Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) vc.m####.com:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) imgal####.res.m####.com:80
- TCP(HTTP/1.1) x.da.m####.com:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) 0####.h####.com:80
- TCP(HTTP/1.1) trac####.ad-su####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) st.bz.m####.com:80
- TCP(HTTP/1.1) d####.t####.m####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) com####.m####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) hun####.m.cn.####.com:80
- TCP(HTTP/1.1) o####.ar####.api.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) log.rc.hun####.com:80
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) mob.bz.m####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) cou####.pe####.m####.com:80
- TCP(HTTP/1.1) o####.ac####.api.####.com:80
- TCP(HTTP/1.1) s5.hun####.com:80
- TCP(HTTP/1.1) y.da.hun####.com:80
- TCP(TLS/1.0) 1####.217.20.78:443
- TCP(TLS/1.0) qq.i####.com:443
- TCP(TLS/1.0) ys.da.m####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP 43.2####.145.67:5225
- TCP t####.nz4.ig####.com:5224
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- a####.u####.com
- ap####.v0.m####.com
- api####.a####.com
- c-h####.g####.com
- com####.m####.com
- cou####.pe####.m####.com
- d####.t####.m####.com
- g####.hun####.com
- hun####.m.cn.####.com
- imgal####.res.m####.com
- log.da.hun####.com
- log.rc.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.i####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- mob.bz.m####.com
- o####.ac####.api.####.com
- o####.ar####.api.####.com
- pl####.log.hun####.com
- pub-####.qin####.com
- rc.m####.com
- s5.hun####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st.bz.m####.com
- t####.nz4.g####.net
- t####.nz4.ge####.com
- t####.nz4.ig####.com
- trac####.ad-su####.com
- use####.api.max.####.com
- v2.log.hun####.com
- v2.res.log.####.com
- vc.m####.com
- www.qchann####.cn
- x.da.hun####.com
- x.da.m####.com
- y.da.hun####.com
- ys.da.m####.com
Запросы HTTP GET:
- 0####.h####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
- 0####.h####.com/preview/cms_icon/2019/5/17/05/20190517121526333.jpg_366x...
- 0####.h####.com/preview/cms_icon/2019/5/17/05/20190517215714311.jpg_750x...
- 0####.h####.com/preview/cms_icon/2019/5/23/05/20190523181131522.jpg_366x...
- 0####.h####.com/preview/sp_images/2018/yuanchuang/321558/4475492/2018072...
- 0####.h####.com/preview/sp_images/2019/5/21/dianshiju/116997/5661680/201...
- 0####.h####.com/preview/sp_images/2019/5/21/dianshiju/116997/5665207/201...
- ap####.v0.m####.com/buffer.php?td=####&net=####&istry=####&aver=####&tim...
- ap####.v0.m####.com/hb.php?ht=####&net=####&istry=####&aver=####&time=##...
- ap####.v0.m####.com/pv.php?nt=####&cpid=####&md=####&tst=####&gps=####&s...
- ap####.v0.m####.com/pv.php?nt=####&ftl=####&cpid=####&md=####&tst=####&g...
- com####.m####.com/video_comment/getcount?type=####&subject_id=####
- cou####.pe####.m####.com/message/poll?uid=####&osVersion=####&did=####&m...
- d####.t####.m####.com/vod.do?arange=####&fid=####&gsid=####&pm=####&svri...
- d####.t####.m####.com/vod.do?arange=####&fid=####&gsid=####&pm=####&ver=...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&svrip=####&ver=#...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&ver=####&chk=####
- g####.hun####.com/mobile/distribute.do?deviceid=####
- hun####.m.cn.####.com/x/k=2122264&p=7Oynx&dx=0&rt=2&ns=95.211.190.197&ni...
- imgal####.res.m####.com/mediafiles/wiad_creative/1008/15585812325442.png
- imgal####.res.m####.com/mediafiles/wiad_creative/1008/15585814243282.png
- imgal####.res.m####.com/mediafiles/wiad_creative/1194/1555079108371.jpg
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.da.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- log.rc.hun####.com/rpt?region=####&mod=####&did=####&ver=####&net=####&c...
- mob.bz.m####.com/odin/c1/channel/list?uid=####&osVersion=####&mac=####&o...
- o####.ac####.api.####.com/artist/getRecommendCollectArtist?uid=####&osVe...
- o####.ar####.api.####.com/artist/getArtistListByIds?artistIds=####&type=...
- o####.ar####.api.####.com/artist/getArtistListByIds?uid=####&type=####&t...
- pl####.log.hun####.com/ad.gif?os=####&app=####&d=####&error=####&cache=#...
- pl####.log.hun####.com/playerQuality.gif?first_frame_time=####&seeking_t...
- qin####.com.www.####.com/tdata_EDT369
- s5.hun####.com/channel/live?uid=####&osVersion=####&ticket=####&appVersi...
- s5.hun####.com/mobile/like?did=####&uid=####&vid=####&c=####
- s5.hun####.com/mobile/rank?c=####
- s5.hun####.com/mobile/rank?uid=####&osVersion=####&c=####&mac=####&osTyp...
- s5.hun####.com/mobile/uip?uid=####&osVersion=####&ticket=####&appVersion...
- s5.hun####.com/mobile/user?uid=####&c=####&mac=####
- s5.hun####.com/recommend?uid=####&platform=####&osVersion=####&mac=####&...
- s5.hun####.com/user/getActivity?uid=####&osVersion=####&ticket=####&appV...
- s5.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v1/config/play?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v5/listconfig?uid=####&platform=####&osVersion=####&mac=#...
- s5.hun####.com/v6/search/recommend?uid=####&osVersion=####&ticket=####&a...
- s5.hun####.com/v7/playlist/list?clipId=####&abroad=####
- s5.hun####.com/v7/video/getSource?uid=####&osVersion=####&mac=####&osTyp...
- s5.hun####.com/v8/video/info?uid=####&osVersion=####&mac=####&osType=###...
- s5.hun####.com/v8/video/list?uid=####&appVersion=####&ticket=####&fstlvl...
- s5.hun####.com/v8/video/relative?uid=####&appVersion=####&ticket=####&fs...
- st.bz.m####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
- t####.c####.q####.####.com/config/bj-bjv7.conf
- t####.c####.q####.####.com/config/hz-bjv8.conf
- t####.c####.q####.####.com/tdata_BAI450
- t####.c####.q####.####.com/tdata_IcB528
- t####.c####.q####.####.com/tdata_Uad612
- trac####.ad-su####.com/impression?1156;1;####
- use####.api.max.####.com/person5805f49c02406.jpg
- use####.api.max.####.com/person5ad6eea479eeb.png@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5b1b72e5b9d13.jpg@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5c80d8fe58bb5.jpg
- use####.api.max.####.com/person5c94cce995310.jpg
- use####.api.max.####.com/preview/aicrop/2019/05/21/3818483/crop_500x284_...
- use####.api.max.####.com/preview/channel_images/20190415173929991.jpg_36...
- use####.api.max.####.com/preview/channel_images/20190417181232074.jpg_73...
- use####.api.max.####.com/preview/channel_images/20190418165231247.jpg_36...
- use####.api.max.####.com/preview/channel_images/20190520125320605.jpg_73...
- use####.api.max.####.com/preview/cms_icon/2019/5/13/05/20190513184717029...
- use####.api.max.####.com/preview/cms_icon/2019/5/17/05/20190517112909481...
- use####.api.max.####.com/preview/cms_icon/2019/5/20/05/20190520162127211...
- use####.api.max.####.com/preview/cms_icon/2019/5/21/05/20190521163536027...
- use####.api.max.####.com/preview/cms_icon/2019/5/23/05/20190523111719680...
- use####.api.max.####.com/preview/cms_icon/2019/5/23/05/20190523151736367...
- use####.api.max.####.com/preview/cms_icon/2019/5/23/05/20190523180742358...
- use####.api.max.####.com/preview/cms_icon/2019/5/23/05/20190523195239293...
- use####.api.max.####.com/preview/cms_icon/2019/5/23/05/20190523215037150...
- use####.api.max.####.com/preview/cms_icon/2019/5/23/05/20190523233603242...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2019/5/22/dian...
- use####.api.max.####.com/preview/sp_images/2018/12/25/dianshiju/323323/4...
- use####.api.max.####.com/preview/sp_images/2019/5/17/yinle/130271/564238...
- use####.api.max.####.com/preview/sp_images/2019/5/17/zongyi/328724/56424...
- use####.api.max.####.com/preview/sp_images/2019/5/21/dianshiju/116997/56...
- use####.api.max.####.com/preview/sp_images/2019/5/22/dianshiju/116997/56...
- use####.api.max.####.com/preview/sp_images/2019/5/23/dianshiju/116997/56...
- use####.api.max.####.com/preview/sp_images/2019/5/23/dianshiju/329261/56...
- v2.log.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- v2.log.hun####.com/info.php?f=0&ex=&e=105000&b=1&c=1&mod=<System Propert...
- vc.m####.com/v2/dynamicinfo?uid=####&osVersion=####&mac=####&pid=####&os...
- y.da.hun####.com/err?_serverip=10.43.6.251&adid=9E863B6135EF99DE841FFEC0...
Запросы HTTP POST:
- a####.u####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- mo####.log.hun####.com/data.cgi
- mo####.log.hun####.com/dispatcher.do
- o####.ac####.api.####.com/global/config
- o####.ar####.api.####.com/artist/getArtistListByIds
- res####.a####.com/v3/log/init
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- vc.m####.com/v2/watch
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/m/page
- x.da.hun####.com/video/player
- x.da.m####.com/m/page
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-613447887
- /data/data/####/-684436472
- /data/data/####/.imprint
- /data/data/####/0ca786015a5bf3c46c7ec82511e8b512848fdccdc98239c....0.tmp
- /data/data/####/105843.png
- /data/data/####/116569.png
- /data/data/####/12aa79ae6c5d93b1e8659f4d3c548503
- /data/data/####/13b3adf55146af7df8cafbaeb5b7f6b423656580995b5fe....0.tmp
- /data/data/####/16cc43660839b8b9d46fcda954851c0bad4fad5f0fa11a0....0.tmp
- /data/data/####/1703720991
- /data/data/####/1b0ecba28427050efe9fb79a1849d5211a173a2b978a6ea....0.tmp
- /data/data/####/1c65b515a717d5daa794c5145b8270867377bd1fda9b510....0.tmp
- /data/data/####/1d2fceda9f928b29e6a23eb3f17e6c1f4f25239b5a7d14a....0.tmp
- /data/data/####/1ec0d8cf05afcc32823e82db8ee2eec583cb51e481c7241....0.tmp
- /data/data/####/257306020
- /data/data/####/257306028
- /data/data/####/29e707a35257fb9ffb7ce4d15e91607e4470729072bf0ec....0.tmp
- /data/data/####/2f0c88c7c95215f516be6705e8617f13d4e22c5d6a60b58....0.tmp
- /data/data/####/30abb4c968bc806edc609ab869c14ac6382caadb9e49b7d....0.tmp
- /data/data/####/30c2dee03f5d5bd1b2aaeabdda786e99a1403df22660502....0.tmp
- /data/data/####/3e304289cd3b71103d37ee2fb132cfb0037512e71267254....0.tmp
- /data/data/####/40e43721a2bf5bb5a057bb87785e578d
- /data/data/####/43471d34796dfedf8579938530103321
- /data/data/####/53156160bd60fe6e110e5a4be0f47f99c1ac5c0bcc630be....0.tmp
- /data/data/####/55b325a51f707bc27b22cb45a9e5d842c11ba788b5df26d....0.tmp
- /data/data/####/598c56a99938c808617c51a332e34b15c3f707a360a72d7....0.tmp
- /data/data/####/5ad61ae6c512
- /data/data/####/5e60e206d70f8674d1ecbf970cfa0499
- /data/data/####/614108960
- /data/data/####/6164488808ecdfe1bb669cf1488d6e4f
- /data/data/####/63c3527172624ae6bf616908b080ba27ce7ba4ca17d69ef....0.tmp
- /data/data/####/6550879cfdd8da6688a3c1e978310a3c
- /data/data/####/668b7927838904ea6c98ecf0790cd0b9906f533d48b6902....0.tmp
- /data/data/####/747bad5c148f60d0ddda1c31b6648c46d86419b02672d90....0.tmp
- /data/data/####/80bf1740301620e6590cf01f84bacd0efcbbd88bba886d4....0.tmp
- /data/data/####/82194835ce1d7d0b7a119b92c9123399da3210e73c76221....0.tmp
- /data/data/####/844d5f4c2bbdb2297f526d20d482d80a7ae4b653e06642b....0.tmp
- /data/data/####/8504eef121d29119395c06893e8e3e7c5ca37588d7a7647....0.tmp
- /data/data/####/8d63244d2394a28451cf2a519d847703699c2ce4b8b4b51....0.tmp
- /data/data/####/933978904
- /data/data/####/96c70a6f8202b7b0669c40789bd5b13769b8c180b6e343b....0.tmp
- /data/data/####/994cbdb39f81254db25e3d60dcdab976e96cd5a54be4e91....0.tmp
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MGTVCommon.xml.bak
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/a33492518015035d0cac32afe3a0a28c437e2cafe72d6e6....0.tmp
- /data/data/####/a3eaa215a6bf24cecd12f962f4bd8cf73cd392bba14c014....0.tmp
- /data/data/####/arch.xml
- /data/data/####/b1d13ddac40cbb20c4def22dab47da0c
- /data/data/####/b79577bf4923232db6eea78b25d59c1e7f6cad88789502e....0.tmp
- /data/data/####/c17ae46f94fda38d98e9a83d64ef9608f6dbef43a54f7f8....0.tmp
- /data/data/####/c36a23d8a8fb67eca6053008d2e3f04f5131eb26dbf873c....0.tmp
- /data/data/####/c5639247001b633f7c5318bf6e7b265a937cbca1a444517....0.tmp
- /data/data/####/c9ead0bc580508e4c94b9c1a6f41b446
- /data/data/####/cf66ce9f460872daf57659bedda3038d
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/d6e6a0dc9f4b8be6b9a2413e63c100278ed39e3f25c6885....0.tmp
- /data/data/####/e0d0a86624adb208cdfa9a21088585a5ff1b0174aefd8cd....0.tmp
- /data/data/####/e7708bb3a22c1fcfbfdc95ae733d07b6b0fb60d27b599b2....0.tmp
- /data/data/####/e7b5c74b248d2bb50688221386d599e6a0c3494e6bd775c....0.tmp
- /data/data/####/ebcd2fbd03bfde5e58341ecce12661e989bb2c3ebda3942....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/f58329f80208bf302a540069d0b5a5e017e76db1741f39a....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/hmt_agent_commonutill_com.aishi.movie.muGua.xml
- /data/data/####/hmt_agent_commonutill_device_id.xml
- /data/data/####/hmt_agent_online_setting_com.aishi.movie.muGua.xml
- /data/data/####/hmt_analytics
- /data/data/####/hmt_analytics-journal
- /data/data/####/hmt_init_savetime.xml
- /data/data/####/hmt_irsuid.xml
- /data/data/####/hmt_session_id.xml
- /data/data/####/hmt_session_id_savetime.xml
- /data/data/####/hmt_session_id_savetime.xml.bak
- /data/data/####/hmt_session_id_savetime.xml.bak (deleted)
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu-149832798.so
- /data/data/####/multidex.version.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/playinfo.db
- /data/data/####/playinfo.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/root.db-journal
- /data/data/####/run.pid
- /data/data/####/tdata_BAI450
- /data/data/####/tdata_BAI450.jar
- /data/data/####/tdata_IcB528
- /data/data/####/tdata_IcB528.jar
- /data/data/####/tdata_Uad612
- /data/data/####/tdata_Uad612.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
- /data/media/####/129af6670cf214532956f21fc3b10710
- /data/media/####/1_log.txt
- /data/media/####/3f14f0f16515a615ce366fbc4dc73141
- /data/media/####/4777547b42fd7fb3972ded9c1f9408c4
- /data/media/####/855a832fd4dd6c54cd39f8f43d74fa80
- /data/media/####/89d4c62979070c49949e4fc76f9f9f19
- /data/media/####/937409892e939f7c7db18dd3f8351491
- /data/media/####/AN.csv-20190523203214
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1558643536841
- /data/media/####/UA.csv-20190523203217
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/apge.csv-20190523203232
- /data/media/####/apge.csv-20190523203240
- /data/media/####/apge.csv-20190523203242
- /data/media/####/apge.csv-20190523203250
- /data/media/####/app.db
- /data/media/####/com.aishi.movie.muGua.bin
- /data/media/####/com.aishi.movie.muGua.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/fb1a963e5be50add2de39e9e6deff920
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/journal.tmp
- /data/media/####/qt.csv.1558643534793.txt
- /data/media/####/tdata_BAI450
- /data/media/####/tdata_IcB528
- /data/media/####/tdata_Uad612
- /data/media/####/test.log
- /data/media/####/uuid
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25038 300 0
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- mount
- sh
Загружает динамические библиотеки:
- CdnAuth
- ImgoFfmpeg
- ImgoHelp
- ImgoMediaPlayer_V3.0.3
- getuiext2
- libjiagu-149832798
Использует следующие алгоритмы для шифрования данных:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
