Adware.Gexin.17495

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) 2####.107.1.2:80
TCP(HTTP/1.1) 1####.232.158.227:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) s####.ipp####.com:80
TCP(HTTP/1.1) 2####.107.1.1:80
TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
TCP(HTTP/1.1) diagn####.ipp####.com:80
TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
TCP(HTTP/1.1) 1####.232.158.231:80
TCP(HTTP/1.1) 1####.232.158.233:80
TCP(HTTP/1.1) f####.izu####.com:80
TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
TCP(TLS/1.0) is.sn####.com.####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) api.ipp####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) 1####.15.81.196:443
TCP(TLS/1.0) f####.izu####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) 47.2####.48.227:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443

Запросы DNS:

196.81.15.####.arpa
225.48.246.####.arpa
227.48.246.####.arpa
228.213.178.####.arpa
a####.man.aliy####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
and####.b####.qq.com
and####.cli####.go####.com
api.ipp####.com
beacon####.aliy####.com
diagn####.ipp####.com
f####.ipp####.com
f####.izu####.com
is.sn####.com
log.sn####.com
norma-e####.m####.com
s####.ipp####.com
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
u####.u####.com

Запросы HTTP GET:

f####.izu####.com/account/avatar/id/290283190/sz/228
f####.izu####.com/img/frame/id/727628757?w=####&delogo=####
f####.izu####.com/img/mosaic-legacy/2c999000ba4142d279cf8~noop.jpg
f####.izu####.com/img/web.business.image/201908265d0d3547f0f902864ae8871...
norma-e####.m####.com/android/exchange/getpublickey.do
sf1-ttc####.ps####.com/img/mosaic-legacy/26aee0005724dc7dc4c95~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/27eaf00058dc22ba41515~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2988a0007790a811748ac~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2c00b000a2443c775b8ad~noop.jpg
sf1-ttc####.ps####.com/img/mosaic-legacy/2c0d700086f3a7156a0c7~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2c123000af324acd94db3~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2c9b4000b51c277a8e85e~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2c9f80009b3058c75cdd1~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2ca660004e5939b46d9cf~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cab1000565de6249bf1f~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cad4000667b0a93b808a~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cb3b000b53a63e7152e7~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cb6800067690a61f20d8~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cc16000789abdc9747f8~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cc870004457716f03ab5~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cccc000af20b7f9ac54a~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd04000516297de13eea~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd1000074f2e7bb4835e~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd2300039f57ceb45628~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd460000c35eff249db2~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd4e0000debd3c57a357~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd5b00010294d2771a56~cs_690x38...
sf1-ttc####.ps####.com/img/mosaic-legacy/e42100083c38f7b90edc~cs_690x388...
sf1-ttc####.ps####.com/img/web.business.image/201907025d0d1876d1fffd4a4b...
sf1-ttc####.ps####.com/img/web.business.image/201907055d0d294e2ee2f68f48...
sf1-ttc####.ps####.com/img/web.business.image/201907085d0d85a7ef9944d14c...
sf1-ttc####.ps####.com/img/web.business.image/201907225d0d25f1e3719c3543...
sf1-ttc####.ps####.com/img/web.business.image/201908205d0d4dad43599bdf4d...
sf1-ttc####.ps####.com/img/web.business.image/201908215d0d3a24a58f141146...
sf3-ttc####.ps####.com/img/mosaic-legacy/2caf50002cb00922f2e56~noop.jpg
sf6-ttc####.ps####.com.####.com/img/mosaic-legacy/22c9100070d7d315dd129~...
sf6-ttc####.ps####.com.####.com/img/mosaic-legacy/2ca6b000324c89dfa0581~...
sf6-ttc####.ps####.com.####.com/img/mosaic-legacy/2cd17000629c4af24f456~...
sf6-ttc####.ps####.com.####.com/img/web.business.image/201907165d0d9a8f2...

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
beacon####.aliy####.com/beacon/fetch/config/byappkey
diagn####.ipp####.com/diagnosis/cdn/api?sign=####
diagn####.ipp####.com/diagnosis/cdn/image?sign=####
diagn####.ipp####.com/stat/action?sign=####
diagn####.ipp####.com/stat/report_user_info?sign=####
f####.izu####.com/service/2/app_log_exception/?openudid=####&version_nam...
norma-e####.m####.com/push/android/external/add.do
s####.ipp####.com/stat/action?sign=####
s####.ipp####.com/stat/report_user_info?sign=####
sf3-ttc####.ps####.com/service/2/app_log_exception/?openudid=####&versio...

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1002
/data/data/####/1004
/data/data/####/1567023017451
/data/data/####/1567023017955
/data/data/####/1567023018059
/data/data/####/1567023018137
/data/data/####/1567023020324
/data/data/####/1567023036135
/data/data/####/1567023053697
/data/data/####/1k68vristuid3tdetpcgqy2rr
/data/data/####/1k68vristuid3tdetpcgqy2rr.tmp
/data/data/####/1puq9wzrcojboxtwirbor5lnv
/data/data/####/1puq9wzrcojboxtwirbor5lnv.tmp
/data/data/####/23x7kxd28p61u0pkhxy0d2o4k
/data/data/####/23x7kxd28p61u0pkhxy0d2o4k.tmp
/data/data/####/2eh0ahdvrqteiwlngwwnohyc4
/data/data/####/2eh0ahdvrqteiwlngwwnohyc4.tmp
/data/data/####/2i90tyii3lgj8ebgnbkdoorr6
/data/data/####/2i90tyii3lgj8ebgnbkdoorr6.tmp
/data/data/####/2lvkmav90ijbtfhf0gqkbx8uw
/data/data/####/2lvkmav90ijbtfhf0gqkbx8uw.tmp
/data/data/####/2rab51ckj8mkvpcdu1c94h4bf
/data/data/####/2rab51ckj8mkvpcdu1c94h4bf.tmp
/data/data/####/2vgtcs39zu0ii76oa5nlyvfmd
/data/data/####/2vgtcs39zu0ii76oa5nlyvfmd.tmp
/data/data/####/31jbldg778lc7toefwogmvf27
/data/data/####/31jbldg778lc7toefwogmvf27.tmp
/data/data/####/31wmr9fz0hsjm1or4yh9aut62
/data/data/####/31wmr9fz0hsjm1or4yh9aut62.tmp
/data/data/####/31wmr9fz0hsjm1or4yh9aut62.tmp (deleted)
/data/data/####/3n7788c7m881y4k79pljyxvej
/data/data/####/3n7788c7m881y4k79pljyxvej.tmp
/data/data/####/498kgafjtajkjdgwypcbxgg1x
/data/data/####/498kgafjtajkjdgwypcbxgg1x.tmp
/data/data/####/4bgqhe4m6xzod0xqmao57x68l
/data/data/####/4bgqhe4m6xzod0xqmao57x68l.tmp
/data/data/####/4s67f492ewv1jesc3sk2fnm2w
/data/data/####/4s67f492ewv1jesc3sk2fnm2w.tmp
/data/data/####/53t5pfj4y9es4q74crldt3wx5
/data/data/####/53t5pfj4y9es4q74crldt3wx5.tmp
/data/data/####/5joi4twt894attkhbbpjlsawv
/data/data/####/5joi4twt894attkhbbpjlsawv.tmp
/data/data/####/5rdo9e43hrqlw2nnfsj6tzpz9
/data/data/####/5rdo9e43hrqlw2nnfsj6tzpz9.tmp
/data/data/####/67k0eq91xuue5p743tt7w7y91
/data/data/####/67k0eq91xuue5p743tt7w7y91.tmp
/data/data/####/67k0eq91xuue5p743tt7w7y91.tmp (deleted)
/data/data/####/69irzl4ppycvu63kn1rf2gy8f
/data/data/####/69irzl4ppycvu63kn1rf2gy8f.tmp
/data/data/####/6cvaniltfvh831zxp2u46085z
/data/data/####/6cvaniltfvh831zxp2u46085z.tmp
/data/data/####/6ej90jffx4rpnnfbxivyfyg1n
/data/data/####/6ej90jffx4rpnnfbxivyfyg1n.tmp
/data/data/####/6fsp561hktr9f7bfv5zplrldq
/data/data/####/6fsp561hktr9f7bfv5zplrldq.tmp
/data/data/####/6mr26h0olpv30u124jtcmvvoj
/data/data/####/6mr26h0olpv30u124jtcmvvoj.tmp
/data/data/####/6nwq6a2q135lnyxdt7jpsj9jh
/data/data/####/6nwq6a2q135lnyxdt7jpsj9jh.tmp
/data/data/####/73n1fvmdh7ef750t9klb79eq5
/data/data/####/73n1fvmdh7ef750t9klb79eq5.tmp
/data/data/####/74k3fq7z2ggroajr414zktifj
/data/data/####/74k3fq7z2ggroajr414zktifj.tmp
/data/data/####/7bgk1oekm7aoedi7yduxd30v1
/data/data/####/7bgk1oekm7aoedi7yduxd30v1.tmp
/data/data/####/7hzg4eywzpyqeuwzerz98v3t4
/data/data/####/7hzg4eywzpyqeuwzerz98v3t4.tmp
/data/data/####/7k25405cojycwxewsbobro1wz
/data/data/####/7k25405cojycwxewsbobro1wz.tmp
/data/data/####/7raq3ms2oxr4pe55f3lk06tq
/data/data/####/7raq3ms2oxr4pe55f3lk06tq.tmp
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Did.xml
/data/data/####/MultiDex.lock
/data/data/####/UTCommon.xml
/data/data/####/UUDid.xml
/data/data/####/a==7.5.3&&1.6.8_1567023002223_envelope.log
/data/data/####/ad_cfg.xml
/data/data/####/ap.Lock
/data/data/####/app_crash_copy.xml
/data/data/####/app_duration.xml
/data/data/####/bugly_db_-journal
/data/data/####/cn.xiaochuankeji.zuiyouLite.BETA_VALUES.xml
/data/data/####/cn.xiaochuankeji.zuiyouLite_preferences.xml
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.2.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/common.xml
/data/data/####/crashrecord.xml
/data/data/####/downloader.db-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f5h76vwfec3djn4sxv05iqi8
/data/data/####/f5h76vwfec3djn4sxv05iqi8.tmp
/data/data/####/httpdns_config_cache.xml
/data/data/####/k6px2q1hyt4iygepi4gxq6rw
/data/data/####/k6px2q1hyt4iygepi4gxq6rw.tmp
/data/data/####/libjiagu-1061397881.so
/data/data/####/local_crash_lock
/data/data/####/lv5eszcsyjxo2dv9fgybljqb
/data/data/####/lv5eszcsyjxo2dv9fgybljqb.tmp
/data/data/####/me56rznn1o9zi2e4kuasbqi5
/data/data/####/me56rznn1o9zi2e4kuasbqi5.tmp
/data/data/####/message.db
/data/data/####/multidex.version.xml
/data/data/####/mz_push_preference.xml
/data/data/####/native_record_lock
/data/data/####/pipi-lite.mmap2
/data/data/####/push_permission.xml
/data/data/####/recommend_all
/data/data/####/s86ivkd2ga09f84c6rda9dmd
/data/data/####/s86ivkd2ga09f84c6rda9dmd.tmp
/data/data/####/security_info
/data/data/####/smartdns.dat
/data/data/####/splash_config.json
/data/data/####/t0jw7nbe5ng6ek63jemltqqm
/data/data/####/t0jw7nbe5ng6ek63jemltqqm.tmp
/data/data/####/topic_banner_v2.dat
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/zuiyou.db
/data/media/####/-gA7TOPJSdtcmtN_ZDUeXTlcaFw.1456732378.tmp
/data/media/####/.nomedia
/data/media/####/2019-08-28.log.txt
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/Z9zj-SnslxijThMCJetEw1C9yyI.-1538542959.tmp
/data/media/####/ZxAYU45zlGmuAS-FRYSY_5iLSd8.1456732378.tmp
/data/media/####/cbYXdE5NfhU5GEBjlhAP5nKITyg.-1538542959.tmp
/data/media/####/iLNJX4t4yzWkPRUmh4zsKdguRaE.104871376.tmp
/data/media/####/pclj4A_AN4ZWsx1xV6s-0NBrgGY.756074561.tmp
/data/media/####/pipi-lite_20190828.xlog
/data/media/####/pipi.conf
/data/media/####/tXjsOfTledIg9GA5iQnZ0X_i1Vs.1920805015.tmp
/data/media/####/zuiyou.conf

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop
getprop
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.letv.release.version
getprop ro.miui.ui.version.code
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
logcat -d -v threadtime

Загружает динамические библиотеки:

Bugly
X86Bridge
imagepipeline
libimagepipeline
libjiagu-1061397881
libnative-filters
marsxlog
net_crypto
pl_droidsonroids_gif
stlport_shared
ut_c_api
wcdb

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней