Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) d####.dushem####.com:80
- TCP(HTTP/1.1) c.d####.mob.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) im####.dushem####.com.####.com:80
- TCP(HTTP/1.1) d####.d####.mob.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) rs.eas####.com:80
- TCP(HTTP/1.1) k####.eas####.com:80
- TCP(HTTP/1.1) cd####.dushem####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) s####.dushem####.com:80
- TCP(TLS/1.0) 2####.58.211.110:443
- TCP(TLS/1.0) l####.cc:443
- TCP(TLS/1.0) api.map.b####.com:443
- TCP c####.g####.ig####.com:5226
- TCP sdk.o####.t####.####.com:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.exc.mob.com
- api.map.b####.com
- api.s####.mob.com
- c####.g####.ig####.com
- c-h####.g####.com
- c.d####.mob.com
- cd####.dushem####.com
- d####.d####.mob.com
- d####.dushem####.com
- im####.dushem####.com
- k####.eas####.com
- l####.cc
- loc.map.b####.com
- m.d####.mob.com
- mt####.go####.com
- pub-####.qin####.com
- rs.eas####.com
- s####.dushem####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
Запросы HTTP GET:
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/ad/list_place_ads/1?sy...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/check_version/1...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/get_validate_ho...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/list_app_dictio...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/list_filter_wor...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/common/list_validate_t...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily-recmd/list-disco...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily_recmd/list_daily...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily_recmd/list_main_...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie/get_douban_analy...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie/get_movie_detail...
- cd####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie_sheet/get_newest...
- im####.dushem####.com.####.com/other/20170913/7c/686eba3801c040098295fe0...
- im####.dushem####.com.####.com/other/20171121/36/1caf8815decc4781b9674f8...
- im####.dushem####.com.####.com/other/20171206/8e/53e1ceb945204e898763050...
- im####.dushem####.com.####.com/other/20180121/70/fb449a4a738d416693f7314...
- im####.dushem####.com.####.com/other/20180124/55/33e4ccc4e5774cda993f74b...
- im####.dushem####.com.####.com/other/20180211/69/d20c1f57fdcd4b389154915...
- im####.dushem####.com.####.com/other/20180901/09/60eb3b5a26694e659992476...
- im####.dushem####.com.####.com/other/20180901/da/3f6b39c2ae964f9c8a6dc1b...
- im####.dushem####.com.####.com/other/20190114/1840/5c3c6719ccacf.jpg
- im####.dushem####.com.####.com/other/20190226/3e/a6a7712212f6461e8e22066...
- im####.dushem####.com.####.com/other/20190226/cc/c6793099115b48ccaa65b28...
- im####.dushem####.com.####.com/other/20190428/1210/5cc527c7f1b91.jpg
- im####.dushem####.com.####.com/other/20190505/1151/5cce5dcb234cb.jpg
- im####.dushem####.com.####.com/other/20190505/1153/5cce5e460fcb0.jpg
- im####.dushem####.com.####.com/other/20190510/1152/5cd4f596839b6.jpg
- im####.dushem####.com.####.com/other/20190513/1541/5cd91fa7b82ac.jpg
- im####.dushem####.com.####.com/other/20190527/76/79159adf844049b9810f2a3...
- im####.dushem####.com.####.com/other/20190527/85/0cb470a0f59c44649e409c1...
- im####.dushem####.com.####.com/other/20190527/c5/0dadf70e5fb049598aadca8...
- im####.dushem####.com.####.com/other/20190527/d7/5f6e25f968b548c6b09577d...
- im####.dushem####.com.####.com/other/20190529/1506/5cee2f7f5aab3.jpg
- im####.dushem####.com.####.com/portrait/20170328/26/c040536ead06471b8857...
- im####.dushem####.com.####.com/portrait/20170608/52/35ad10f5a7bd4d7e8c8d...
- im####.dushem####.com.####.com/portrait/20180730/47/2432a9d25965436995ee...
- im####.dushem####.com.####.com/portrait/20190110/39/063915e3fe4b4513bf38...
- im####.dushem####.com.####.com/portrait/20190214/59/e0f83e45b7c7405cabbe...
- im####.dushem####.com.####.com/portrait/20190528/36/2bb1ab98bde54634925d...
- im####.dushem####.com.####.com/video/thumbnail/20180722/8b/1f7a000200b74...
- k####.eas####.com/v1/visitors/tenants/41744
- m.d####.mob.com/cconf?appkey=####&plat=####&apppkg=####&appver=####&netw...
- qin####.com.www.####.com/tdata_EDT369
- rs.eas####.com/easemob/server.json?sdk_version=####&app_key=####&file_ve...
- t####.c####.q####.####.com/config/hz-hzv6.conf
- t####.c####.q####.####.com/tdata_Gfv491
- t####.c####.q####.####.com/tdata_MkX219
- t####.c####.q####.####.com/tdata_RTc910
- t####.c####.q####.####.com/tdata_TPC259
Запросы HTTP POST:
- a####.exc.mob.com/errconf
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- c-h####.g####.com/api.php?format=####&t=####
- c.d####.mob.com/cdata
- d####.d####.mob.com/dinfo
- d####.d####.mob.com/dsign
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/account/report_push_tok...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/activity/new_user_gift/1
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/cinecism/list_summary_m...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily-recmd/list-inform...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/daily_recmd/list_daily_...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/group/list_movie_relati...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie/list_movie_dynami...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie/list_recommend_mo...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/movie_sheet/list_custom...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/resource/batch_resource...
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user/list_grade/1
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user/sign_in/1
- d####.dushem####.com/dsmovieapi/e78d375e67fa436f/user_relation/get_unrea...
- loc.map.b####.com/sdk.php
- s####.dushem####.com/srapi/0c2641bbe60b6d2f/statistics/request_log/1
- s####.dushem####.com/srapi/0c2641bbe60b6d2f/statistics/stat_log/1
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/.lock
- /data/data/####/.mrecord
- /data/data/####/.mrlock
- /data/data/####/.statistics
- /data/data/####/31042830e25235618727ae947334d734f72aacc901fc200....0.tmp
- /data/data/####/33f0ca2012c33bb7d76b1a3ed0d097dcd67a4b2bbc7b2fe....0.tmp
- /data/data/####/37ea7b603a888d71d663ee3934a727fad59e9b75a26bef7....0.tmp
- /data/data/####/3aea76bc468c9d75ddb7f2faaf00ec520180813921bfe04....0.tmp
- /data/data/####/3f017dfc14048d1ed46dab64fca6a5f0e305989a0690c2a....0.tmp
- /data/data/####/4343656617ce160ebb7aaa1e575c83cbbb682d69c6ffe13....0.tmp
- /data/data/####/6236ef235374114dd859013ba62d5108c033308d8c18ce0....0.tmp
- /data/data/####/635b17650919a74f9230ffa2779070ed0c7bdf295d50aa1....0.tmp
- /data/data/####/69b593a203367b66ba3e170275ca39ba3d9969f148e449b....0.tmp
- /data/data/####/6f011b871c0a4300651958b22902b69c1a14d02781ee7e2....0.tmp
- /data/data/####/6f011b871c0a4300651958b22902b69c1a14d02781ee7e2...0f51.0
- /data/data/####/7093ceab5cb5c78baba5bcaf79a9359ff4b3a9c1f954f35....0.tmp
- /data/data/####/71c828e61a7bf394def92bfac34bba54b425fee85d1072c....0.tmp
- /data/data/####/8746ffb31694a2f344a0fd0e954ea52920b523c2b560837....0.tmp
- /data/data/####/8b2b39fc55da8ce8d13e3d63259def1086f7d3c3553a2c2....0.tmp
- /data/data/####/8bc4e0dbde66
- /data/data/####/8d658acda8b545fdbbfea05433fd001f8662926741087c6....0.tmp
- /data/data/####/920034aa94305680f6cae7d64119b973aaeed5e1ffe2fa2....0.tmp
- /data/data/####/LKME_Server_Request_Queue.xml
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/a3efa38cfce87bfdd9b9025fea6b06ab1aae33ab3f26f53....0.tmp
- /data/data/####/a4de4c48b3b1601af2af1a572c8154d8d07f99c872e1138....0.tmp
- /data/data/####/ae41221afba0400e970c08231ac07359ca57acea4679134....0.tmp
- /data/data/####/aeed35dd7a387cdc551ff98dde9552fc73dbeff5fec2e77....0.tmp
- /data/data/####/authStatus_com.dushe.movie;remote.xml
- /data/data/####/b2e18fc9546ee34b01ef9f840d00e668a2d0bf1528759c1....0.tmp
- /data/data/####/ba9333ee67f33507d3f627799d93e152cd66455e164a4d4....0.tmp
- /data/data/####/be848399fa40f5321b2d4d42409682b214c4cbfa895e95b....0.tmp
- /data/data/####/ca248f76770bff580b447eb328edfd7a269462bf1dd31b2....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/common_sp_0.xml
- /data/data/####/config.json
- /data/data/####/d7a6c533cf118a75f611e2f645473a5545e4fa6f6cf30fa....0.tmp
- /data/data/####/ddad201e333ae7b50d17c68087d95f73186499331e0c47a....0.tmp
- /data/data/####/device_id.xml.xml
- /data/data/####/e1bfced01138e0ffe215a9a3dca355cf628bb805ce449eb....0.tmp
- /data/data/####/ecc35fd9fe938ec4219d3fd874b7c5a605443916e0e98b9....0.tmp
- /data/data/####/f2e4e0f7a694a8085870b168bd09a3cea197ee30167ca31....0.tmp
- /data/data/####/fbc59601f6fb6fb80958fb9fb4a472a14aab26ab0459192....0.tmp
- /data/data/####/firll.dat
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/httpclient-req-376573568.cache
- /data/data/####/httpclient-req-376573568.cache (deleted)
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libjiagu1231164332.so
- /data/data/####/linkedme_referral_shared_pref.xml
- /data/data/####/mob_commons_1.xml
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/mobclick_agent_cached_com.dushe.movie47
- /data/data/####/movie0.db
- /data/data/####/movie0.db-journal
- /data/data/####/multidex.version.xml
- /data/data/####/public_sp.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/server.json
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/tdata_Gfv491
- /data/data/####/tdata_Gfv491.jar
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_RTc910
- /data/data/####/tdata_RTc910.jar
- /data/data/####/tdata_TPC259
- /data/data/####/tdata_TPC259.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/webview.db-journal
- /data/media/####/.al
- /data/media/####/.ccLock
- /data/media/####/.ccc
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.dh-journal
- /data/media/####/.dhlock
- /data/media/####/.dic_lock
- /data/media/####/.dk
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.lm_device_id
- /data/media/####/.nomedia
- /data/media/####/.nulal
- /data/media/####/.nulplt
- /data/media/####/.pkg_lock
- /data/media/####/.plst
- /data/media/####/.rc_lock
- /data/media/####/.usLock
- /data/media/####/app.db
- /data/media/####/com.dushe.movie.bin
- /data/media/####/com.dushe.movie.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/gktper (deleted)
- /data/media/####/share_img.png
- /data/media/####/tdata_Gfv491
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_RTc910
- /data/media/####/tdata_TPC259
- /data/media/####/test.0
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.dushe.push.getui.GTPushService 24492 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu1231164332.so
- grep -E -v root|shell|system
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.dushe.push.getui.GTPushService 24492 300 0
- top -d 0 -n 1
Загружает динамические библиотеки:
- genius_blur
- getuiext2
- hyphenate
- ijkffmpeg
- libjiagu1231164332
- locSDK7
- neh
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
