Adware.Gexin.17122

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) a####.qq.com:80
TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) otherbd####.x2s####.t####.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) openmo####.qq.com:80
TCP(HTTP/1.1) appsup####.qq.com:80
TCP(HTTP/1.1) pub.idq####.com.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) c.isds####.qq.com:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(TLS/1.0) x####.tc.qq.com:443
TCP(TLS/1.0) a####.qq.com:443
TCP(TLS/1.0) cf####.3g.qq.com:443
TCP(TLS/1.0) o####.ssd.i####.####.com:443
TCP(TLS/1.0) otherbd####.x2s####.t####.####.com:443
TCP(TLS/1.0) yun.fac####.me:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5225

Запросы DNS:

7j####.c####.z0.####.com
a####.qq.com
appsup####.qq.com
c-h####.g####.com
c.isds####.qq.com
cf####.3g.qq.com
cgi.con####.qq.com
cm-1####.ig####.com
cms.g####.com
colle####.b####.com
log.u####.com
openmo####.qq.com
pi####.qq.com
pp.m####.com
pub-####.qin####.com
pub.idq####.com
q####.qq.com
qappce####.3g.qq.com
qzones####.g####.cn
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
yun.fac####.me

Запросы HTTP GET:

a####.qq.com/detail/com.tencent.mobileqq?autodownload=####&norecommend=#...
appsup####.qq.com/cgi-bin/appstage/mstats_report?report_type=####&platfo...
c.isds####.qq.com/code.cgi?domain=####&cgi=####&type=####&code=####&time...
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
et2-na6####.wagbr####.ali####.####.com/bar/get/55efac7d67e58e0cac000337/...
openmo####.qq.com/oauth2.0/m_authorize?status_userip=####&scope=####&red...
otherbd####.x2s####.t####.####.com/c/=/open/mobile/login/js/login_browse...
otherbd####.x2s####.t####.####.com/open/mobile/login/qzsjump.html?status...
otherbd####.x2s####.t####.####.com/open_proj/qqconnect/h5login/css/jump2...
otherbd####.x2s####.t####.####.com/open_proj/qqconnect/h5login/css/sprit...
pub.idq####.com.####.com/qconn/widget/mobile/login/images/loading.gif?ma...
q####.c####.l####.####.com/config/hz-hzv6.conf
ti####.c####.l####.####.com/tdata_mMz796
ti####.c####.l####.####.com/tdata_pUt878
ti####.c####.l####.####.com/tdata_qHR433

Запросы HTTP POST:

appsup####.qq.com/cgi-bin/appstage/mstats_batch_report
c-h####.g####.com/api.php?format=####&t=####
pi####.qq.com/mstat/report
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/BUGHD.xml
/data/data/####/blq_settings.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.tencent.open.config.json.1104813494
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/facehub_sdk_user.xml
/data/data/####/facehubcloudv1.db
/data/data/####/facehubcloudv1.db-journal
/data/data/####/gdaemon_20161017
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c.pid
/data/data/####/libjiagu.so
/data/data/####/libwbsafeedit_x86.so
/data/data/####/local_emoticon.xml
/data/data/####/me.ddkj.we_preferences.xml
/data/data/####/mobclick_agent_cached_me.ddkj.we36
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sdk_report.db
/data/data/####/sdk_report.db-journal
/data/data/####/secure_lib.xml
/data/data/####/tdata_mMz796
/data/data/####/tdata_mMz796.jar
/data/data/####/tdata_pUt878
/data/data/####/tdata_pUt878.jar
/data/data/####/tdata_qHR433
/data/data/####/tdata_qHR433.jar
/data/data/####/tencent_analysis.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_socialize.xml
/data/data/####/we-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/face_cloud_log.log
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/me.ddkj.we.db
/data/media/####/sign
/data/media/####/tdata_mMz796
/data/media/####/tdata_pUt878
/data/media/####/tdata_qHR433
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 23935 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/files/libjiagu.so
mount
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 23935 300 0

Загружает динамические библиотеки: