d2abfc863a76e3b8e7d2d142758_temp
/data/media/####/09a745210882b9f2492d56f98e80a16c_temp
/data/media/####/0a5f4147fab5b54eea2e225beda65b33_temp
/data/media/####/0ab8825cba934eb21f28968ef6703143_temp
/data/media/####/0be71a7f0935276da6a98d477dbb9e13_temp
/data/media/####/1433033d8d7926c92de3f0d1b08e5d7d_temp
/data/media/####/171f1c58fa79c03f8979040f46867891_temp
/data/media/####/1d980ba1f241bc721b5f7111f0142426_temp
/data/media/####/21b59257a094af54b9805038701824d3_temp
/data/media/####/229cba211262dfc0c953e2ba7ca29aad_temp
/data/media/####/2565154c488ecce91d6562f9cb7f87e6_temp
/data/media/####/2c7eb113a00101237e8a3616d8ba1473_temp
/data/media/####/345c94b426b577f9466653228b650ee7_temp
/data/media/####/3567f814210c67b6f548cc5c7ab1bd51_temp
/data/media/####/3b9cee9037772ca37f3cb133638e9d54_temp
/data/media/####/3d7ffd65e2ffe244e4aaf884ffe1568c_temp
/data/media/####/4216add01dbd88365dca87f8d5f44090_temp
/data/media/####/42aae0e30c7e02be678c07ebf4f3c1a9
/data/media/####/42d19aaa28e306782fbd75118276f725_temp
/data/media/####/4673c72ac379d16d571d73341ab2f87c_temp
/data/media/####/4bb9087d90d1bf7a0b0c9cdfd1ad0d84_temp
/data/media/####/4ec44e4b7238839a414ff8565433a611_temp
/data/media/####/50881f5957aa8322366d0a844b7d228a_temp
/data/media/####/53f8d612ce83596fba9d880b1419f894_temp
/data/media/####/551bf8f83a7a584b38bfdb4489b325bc_temp
/data/media/####/5d03a821700596ceac76b8142e24f192_temp
/data/media/####/5d9c074bc3c0792e4a133d6485a9d62d
/data/media/####/5efb6fc11871741bd8eba3f0f532d3c8_temp
/data/media/####/5ffed50de894c3471b03631116ac8f52_temp
/data/media/####/6188d2c3fe44757d553521983f07c5fe_temp
/data/media/####/62af0ea96375a89e5c248c2bfcf7f586_temp
/data/media/####/634dc9517bf04594f64873b6563db1c6_temp
/data/media/####/64079b231d9957bccf59cc9026433a8d_temp
/data/media/####/668fd62b4bbfc01d4f318cbec48c0856
/data/media/####/6bc797a8697c4b5f00d01e824804ede5_temp
/data/media/####/7037dbbc8a8fad24828a85882581e273_temp
/data/media/####/724d27fa02c96a1f4799ed5adbf28356_temp
/data/media/####/780930da9b4645073f38ed8b236e1d1b_temp
/data/media/####/7d596bddea19919c82e2bac3aa547aed_temp
/data/media/####/7d9c205da5c6d66bb42f1e7362f18dbc_temp
/data/media/####/859fb0d93dbe83e400545eb89769c108_temp
/data/media/####/8edf87be26e23db42b74e2aa68849010_temp
/data/media/####/948e2f564c1a3ba1bd9c035aaec0f59a_temp
/data/media/####/9d5af66906bd0bbb4a77e9a81ffb9395_temp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a2c4efcd107d8f8fccf57a29db6c3dcf_temp
/data/media/####/app.db
/data/media/####/b1b661b2150d63d3943fc2df4b076995_temp
/data/media/####/b324be51dc9a88746e6a1b63bcf2e8e4_temp
/data/media/####/b6ddba4003927fcd2ee9c1affb9162db_temp
/data/media/####/bbfebf7dfb9b497f00cfde28cb93df9a_temp
/data/media/####/bfbeeee57dd3956be9ef3f52c7a32a1b_temp
/data/media/####/blank.png
/data/media/####/btn_nav_bg.9.png
/data/media/####/btn_nav_sel.9.png
/data/media/####/c4eed8f761f91954072d23a0718b7ebe_temp
/data/media/####/c88ca270548d193c9519f524af873659
/data/media/####/c88d0ca53d6d5a19a6e914e3e81d027f_temp
/data/media/####/c8e6e38041f191920663be2222984a1c_temp
/data/media/####/c9053e897d5ee748b0798fe8bc8f96d4_temp
/data/media/####/cf3efa8c872d04d967cef51e17fa83a7
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.kuaima.browser.bin
/data/media/####/com.kuaima.browser.db
/data/media/####/d0faf429c2e87b1a5ffefcb87512d536_temp
/data/media/####/d2706f8a2e1c1717a747ff39f8b6157b_temp
/data/media/####/d5b95c75b6991e263234b2052f137f36_temp
/data/media/####/de15173514b4e1d2b1ace7bf859c4218_temp
/data/media/####/dialog_details_bg.9.png
/data/media/####/dialog_dismiss.png
/data/media/####/dialog_dismiss_sel.png
/data/media/####/download_btn_normal.9.png
/data/media/####/e23693915d6f58e300642f33dc20b0ac_temp
/data/media/####/e8a26f01e775216f26efc3c0f8bd8d66_temp
/data/media/####/e996de7ece3522e4364d921fd5e4cd22_temp
/data/media/####/ea155751327b4aa820020d368393a574_temp
/data/media/####/eb31a045c5e1dd8476bef193097f85fc
/data/media/####/ee05d9030b8e38d5948cd86b4f050f1f_temp
/data/media/####/f0877a8db13eec2c29d86b267887c353_temp
/data/media/####/f38cd81e7c08878445ebed55f2af9d69_temp
/data/media/####/f81b23f89ab273c226cc52b3623369ca_temp
/data/media/####/fa2a58ef4c89ec6c6f680c171c3a87ff_temp
/data/media/####/fes_type_sel.9.png
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/grid_bg.9.png
/data/media/####/grid_sel.9.png
/data/media/####/ic_btn_down.png
/data/media/####/ic_default.png
/data/media/####/info
/data/media/####/list_bg_sel.png
/data/media/####/mac_imei.txt
/data/media/####/suishen_exitpage.zip
/data/media/####/tdata_AXX896
/data/media/####/tdata_BAI450
/data/media/####/tdata_Fus136
/data/media/####/test.log
/data/media/####/top_btn_normal.9.png
/data/media/####/top_btn_selected.9.png
/data/media/####/update_btn_normal.9.png

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.module.push.DemoPushService 24815 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount

Загружает динамические библиотеки:

getuiext2
libjiagu

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
DESede
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней