Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.3.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ser####.dc####.net.cn:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) v####.rainbo####.com:80
- TCP(HTTP/1.1) vs.rainbo####.com:80
- TCP(HTTP/1.1) m####.to####.cn:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) v.rainbo####.com:80
- TCP(TLS/1.0) ser####.dc####.net.cn:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) js.cdn.al####.####.cn:443
- TCP c####.g####.ig####.com:5224
- TCP sdk.o####.t####.####.com:5224
Запросы DNS:
- c####.g####.ig####.com
- c-h####.g####.com
- hm.b####.com
- js.cdn.al####.####.cn
- m####.to####.cn
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- ser####.dc####.net.cn
- st####.dc####.net.cn
- v####.rainbo####.com
- v.rainbo####.com
- vs.rainbo####.com
Запросы HTTP GET:
- m####.to####.cn/
- m####.to####.cn/catalog/view/javascript/bootstrap/fonts/glyphicons-halfl...
- m####.to####.cn/catalog/view/javascript/bootstrap/js/bootstrap.min.js
- m####.to####.cn/catalog/view/javascript/common.js
- m####.to####.cn/catalog/view/javascript/flexible.js
- m####.to####.cn/catalog/view/javascript/font-awesome/css/font-awesome.mi...
- m####.to####.cn/catalog/view/javascript/font-awesome/fonts/fontawesome-w...
- m####.to####.cn/catalog/view/javascript/jquery-cookie.js
- m####.to####.cn/catalog/view/javascript/jquery/datetimepicker/bootstrap-...
- m####.to####.cn/catalog/view/javascript/jquery/datetimepicker/moment/mom...
- m####.to####.cn/catalog/view/javascript/jquery/jquery-2.1.1.min.js
- m####.to####.cn/catalog/view/javascript/jquery/swiper/css/swiper.min.css
- m####.to####.cn/catalog/view/javascript/jquery/swiper/js/swiper.min.js
- m####.to####.cn/catalog/view/javascript/layer/layer.js
- m####.to####.cn/catalog/view/javascript/layer/theme/default/layer.css?v=...
- m####.to####.cn/catalog/view/theme/default/image/ad/superBag.jpg
- m####.to####.cn/catalog/view/theme/default/image/band-1.jpg
- m####.to####.cn/catalog/view/theme/default/image/band-2.jpg
- m####.to####.cn/catalog/view/theme/default/image/band-3.jpg
- m####.to####.cn/catalog/view/theme/default/image/band-4.jpg
- m####.to####.cn/catalog/view/theme/default/image/class-icon.png?1####
- m####.to####.cn/catalog/view/theme/default/image/cuxiao.jpg
- m####.to####.cn/catalog/view/theme/default/image/index-band.png
- m####.to####.cn/catalog/view/theme/default/image/index-icon.png?1####
- m####.to####.cn/catalog/view/theme/default/image/index-member.png
- m####.to####.cn/catalog/view/theme/default/image/index-more.png
- m####.to####.cn/catalog/view/theme/default/image/index-order.png
- m####.to####.cn/catalog/view/theme/default/image/index-shop.png
- m####.to####.cn/catalog/view/theme/default/image/index-t1.jpg?1####
- m####.to####.cn/catalog/view/theme/default/image/info-icon.png?1####
- m####.to####.cn/catalog/view/theme/default/image/jc-logo.jpg
- m####.to####.cn/catalog/view/theme/default/image/jingxuan-1.jpg
- m####.to####.cn/catalog/view/theme/default/image/login-btn.png
- m####.to####.cn/catalog/view/theme/default/image/more-icon.png
- m####.to####.cn/catalog/view/theme/default/image/search-icon.png
- m####.to####.cn/catalog/view/theme/default/image/user-icon.png?1####
- m####.to####.cn/catalog/view/theme/default/image/zhuanti-1.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuanti-2.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuanti-3.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuanti-4.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuanti-5.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuanti-6.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuanti-7.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuti-1.jpg
- m####.to####.cn/catalog/view/theme/default/image/zhuti-2.jpg
- m####.to####.cn/catalog/view/theme/default/stylesheet/stylesheet.css
- m####.to####.cn/catalog/view/theme/default/stylesheet/swiper.min.css
- m####.to####.cn/catalog/view/theme/default/stylesheet/swiper.min.js
- m####.to####.cn/image/cache/catalog/Banner/未标题-11-1140x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/坐便器/5a4c7cec9bcd6-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/坐便器/5a4ddd49a6485-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/坐便器/5a5025f90542f-300x300.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水槽/乐厨 062_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水槽/乐厨 069_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/JJH3056D_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/奥拉 1822/xq_1-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/奥斯卡 1826/奥斯卡 1826_主图-300x300....
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/普拉提 3044_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/萨提雅 3043_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/阳光 1888/阳光 1888_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/阳光 1889/阳光 1889_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/阳光 1890/阳光 1890_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/水龙头/雅格仕 3053_产品大图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/浴室柜/PVC/7500-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/浴室柜/PVC/7501-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/浴室柜/PVC/7504-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/浴室柜/爱丽舍 30882/爱丽舍30882_主图-300x300...
- m####.to####.cn/image/cache/catalog/卫浴/浴室柜/雅尚 250882/雅尚250882_主图-500x500...
- m####.to####.cn/image/cache/catalog/卫浴/浴室柜/雅筑 70882/雅筑70882_主图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/浴缸/奥拉浴缸_产品大图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/浴缸/奥斯卡浴缸_产品大图-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/淋浴房/爱丽舍1号_产品大图-300x300.jpg
- m####.to####.cn/image/cache/catalog/卫浴/花洒/奥拉 2161/奥拉 2161_主图-300x300.jpg
- m####.to####.cn/image/cache/catalog/卫浴/陶瓷盆/5a52dba7b9d39-300x300.jpg
- m####.to####.cn/image/cache/catalog/卫浴/陶瓷盆/5a52dba7b9d39-500x500.jpg
- m####.to####.cn/image/cache/catalog/卫浴/陶瓷盆/5a52de5da2444-500x500.jpg
- m####.to####.cn/image/cache/catalog/摆件/5703076515_1413632152-500x500.jpg
- m####.to####.cn/image/cache/catalog/瓷砖/东鹏/BG603011商品特价封面500x500-500x500....
- m####.to####.cn/image/cache/catalog/瓷砖/东鹏/DG801011商品特价封面500x500-500x500....
- m####.to####.cn/image/cache/catalog/瓷砖/东鹏/DG801023商品特价封面500x500-500x500....
- m####.to####.cn/image/cache/catalog/瓷砖/东鹏/DG801026商品特价封面500x500-500x500....
- m####.to####.cn/image/cache/catalog/瓷砖/仿古砖/600x600mm/中哑/9A189商品封面500x500...
- m####.to####.cn/image/cache/catalog/瓷砖/仿古砖/600x600mm/中哑/9A190E商品封面500x50...
- m####.to####.cn/image/cache/catalog/瓷砖/俊贤地砖/V2301XT大板商品封面500x500-500x500...
- m####.to####.cn/image/cache/catalog/瓷砖/俊贤地砖/V2302XT大板商品封面500x500-500x500...
- m####.to####.cn/image/cache/catalog/瓷砖/俊贤地砖/V2801XT大板商品封面500x500-500x500...
- m####.to####.cn/image/cache/catalog/瓷砖/俊贤地砖/V2802XT大板商品封面500x500-500x500...
- m####.to####.cn/image/cache/catalog/瓷砖/小地砖/BM3005-300x300.jpg
- m####.to####.cn/image/cache/catalog/瓷砖/欧神诺/瓷砖商品封面500x500(1)(1)-300x300.jpg
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACQ321080商品封面500x500-300x300.jpg
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACQ322080商品封面500x500-300x300.jpg
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACQ332080商品封面500x500-500x500.jpg
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACQ336060商品封面500x500-500x500.jpg
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACS800189P大板商品封面500x500-300x30...
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACT030080L商品封面500x500-500x500....
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACT031080L商品封面500x500-500x500....
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACT032080L商品封面500x500-500x500....
- m####.to####.cn/image/cache/catalog/瓷砖/箭牌/ACT052080L商品封面500x500-500x500....
- m####.to####.cn/image/catalog/jc-logo.jpg
- m####.to####.cn/index.php?isWebView=####&time=####
- m####.to####.cn/index.php?route=####
- qin####.com.www.####.com/tdata_EDT356
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- v####.rainbo####.com/group1/M00/A1/50/wKhCBFyCGmyALF0BAAAljkXYPyw504.png
- v.rainbo####.com/ysc?companyId=####&t=####
- vs.rainbo####.com/visitor/echat.js
- vs.rainbo####.com/visitor/surfer/bridge.html?companyId=####&visitorId=##...
- vs.rainbo####.com/visitor/surfer/css/surfer_a009242.css
Запросы HTTP POST:
- c-h####.g####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- ser####.dc####.net.cn/device/location
- v####.rainbo####.com/mychat/visitor/
- v####.rainbo####.com/mychat/visitor/connect
- v####.rainbo####.com/mychat/visitor/handshake
- v.rainbo####.com/mychat/visitor/
- v.rainbo####.com/mychat/visitor/connect
- v.rainbo####.com/mychat/visitor/handshake
Запросы HTTP OPTIONS:
- v.rainbo####.com/mychat/visitor/
- v.rainbo####.com/mychat/visitor/connect
- v.rainbo####.com/mychat/visitor/handshake
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imei.txt
- /data/data/####/.jg.ic
- /data/data/####/MultiDex.lock
- /data/data/####/__UNI__2F1FD3A.xml
- /data/data/####/__UNI__2F1FD3A_storages.xml
- /data/data/####/_adio.dcloud.feature.ad.a.a.xml
- /data/data/####/clientid_igexin.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/eje3cnc
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/f_00003b
- /data/data/####/f_00003c
- /data/data/####/f_00003d
- /data/data/####/f_00003e
- /data/data/####/f_00003f
- /data/data/####/f_000040
- /data/data/####/f_000041
- /data/data/####/f_000042
- /data/data/####/f_000043
- /data/data/####/f_000044
- /data/data/####/f_000045
- /data/data/####/f_000046
- /data/data/####/f_000047
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/html5Geo.xml
- /data/data/####/http_mall.tosame.cn_0.localstorage-journal
- /data/data/####/http_mall.tosame.cn_0.localstorage-journal (deleted)
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/libjiagu1339025162.so
- /data/data/####/multidex.version.xml
- /data/data/####/pdr.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/stream_permission.xml
- /data/data/####/test_app
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/.imei.txt
- /data/media/####/app.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.jiancaimao.work.bin
- /data/media/####/com.jiancaimao.work.db
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24898 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24898 300 0
Загружает динамические библиотеки:
- getuiext2
- libjiagu1339025162
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
