Adware.Gexin.14483

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) h####.1####.com:80
TCP(HTTP/1.1) m####.3g.qq.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) apk.1####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(TLS/1.0) cdn.a####.com:443
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) lo####.qutou####.net:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) 1####.217.20.110:443
TCP sdk.o####.t####.####.com:5224
TCP zb-cent####.m.ta####.com:80
TCP c####.g####.ig####.com:5224
TCP zb-cent####.m.ta####.com:443
UDP 1####.168.106.1:137

Запросы DNS:

7j####.c####.z0.####.com
a####.man.aliy####.com
ag####.m.ta####.com
amap####.cn-hang####.oss####.####.com
amdc####.m.ta####.com
and####.b####.qq.com
and####.cli####.go####.com
api.1####.com
api.w####.com
apk.1####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.a####.com
ddd.1####.com
h####.1####.com
lo####.qutou####.net
m####.3g.qq.com
msg.umengc####.com
plb####.u####.com
qfy.innot####.com
recall-####.1####.com
res####.a####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.1####.com
umen####.m.ta####.com
umengj####.m.ta####.com
upd####.a####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&device...
api.1####.com/app/coldStart?lon=####&device_code=####&plugins=####&OSVer...
api.1####.com/app/getConfig?lon=####&device_code=####&OSVersion=####&dev...
api.1####.com/app/getResource?os=####&lon=####&device_code=####&OSVersio...
api.1####.com/app/start?model=####&lon=####&device_code=####&OSVersion=#...
api.1####.com/component/getFeComponentInfo?name=####&currtime=####&sign=...
api.1####.com/remain/getIncreaseRead?lon=####&device_code=####&OSVersion...
apk.1####.com/qukan_hotfix_3.9.23.000.0429.1436_001_419.zip
apk.1####.com/qukan_resource_emoji_265_610.apk
apk.1####.com/qukan_resource_level_897_295.apk
gl####.w.kunl####.####.com/image/sp/2019/05/08/5cd27456eff0a.jpg
h####.1####.com/search_middle/release/middle/static/release/middle.zip?l...
t####.c####.q####.####.com/config/hz-hzv6.conf
t####.c####.q####.####.com/tdata_Jga153
t####.c####.q####.####.com/tdata_WOW230
t####.c####.q####.####.com/tdata_bca864
t####.c####.q####.####.com/tdata_mSr887

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/member/isDeviceReport
api.1####.com/operate/resource/openScreen
c-h####.g####.com/api.php?format=####&t=####
ddd.1####.com/report
m####.3g.qq.com/
sdk-ope####.g####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.DS_Store
/data/data/####/._.DS_Store
/data/data/####/._choose_right.png
/data/data/####/._deposit.html
/data/data/####/._icon_tis.png
/data/data/####/._images
/data/data/####/._index.html
/data/data/####/._style
/data/data/####/._withdrawal_hand.png
/data/data/####/._wx_logo.png
/data/data/####/._zfb_logo.png
/data/data/####/.jg.ic
/data/data/####/0df678a7f3143bbd019b845ec9cebd2d
/data/data/####/1004
/data/data/####/1ce6c2831cf2a94a2d510c50bc9b686f348caf430e804a9....0.tmp
/data/data/####/2261cdaf8a69e00b2f0a2d910b6905b4
/data/data/####/71eb1e767599d1c0eac42ca224e395af.0.tmp
/data/data/####/71eb1e767599d1c0eac42ca224e395af.1.tmp (deleted)
/data/data/####/7e78d79200e8112826994e4d8aa4f911
/data/data/####/7e78d79200e8112826994e4d8aa4f911.tmp
/data/data/####/ACCS_BINDumeng;57578e4d67e58e4c810000d2.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MANIFEST.MF
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/T08XxdPRtQ46dX9y_bTXFkGAFpGQJ7Fa
/data/data/####/T0ZSMBu2uwWc8BX__pXsykCygKlggeYO
/data/data/####/T3UEHZuiYQjSp5dcdZOxh0P1KCC7rL9w
/data/data/####/T3V7-5aK2Ra6_MdhwYvo60TPRL5JEPdA
/data/data/####/T4lZFFuQ_WrjqfD7-ZXqf0kuFTSwCcW8
/data/data/####/T6EiqCYl1fIfYy9ZUZuRdEL90YQ37Tzb
/data/data/####/T6pQmuW8TNDmx01Nu5htzUTEOf50HJrL
/data/data/####/T7plfPPoD3wq2fCsEJy8a0SsccE6StsH
/data/data/####/T7r9Lv1GUbsJzfoAmagQKUpNabV5CyTk
/data/data/####/T9QjqoWDbyngab7SvLVzTUbbtKZYo21C
/data/data/####/TMSPropertiesb_d_pre.xml
/data/data/####/TMSPropertiesb_d_pre.xml.bak
/data/data/####/TMSPropertiesw_s_c.xml
/data/data/####/TwxDVceJlWpxPZ5A3bA-cEYiAPBkVpDF
/data/data/####/TybATIhj0tjlOe3vt7EJqEBY7s4kjI0E
/data/data/####/TzAi4yzhfvGlcEKwMIxJl0KKxvCp-noJ
/data/data/####/TztPsuj_erxkeM5K6bNRM0MILQHSn9gz
/data/data/####/Tzwm2rGo4KXf_nFLt55gSkJJRdvLlrlt
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/bg.png
/data/data/####/bt.png
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/choose_right.png
/data/data/####/classes.dex
/data/data/####/cmd_data_tracker_v2.db
/data/data/####/cmd_data_tracker_v2.db-journal
/data/data/####/cmd_data_tracker_v2.db_init
/data/data/####/cmd_data_tracker_v2.db_init-journal
/data/data/####/cmd_data_tracker_v2.db_pushservice
/data/data/####/cmd_data_tracker_v2.db_pushservice-journal
/data/data/####/com.jifen.qukan-journal
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan.xml.bak
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/cotent_fix_4034
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MjIyNDY5NTA1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MjIyNDgyNDcw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MjIyNDk0MTA3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MjIyNTAxNDk3;
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_tracker_v2.db
/data/data/####/data_tracker_v2.db-journal
/data/data/####/data_tracker_v2.db_init
/data/data/####/data_tracker_v2.db_init-journal
/data/data/####/data_tracker_v2.db_pushservice
/data/data/####/data_tracker_v2.db_pushservice-journal
/data/data/####/deposit.html
/data/data/####/dn_163
/data/data/####/emoji.apk
/data/data/####/emoji_md5
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&3.9.23.000.0429.1436_1559222469884_envelope.log
/data/data/####/icon_tis.png
/data/data/####/index.html
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/level.apk
/data/data/####/libjiagu-1385524905.so
/data/data/####/libquid.so
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pdm.db
/data/data/####/pdm.db-journal
/data/data/####/pointer.png
/data/data/####/pref.xml
/data/data/####/proc_monitor_local_rec_main.xml
/data/data/####/proc_monitor_local_rec_push.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_app_optsp.xml
/data/data/####/qk_crash_report_cache.xml
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/sensorsdata.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/statistic_all_new_log.db_pushservice
/data/data/####/statistic_all_new_log.db_pushservice-journal
/data/data/####/sys_log_1559222471754547.txt
/data/data/####/tdata_Jga153
/data/data/####/tdata_Jga153.jar
/data/data/####/tdata_WOW230
/data/data/####/tdata_WOW230.jar
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.jar
/data/data/####/tdata_mSr887
/data/data/####/tdata_mSr887.jar
/data/data/####/timer_ab.xml
/data/data/####/tmsdk_dualsim_shark.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/data/####/weibo_sdk_aid1
/data/data/####/wifi_signal_table-journal
/data/data/####/withdrawal_hand.png
/data/data/####/wx_logo.png
/data/data/####/zfb_logo.png
/data/media/####/.2e1b3.cuid
/data/media/####/.301d5.cuid
/data/media/####/._driver.dat
/data/media/####/.a274f.cuid2
/data/media/####/.c3418.cuid
/data/media/####/.com.jifen.ac.ReportCount
/data/media/####/.com.jifen.ac.cuid
/data/media/####/.com.jifen.ac.cuid2
/data/media/####/.nomedia
/data/media/####/.quid
/data/media/####/4c74fc7ca3264862bd0a87d5f32201c8
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/adc05be6aad246d59bd6dabdef11fff5
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/bedb41c5425848189540ba8cb4b97652
/data/media/####/cf_lk_2.dat
/data/media/####/cf_st_2.dat
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/crash-2019-05-30.log
/data/media/####/deviceToken
/data/media/####/e70a0bf5d0434795953b0e5a49e1562a
/data/media/####/tdata_Jga153
/data/media/####/tdata_WOW230
/data/media/####/tdata_bca864
/data/media/####/tdata_mSr887
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57578e4d67e58e4c810000d2","utdid":"XO/Yw50pX/kDAGdzx1GcGXqj","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/app_bin/daemon
chmod 700 <Package Folder>/files/gdaemon_20161017
date
df
getprop
getprop net.hostname
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.serialno
getprop ro.smartisan.version
getprop ro.vivo.os.version
id
logcat -d -v threadtime
ls -i
ls -l
ls /dev/socket
ls /sys/class/thermal
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd <SD-Card>/ && ls -i
sh -c echo NjZFODMyMjA3N0UxMjYzODlBRjlBMDQyQTMxRkYzQUU4OEMyRjM6RjBENEYxOkUxMUIyQg== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo NjZFODMyMjA3N0UxMjYzODlBRjlBMDQyQTMxRkYzQUU4OEMyRjM6RjBENEYxOkUxMUIyQg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo Njk5ODdDQ0I3Mzg4QTU0ODc0MEFGNkQxRTI3MjdEQzVGN0FBQTQ6NEEzMzZBOjMxQzBEMA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh <Package Folder>/files/T08XxdPRtQ46dX9y_bTXFkGAFpGQJ7Fa
sh <Package Folder>/files/T0ZSMBu2uwWc8BX__pXsykCygKlggeYO
sh <Package Folder>/files/T3UEHZuiYQjSp5dcdZOxh0P1KCC7rL9w
sh <Package Folder>/files/T3V7-5aK2Ra6_MdhwYvo60TPRL5JEPdA
sh <Package Folder>/files/T4lZFFuQ_WrjqfD7-ZXqf0kuFTSwCcW8
sh <Package Folder>/files/T6EiqCYl1fIfYy9ZUZuRdEL90YQ37Tzb
sh <Package Folder>/files/T6pQmuW8TNDmx01Nu5htzUTEOf50HJrL
sh <Package Folder>/files/T7plfPPoD3wq2fCsEJy8a0SsccE6StsH
sh <Package Folder>/files/T7r9Lv1GUbsJzfoAmagQKUpNabV5CyTk
sh <Package Folder>/files/T9QjqoWDbyngab7SvLVzTUbbtKZYo21C
sh <Package Folder>/files/TwxDVceJlWpxPZ5A3bA-cEYiAPBkVpDF
sh <Package Folder>/files/TybATIhj0tjlOe3vt7EJqEBY7s4kjI0E
sh <Package Folder>/files/TzAi4yzhfvGlcEKwMIxJl0KKxvCp-noJ
sh <Package Folder>/files/TztPsuj_erxkeM5K6bNRM0MILQHSn9gz
sh <Package Folder>/files/Tzwm2rGo4KXf_nFLt55gSkJJRdvLlrlt
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat random
uname -a

Загружает динамические библиотеки:

Bugly
InnoSo
NativeExample
du
getuiext3
libTmsdk-2.0.8-dual-mfr
libjiagu-1385524905
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней