Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) d####.dushem####.com:80
- TCP(HTTP/1.1) c.d####.mob.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) im####.dushem####.com.####.com:80
- TCP(HTTP/1.1) d####.d####.mob.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) d####.opensp####.cn:80
- TCP(HTTP/1.1) rs.eas####.com:80
- TCP(HTTP/1.1) k####.eas####.com:80
- TCP(HTTP/1.1) cd####.dushem####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) h####.opensp####.cn:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) s####.dushem####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) 3####.97.9.53:80
- TCP(TLS/1.0) l####.cc:443
- TCP(TLS/1.0) 1####.217.168.206:443
- TCP(TLS/1.0) api.map.b####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.exc.mob.com
- api.map.b####.com
- api.s####.mob.com
- arti####.dushem####.com
- c####.g####.ig####.com
- c-h####.g####.com
- c.d####.mob.com
- cd####.dushem####.com
- d####.d####.mob.com
- d####.dushem####.com
- d####.opensp####.cn
- h####.opensp####.cn
- im####.dushem####.com
- k####.eas####.com
- l####.cc
- loc.map.b####.com
- m.d####.mob.com
- pub-####.qin####.com
- rs.eas####.com
- s####.dushem####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
Запросы HTTP GET:
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/ad/list_place_ads/1?sy...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/article/get_article_de...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/check_version/1...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/get_validate_ho...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/list_app_dictio...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/list_filter_wor...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/list_validate_t...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/component/get_recommen...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily_recmd/list_daily...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/light_info/list_light_...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie/get_douban_analy...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie_sheet/get_newest...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily_recmd/list_discov...
- h####.opensp####.cn/launchconfig?t=####&p=b3ZpZ####
- im####.dushem####.com.####.com/other/20160902/05/c7338471d1924ec19f43f06...
- im####.dushem####.com.####.com/other/20160902/0e/3070d12c806c4364af47be1...
- im####.dushem####.com.####.com/other/20160902/61/dfbc52ef96b24e1386f40d6...
- im####.dushem####.com.####.com/other/20160902/73/99c98e2afc7e49cbbd3c461...
- im####.dushem####.com.####.com/other/20160902/9e/1fd0d6d65bbb4281a41ccda...
- im####.dushem####.com.####.com/other/20160902/ca/70b2a5efacc14db5a3fbd74...
- im####.dushem####.com.####.com/other/20160902/cc/77be7b1765f849a59a8559c...
- im####.dushem####.com.####.com/other/20160902/ce/5c38ce3c04af46499db6583...
- im####.dushem####.com.####.com/other/20160902/df/e9e278ee5a9041928a2a462...
- im####.dushem####.com.####.com/other/20170425/6e/b281d59319cc41b88b0017b...
- im####.dushem####.com.####.com/other/20170911/cf/f4d2785aafb244b8ae11905...
- im####.dushem####.com.####.com/other/20171118/70/619577158a764a158a4f0b8...
- im####.dushem####.com.####.com/other/20171121/9d/8cb42f3f902d4d46a1e0f66...
- im####.dushem####.com.####.com/other/20190114/1805/5c3c5ed73b8b1.jpg
- im####.dushem####.com.####.com/other/20190403/1028/5ca41a3287c8d.jpg
- im####.dushem####.com.####.com/other/20190408/1208/5caac93e13712.jpg
- im####.dushem####.com.####.com/other/20190408/1211/5caac9e4f296f.jpg
- im####.dushem####.com.####.com/other/20190510/1152/5cd4f596839b6.jpg
- im####.dushem####.com.####.com/other/20190513/1426/5cd90e2c4f6a7.jpg
- im####.dushem####.com.####.com/other/20190513/1921/5cd9531c79d97.jpg
- im####.dushem####.com.####.com/other/20190513/2002/5cd95ced6c45a.jpg
- im####.dushem####.com.####.com/other/20190514/1241/5cda46df9c854.jpg
- im####.dushem####.com.####.com/other/20190514/1315/5cda4f0b9a079.jpg
- im####.dushem####.com.####.com/other/20190514/1316/5cda4f2383b9e.jpg
- im####.dushem####.com.####.com/portrait/20170305/17/e532a498d9e54ba79d5b...
- im####.dushem####.com.####.com/portrait/20170320/b2/6866f0d9c9cc463ab1c3...
- im####.dushem####.com.####.com/portrait/20170503/92/290a7b1645094451a5b7...
- im####.dushem####.com.####.com/portrait/ip/dusir.jpg
- k####.eas####.com/v1/visitors/tenants/41744
- m.d####.mob.com/cconf?appkey=####&plat=####&apppkg=####&appver=####&netw...
- qin####.com.www.####.com/tdata_EDT369
- rs.eas####.com/easemob/server.json?sdk_version=####&app_key=####&file_ve...
- t####.c####.q####.####.com/config/hz-hzv6.conf
- t####.c####.q####.####.com/tdata_Gfv491
- t####.c####.q####.####.com/tdata_MkX219
- t####.c####.q####.####.com/tdata_ZvO248
- t####.c####.q####.####.com/tdata_zzW503
Запросы HTTP POST:
- a####.exc.mob.com/errconf
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- c-h####.g####.com/api.php?format=####&t=####
- c.d####.mob.com/cdata
- d####.d####.mob.com/dinfo
- d####.d####.mob.com/dsign
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/account/report_push_tok...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/activity/new_user_gift/1
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/article/list_article_co...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/category/list_category/1
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily_recmd/list_daily_...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily_recmd/list_relate...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/group/list_my_follow_gr...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie_sheet/list_custom...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/recmd_category/list_rec...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/resource/batch_resource...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/resource_charts/list_re...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/theme/list_theme_recmd_...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user/get_user_detail_in...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user/list_grade/1
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user/sign_in/1
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user_relation/get_unrea...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user_relation/list_foll...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user_relation/list_reco...
- d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
- loc.map.b####.com/sdk.php
- s####.dushem####.com/srapi/0c2641bbe60b6d2f/statistics/stat_log/1
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/.lock
- /data/data/####/.mrecord
- /data/data/####/.mrecord (deleted)
- /data/data/####/.mrlock
- /data/data/####/.statistics
- /data/data/####/0653ecda6eef7a4ed3eb39cb5c1ebf5e12fe9d46d9aab73....0.tmp
- /data/data/####/0b58efd257b8b388c8c9af9736e7eab9b9bc6bebc12efb7....0.tmp
- /data/data/####/0f56ecb45eeb2b64da42ccfd9a05af7aaad9ec730344bc2....0.tmp
- /data/data/####/1a6f8fee1ffc88756a43aff0b8665321fa99a2cac78def2....0.tmp
- /data/data/####/1ea8be7b4d53c5a52d593e86a052acc1f77986570be2089....0.tmp
- /data/data/####/2aa5848acfb0ce829cfafeb733da45a78d26ff3de278cda....0.tmp
- /data/data/####/3d99b4e23260a15afe8f4f8cab63c815960c35759739e05....0.tmp
- /data/data/####/4acfe348b08a88223b2257be7bcc063ead1fc74e4968ab0....0.tmp
- /data/data/####/4b21f22884d82bfdd4c20d7324162b0bbb5c30a16b1e6af....0.tmp
- /data/data/####/58bd7512e545964dec376da172649bbd0f9e837c992ae5c....0.tmp
- /data/data/####/766ede40e31e6788ab0d033c6c81c90ad2a7664a9fb64b9....0.tmp
- /data/data/####/8261e4d1426351299e5fd95201265f5e734374660234f2d....0.tmp
- /data/data/####/8348cbbef4acddf8458cb8f44ab7e480bf5984bde217436....0.tmp
- /data/data/####/883442c989635407887200f803aa456fbf50a7fccd9f1b4....0.tmp
- /data/data/####/8bc4e0dbde66
- /data/data/####/8c8b932064217a09c4da8a1c262d5cd3631e8ea5c6e4153....0.tmp
- /data/data/####/8eee16c1187adfceeb74462b4df38d33a4a61c3d375d765....0.tmp
- /data/data/####/9e2e5b243474c7455e47633dd07f85fcc18c99a60d34a14....0.tmp
- /data/data/####/9ef8f4ad25c06cf4234393dafca508fca0d9161c410294c....0.tmp
- /data/data/####/LKME_Server_Request_Queue.xml
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/a322708d6aa76ab1a3be7f908f11d61a1748db1a707f5f4....0.tmp
- /data/data/####/a67732b787f5ff58224e2b6b8034bcd3a790ce746cf897e....0.tmp
- /data/data/####/a970a98fabf022e5209dfa710b093962b4d3bcba2a2419b....0.tmp
- /data/data/####/authStatus_com.dushe.movie;remote.xml
- /data/data/####/babbee32bed6602e3ac55dd755f86a7f0b46478c8311a68....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.dushe.movie_preferences.xml
- /data/data/####/com.iflytek.id.xml
- /data/data/####/com.iflytek.msc.xml
- /data/data/####/common_sp_0.xml
- /data/data/####/config.json
- /data/data/####/d509ff7aa913b51aa0183aed5298afb417a551ad9a7e9f3....0.tmp
- /data/data/####/d53e667fc77b2b6cbc6b032a5ecb5c1aaa71b1a8f2dcc74....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/device_id.xml.xml
- /data/data/####/e6e37ca2d14ae9696291f57371e3dead0ea5f40a54af2bf....0.tmp
- /data/data/####/f26eca6461196227c90b0a6540833444a537577fad2fabd....0.tmp
- /data/data/####/fc68523b76a0caedbfce60a909ed3ab208ede0b00913fac....0.tmp
- /data/data/####/ff7f4cf4957bb325a48e7ee89aceeab0926a2d8696e7e1e....0.tmp
- /data/data/####/firll.dat
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/httpclient-req-217880012.cache
- /data/data/####/httpclient-req-217880012.cache (deleted)
- /data/data/####/ifly_launch_lib.xml
- /data/data/####/iflytek_state_com.dushe.movie.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libjiagu.so
- /data/data/####/linkedme_referral_shared_pref.xml
- /data/data/####/mob_commons_1.xml
- /data/data/####/mobclick_agent_cached_com.dushe.movie37
- /data/data/####/movie0.db
- /data/data/####/movie0.db-journal
- /data/data/####/multidex.version.xml
- /data/data/####/public_sp.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/server.json
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/tdata_Gfv491
- /data/data/####/tdata_Gfv491.jar
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_ZvO248
- /data/data/####/tdata_ZvO248.jar
- /data/data/####/tdata_zzW503
- /data/data/####/tdata_zzW503.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.al
- /data/media/####/.ccLock
- /data/media/####/.ccc
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.dh-journal
- /data/media/####/.dhlock
- /data/media/####/.dic_lock
- /data/media/####/.dk
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.lm_device_id
- /data/media/####/.nomedia
- /data/media/####/.nulal
- /data/media/####/.nulplt
- /data/media/####/.pkg_lock
- /data/media/####/.plst
- /data/media/####/.rc_lock
- /data/media/####/.usLock
- /data/media/####/app.db
- /data/media/####/com.dushe.movie.bin
- /data/media/####/com.dushe.movie.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/iflyworkdir_test
- /data/media/####/share_img.png
- /data/media/####/tdata_Gfv491
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_ZvO248
- /data/media/####/tdata_zzW503
- /data/media/####/test.0
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.dushe.push.getui.GTPushService 24492 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- grep -E -v root|shell|system
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.dushe.push.getui.GTPushService 24492 300 0
- top -d 0 -n 1
Загружает динамические библиотеки:
- getuiext2
- hyphenate
- ijkffmpeg
- libjiagu
- locSDK7
- msc
- neh
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
