Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) api.yuf####.com:80
- TCP(HTTP/1.1) yan####.n####.127.####.net:80
- TCP(HTTP/1.1) i####.j####.com:80
- TCP(HTTP/1.1) pic.yuf####.com:80
- TCP(HTTP/1.1) a.vp####.com.####.com:80
- TCP(HTTP/1.1) img.al####.com:80
- TCP(HTTP/1.1) img.bestof####.cn:80
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) yan####.n####.127.####.net:443
Запросы DNS:
- a####.u####.com
- a.vp####.com
- api.yuf####.com
- i####.360bu####.com
- img.al####.com
- img.bestof####.cn
- log.u####.com
- pic.yuf####.com
- s####.u####.com
- yan####.n####.127.net
- yanxuan####.n####.127.net
Запросы HTTP GET:
- a.vp####.com.####.com/upload/merchandise/pdcimg/2018/09/29/177/547719871...
- a.vp####.com.####.com/upload/merchandise/pdcimg/2018/09/30/159/189813221...
- a.vp####.com.####.com/upload/merchandise/pdcimg/2018/12/06/57/7905544154...
- a.vp####.com.####.com/upload/merchandise/pdcvis/2019/01/04/44/7d99d20a-7...
- a.vp####.com.####.com/upload/merchandise/pdcvis/2019/01/06/191/ebe12574-...
- a.vp####.com.####.com/upload/merchandise/pdcvis/612946/2018/1019/85/0690...
- i####.j####.com/n1/g12/M00/04/16/rBEQYVGNmDoIAAAAAAK_eBs53SQAAA6nAOmueUA...
- i####.j####.com/n1/jfs/t1/26517/10/8636/376116/5c77788dE516153d5/135b979...
- i####.j####.com/n1/jfs/t1/33786/12/808/203590/5ca18f13E866f5535/6f3228af...
- i####.j####.com/n1/jfs/t1/7351/34/13574/270473/5c4ac1e7Ef640c1a7/d80d2eb...
- i####.j####.com/n1/jfs/t2683/225/1550943003/169198/cfa53cd/574267cdN3730...
- i####.j####.com/n1/jfs/t29425/292/1016335317/280511/c54570dd/5c050b0aN6c...
- i####.j####.com/n1/jfs/t30751/103/1579714062/171377/5119373d/5ce4bd8bN2c...
- img.al####.com/imgextra/i2/1865856284/O1CN01roFX2v1wI7QKHaDL0_!!18658562...
- img.al####.com/imgextra/i3/1865856284/O1CN01c4DKsS1wI7QRYfGe7_!!18658562...
- img.al####.com/imgextra/i4/1865856284/O1CN010Sw8Cc1wI7QZQuHyc_!!18658562...
- img.al####.com/imgextra/i4/1865856284/O1CN0169oiWh1wI7QPzkoZI_!!18658562...
- img.al####.com/imgextra/i4/1865856284/O1CN01KmHc271wI7QAHoBpL_!!18658562...
- img.al####.com/imgextra/i4/1865856284/O1CN01LK07Hm1wI7Q4dVf6v_!!18658562...
- img.al####.com/imgextra/i4/1865856284/O1CN01M7EwJ41wI7QSQipzm_!!18658562...
- img.bestof####.cn/product/110/9495/7f3111bfcf4953199689ba2a03708ea6.jpg
- img.bestof####.cn/product/118/6029/fd6c56a51cdce8eed0136e9e50c11908.jpg
- img.bestof####.cn/product/124/17234/f85836f2b23bae84abe57d99df4e7500.jpg
- img.bestof####.cn/product/18/318/53761c90d09355e7cb34fde9ed7475d3.jpg
- img.bestof####.cn/product/220/28531/20170926130857_9400.jpg
- img.bestof####.cn/product/252/24814/aab827f59c17461d71a92691495eca8a.jpg
- img.bestof####.cn/product/56/20049/722add09f08d009697e11237ea6ef80b.jpg
- pic.yuf####.com/mall/uploads/ad/2017-11-23/5a166db357150.png
- pic.yuf####.com/mall/uploads/ad/2017-11-23/5a166ee0414f0.png
- pic.yuf####.com/mall/uploads/ad/2017-12-28/5a44455ec733d.png
- pic.yuf####.com/mall/uploads/ad/2018-06-06/5b17a6a0eba1a.png
- pic.yuf####.com/mall/uploads/ad/2018-06-06/5b17a6a78786c.png
- pic.yuf####.com/mall/uploads/ad/2018-06-06/5b17a6b75a2a2.png
- pic.yuf####.com/mall/uploads/ad/2018-06-06/5b17a6beb5b9a.png
- pic.yuf####.com/mall/uploads/ad/2018-07-17/5b4daa9b99e0b.png
- pic.yuf####.com/mall/uploads/ad/2018-07-18/5b4e97a26a6bb.png
- pic.yuf####.com/mall/uploads/ad/2018-10-31/5bd91fb71ed14.png
- pic.yuf####.com/mall/uploads/ad/2019-01-14/5c3bf30bce952.jpg
- pic.yuf####.com/mall/uploads/ad/2019-04-30/5cc7a85d614f1.png
- pic.yuf####.com/mall/uploads/ad/2019-07-22/5d35248f26b37.png
- pic.yuf####.com/mall/uploads/ad/2019-08-13/5d522b62177d2.jpg
- pic.yuf####.com/mall/uploads/merchant/2016-09-21/57e1f08c313c6.png
- pic.yuf####.com/mall/uploads/merchant/2017-10-30/59f6cbd17cf94.jpg
- pic.yuf####.com/mall/uploads/merchant/2019-07-23/5d36647f261da.jpg
- pic.yuf####.com/mall/uploads/merchantbanner/2017-11-23/5a166a74d83ae.png
- pic.yuf####.com/mall/uploads/merchantbanner/2017-11-23/5a166a9588061.png
- pic.yuf####.com/mall/uploads/merchantbanner/2019-07-22/5d356b8d4fb56.jpg
- pic.yuf####.com/mall/uploads/section/2017-11-23/5a1669607b759.png
- pic.yuf####.com/mall/uploads/section/2017-11-24/5a17b2e24f23a.png
- pic.yuf####.com/mall/uploads/section/2018-02-02/5a73d125c4a13.png
- pic.yuf####.com/mall/uploads/section/2019-01-03/5c2d7b29a4f28.png
- pic.yuf####.com/mall/uploads/section/2019-02-01/5c539b1d2afaa.png
- pic.yuf####.com/mall/uploads/section/2019-02-02/5c55097996303.png
- pic.yuf####.com/mall/uploads/section/2019-05-28/5cece07e009a6.png
- pic.yuf####.com/mall/uploads/section/2019-07-25/5d3906007759e.png
- pic.yuf####.com/mall/uploads/section/2019-07-25/5d39060ec85c3.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-08-25/57be9e5497876.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-08-25/57bea1a9dbe2b.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-08-25/57bea3e7d859d.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-08-25/57bea7b23203f.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-08-25/57bea8e4103b2.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-08-25/57bead7483fb7.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-08-26/57bfd4b0e1a5a.png
- pic.yuf####.com/merchant/uploads/goodsbig/2016-12-18/585630ac74179.jpg
- pic.yuf####.com/merchant/uploads/goodsbig/2017-01-04/586cbbab9c143.jpg
- pic.yuf####.com/merchant/uploads/goodsbig/2017-04-23/58fc3a87c38e0.jpg
- pic.yuf####.com/merchant/uploads/goodsbig/2017-06-16/5943bf751f6bd.jpg
- pic.yuf####.com/merchant/uploads/goodsbig/2018-01-15/5a5c6e4607a04_thumb...
- pic.yuf####.com/merchant/uploads/goodsbig/2018-12-04/5c06482a4e3e4_thumb...
- pic.yuf####.com/merchant/uploads/goodsbig/2018-12-06/5c08cc4db5c45_thumb...
- yan####.n####.127.####.net/4e6c1fa16c50d08969bccd7637ea46b2.png
- yan####.n####.127.####.net/65eb63536f0039f8ee5ae87a0310d778.png
- yan####.n####.127.####.net/ff61f9fe97d84b25ff89eac29376da83.png
Запросы HTTP POST:
- a####.u####.com/app_logs
- api.yuf####.com/mall/ad/getList
- api.yuf####.com/mall/category/index_show
- api.yuf####.com/mall/goods/by_type
- api.yuf####.com/mall/merchant/index_list
- api.yuf####.com/mall/merchant/list_bytype
- api.yuf####.com/mall/section/index_show
- api.yuf####.com/mall/version/getVersion
- api.yuf####.com/user/message/new
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1480503363-1842559360
- /data/data/####/-1480503363-473088763
- /data/data/####/-14805033631207073455
- /data/data/####/-1480503363496845126
- /data/data/####/-22869833
- /data/data/####/-415474899
- /data/data/####/-458830263
- /data/data/####/-663699784
- /data/data/####/-785240094
- /data/data/####/-797963734-1184356729
- /data/data/####/-797963734-2099901616
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/0651866363e02a35a398921679268c9bfc3e1f7fcffa18e....0.tmp
- /data/data/####/08dd940e1e339b638f1aa2ca32e10351079f6736d6dd679....0.tmp
- /data/data/####/0b1d5597766d5a605f19aed9e80dfaf3707a69236159722....0.tmp
- /data/data/####/1025243958
- /data/data/####/1032928068-1270733060
- /data/data/####/1105b6fa7f5c7775e2481a2e703eee0de2acac28c2310de....0.tmp
- /data/data/####/1251bd94d60f6a6c598f3a8ffac037389dce59710a777ba....0.tmp
- /data/data/####/1349036050-638143962
- /data/data/####/1488529b1169cbbe61067129b60fdfa77059dcc0a0af500....0.tmp
- /data/data/####/1538f48544908c1010ae4e98fa378f5809f714171ff1387....0.tmp
- /data/data/####/1566146134445.log
- /data/data/####/158167729b4bc1133670aef1cf8398785cdd62048913fb1....0.tmp
- /data/data/####/1797c5be8af5468a15783c3ee816568a1478b8bf3736e4b....0.tmp
- /data/data/####/1aada5ba2ce255aabea2bffa72dc54a933fa817573768d7....0.tmp
- /data/data/####/1f7361eb97bc655bf3592e2a44093d9a2e7d3096bf43b47....0.tmp
- /data/data/####/23e0b7a33803cdcecff1dc320d7238700bc33ee2ea43ae0....0.tmp
- /data/data/####/244596595
- /data/data/####/26aee2580a33b5e6fe9fb7a52c8b4bf2a17a4d0cc9a23d4....0.tmp
- /data/data/####/27b83ffe91778494227a8485670ab4bc10158c7c728e6de....0.tmp
- /data/data/####/29e8c1b69b9e3b653131b044bb51f1d850d3d8d4a4aff85....0.tmp
- /data/data/####/3052b358fdd585edf1997e960235a354caf4c6f502bcaaf....0.tmp
- /data/data/####/309f35a1cd34ab4b14533a88f1aef0b89d37a2d724eb380....0.tmp
- /data/data/####/38341741b88d4b70504703a01083b4a95df49e8b25a1738....0.tmp
- /data/data/####/3a2cae622fabc545531ae5170bdf04380d1429779efb022....0.tmp
- /data/data/####/3b006cd4d8f404b7aedcca2b7d9a7b50ccd946d1e8028b0....0.tmp
- /data/data/####/3c86b117527321a876164d1fe8c96360a10582c31789168....0.tmp
- /data/data/####/426853508
- /data/data/####/42815f2db154aaebe2c9ba526ef10345b91d3858bd21901....0.tmp
- /data/data/####/453a02f49e7b98760dec7db55126f63850b3149403967dd....0.tmp
- /data/data/####/4789d2573f8500dccb3b2f98e376b066c65be6a9e28ab63....0.tmp
- /data/data/####/490945149
- /data/data/####/49c2b5303f9581f80c34954aa973534f8f65053f7083100....0.tmp
- /data/data/####/4d02775899c3bd8aa30799bb2aa1de1e5660b5c300ab248....0.tmp
- /data/data/####/52e308c985b6926baddbf55bb3eb36e003e58559c111193....0.tmp
- /data/data/####/55c4067aed01f509a3569073976f1416897abbcdeb99a38....0.tmp
- /data/data/####/57d39b8ee7178c7d6223db69ac67bec13bd3be0355c1ba3....0.tmp
- /data/data/####/5d3e74afcf657f962ce8ca971be0eedc7c4fa226f0cfa23....0.tmp
- /data/data/####/5def27e8ecaa71634501adc645cecdd8d77a921548e2ff1....0.tmp
- /data/data/####/5f17bf7e7fc07936bec3a267da961d2018b6fe26279a604....0.tmp
- /data/data/####/66da2c5f7b453f47051426a6aa92adfbe14cadc5c15df50....0.tmp
- /data/data/####/6c4303236d8ebef48b82758d7374e62c55826e82340ec84....0.tmp
- /data/data/####/6d32100f455e2ccf4ab0fc2eb2d93fcf8b67461f413e8a0....0.tmp
- /data/data/####/70a9e96774a8093ce588a202c93916c8fd4915e9aba5f94....0.tmp
- /data/data/####/7106da78608859aff223488f7c5c6f0496f80212a236afa....0.tmp
- /data/data/####/722909333392f7ad91e1e4bb505be08aa6d4d292e9ea7b6....0.tmp
- /data/data/####/7444e9c08077d66811feebe8c17ee873b8b35f4303e44ac....0.tmp
- /data/data/####/74890d61a3b7f56e57323ef4af7e290c170f9dbe5207b69....0.tmp
- /data/data/####/77720f0c1e84ef570fb1cf6e989e09763e975d2318133c1....0.tmp
- /data/data/####/82abb8826b185813a20928d085943b1b4927842b1ed98f3....0.tmp
- /data/data/####/8618f4cf7feb761f69f36140ad72f3d6b7f50d30fed3e47....0.tmp
- /data/data/####/87e505f4b1486a63125c521089951cec3ac032fe5a2d6e8....0.tmp
- /data/data/####/91c451931bae617d875e491db721ad864cd5b9fc2fbcc5d....0.tmp
- /data/data/####/9291b95d423aae65a9771ce5d129ede363a6535b0c4976b....0.tmp
- /data/data/####/990ea02c77ca4c955009bdb64520b4031f60b3dc1bededc....0.tmp
- /data/data/####/994189911
- /data/data/####/9c207de0f66187fb78f39bf9db0131d9b0b6064e511b000....0.tmp
- /data/data/####/9ddef58a1e36854a9725031595656a65573c6d49076c652....0.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/a1f6d189d216ba111c91bc8538d35d7dcfea2bec1cbc4b3....0.tmp
- /data/data/####/a5f51faf28914550a89fd16adaf5b16bb9db80471ffc007....0.tmp
- /data/data/####/a73927d6b30e1d3e7614195cc619464180f44f7130da20d....0.tmp
- /data/data/####/ac1e1787a80741f0c2b41610cf33b40c3910d9f857174dc....0.tmp
- /data/data/####/b5de0107d54ae622174ad68e77ac892cc463a90b8458d9f....0.tmp
- /data/data/####/b86046bed4c8be0f436f0e3626cafafc25dda1ae1ca0da4....0.tmp
- /data/data/####/bfb19a0bb4505951216be10b9bbacb86d2002f9743b073a....0.tmp
- /data/data/####/c29e6914f41aa1dc73586e843363f6a620739c09147a800....0.tmp
- /data/data/####/c300ebec2b4e10280a10a12801d5b68bbd14f0723cf5f36....0.tmp
- /data/data/####/c6b4b7a939cf140d14c775bf1f225d5ce631ccb2a177ca4....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/d329af696f4dae9b7c816799391f46fbf7d2aaade0013c1....0.tmp
- /data/data/####/d33ba99bb5c22b0c083485749b82afab121f9c7e0313279....0.tmp
- /data/data/####/d6c0d6d0f2fbde2e6d7cefb9b83bbc9ce545e1576f9b2b1....0.tmp
- /data/data/####/d72b4897551389d49fd5b47c8209c18c594d1b419febb22....0.tmp
- /data/data/####/db8c79f8caad442b5a966cde087552655abd8a82bc49d66....0.tmp
- /data/data/####/dc07b7122e72994355826737811251b15eaebcf7895551d....0.tmp
- /data/data/####/e0d435f31a6fedfb77432e1b48535f2f8cb653e4d79874e....0.tmp
- /data/data/####/e0d7e9f6934d510a8fbfc27fe63192f47548e4b3b64b91c....0.tmp
- /data/data/####/e0e34d3ea8ecceda07896cb6064c43cc064dd3b1482f630....0.tmp
- /data/data/####/e20ea18f8a2ba479249394024d4dc973ac1d4204aa2ea94....0.tmp
- /data/data/####/ee96c6864b55dc9ce8e843d6a1e0e9a0fa05054c0ac9fb2....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f77e8b7658d8c54056c0cbd75ac85cb0e424da674de0635....0.tmp
- /data/data/####/fa8f7c639c0d0a6b133434db3612cb847e744f5e9c400ac....0.tmp
- /data/data/####/fe3b7b8f4452c44f98f93d708cab81afae450105de3b1f6....0.tmp
- /data/data/####/fe9e932c0bf5ba03e0de10c34c7b2bf6373a0233d450bdf....0.tmp
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
