Adware.Gexin.17505

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) qfy.innot####.com:80
TCP(HTTP/1.1) cfg.a####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) h####.1####.com:80
TCP(HTTP/1.1) m####.3g.qq.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) qfc.innot####.com:80
TCP(HTTP/1.1) rcv.a####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) st####.1####.com.####.com:80
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) only-33####.ns####.net####.com:443
TCP(TLS/1.0) 1####.217.168.238:443
TCP(TLS/1.0) only-58####.ns####.net####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) cdn.a####.com.####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) static####.qutou####.net:443
TCP(TLS/1.0) ns####.net####.com:443
UDP 1####.168.109.1:137

Запросы DNS:

a####.man.aliy####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
api.shu####.cn
api.w####.com
apk.1####.com
cdn.a####.com
cfg.a####.com
ddd.1####.com
h####.1####.com
i####.1####.com
l####.tbs.qq.com
log.1####.com
m####.3g.qq.com
ns####.net####.com
only-33####.ns####.net####.com
only-57####.ns####.net####.com
only-58####.ns####.net####.com
only-65####.ns####.net####.com
qfc.innot####.com
qfy.innot####.com
rcv.a####.com
res####.a####.com
sdk-glo####.a####.com
st####.1####.com
static####.qutou####.net
upd####.a####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&tuid=#...
api.1####.com/app/bottomBar?model=####&lon=####&tuid=####&device_code=##...
api.1####.com/app/coldStart?lon=####&tuid=####&device_code=####&OSVersio...
api.1####.com/app/coldStart?lon=####&tuid=####&device_code=####&plugins=...
api.1####.com/app/getAdConfig?lon=####&tuid=####&device_code=####&OSVers...
api.1####.com/app/getCloudPluginV3?os=####&lon=####&tuid=####&device_cod...
api.1####.com/app/getConfig?lon=####&tuid=####&device_code=####&OSVersio...
api.1####.com/app/getGuide?lon=####&tuid=####&device_code=####&OSVersion...
api.1####.com/app/getResource?os=####&lon=####&tuid=####&device_code=###...
api.1####.com/app/start?model=####&tuid=####&OSVersion=####&from=####&tk...
api.1####.com/component/getFeComponentInfo?name=####&currtime=####&sign=...
api.1####.com/content/getDefaultChannelList?lon=####&tuid=####&device_co...
api.1####.com/remain/getIncreaseRead?lon=####&tuid=####&device_code=####...
cfg.a####.com/reqMotPkgLst
h####.1####.com/qukan_resource_emoji_244_302.apk
h####.1####.com/qukan_resource_level_897_295.apk
h####.1####.com/search_middle/release/middle/static/release/middle.zip?l...
i####.1####.com/module_detail/release/template/release/static/template.z...
i####.1####.com/module_detail/release/template/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip....
log.1####.com/a.gif?lon=####&tuid=####&device_code=####&OSVersion=####&d...
log.1####.com/a.gif?tuid=####&OSVersion=####&tk=####&network=####&versio...
rcv.a####.com/trace?op1=####&opt_app_name=####&op2=####&op3=####&opt_v=#...
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
st####.1####.com.####.com/image/sp/2019/08/29/5d67359da8435.png

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.1####.com/member/isDeviceReport
api.1####.com/operate/resource/openScreen
api.a####.com/v4/json
ddd.1####.com/report
l####.tbs.qq.com/ajax?c=####&k=####
m####.3g.qq.com/
qfc.innot####.com/report/v1
qfy.innot####.com/report/v1
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/0df678a7f3143bbd019b845ec9cebd2d
/data/data/####/1004
/data/data/####/263ddface8bb83c1144c66567eee4fb1.0.tmp
/data/data/####/4077e5503ef4b24525f37558ff2a91f7
/data/data/####/578B62A16DA3AC930921316D40FC750B.so
/data/data/####/58e04b1662b14eb2313283f298693bd9
/data/data/####/7e78d79200e8112826994e4d8aa4f911
/data/data/####/826323f8e625037fca9ee615af2eb214.ttf
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/SupportABImpl.xml
/data/data/####/T1kT1ajVkOChiU4SI6z6fkOrNcFxXXz_
/data/data/####/T3x0oSHIdfJKdzUc1okuZUCCkF7Yrbgc
/data/data/####/T9L-AjmqJwaxp3JQO7WbPkOUSEAgAaaQ
/data/data/####/TMSPropertiesb_d_pre.xml
/data/data/####/TMSPropertiesw_s_c.xml
/data/data/####/Txyk9dgYzHYg_ZpdL5OeNUXB5kpXyxgp
/data/data/####/TyQdveyxZJX3pNezlYQWFEbahGFvcX6q
/data/data/####/TyV2TjNRA-1-RfeNM6HuLkz8I6kk-2zT
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_loadremote_config.xml
/data/data/####/_s_base_switch.xml
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/b45dc1cadf3e6e43b20b503cd093086c
/data/data/####/bugly_db_-journal
/data/data/####/cmd_data_tracker_v2.db
/data/data/####/cmd_data_tracker_v2.db-journal
/data/data/####/cmd_data_tracker_v2.db_pushservice
/data/data/####/cmd_data_tracker_v2.db_pushservice-journal
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.jifen.qkbase.web.template.source.SourceManager.xml
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan.xml.bak
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/common.536c570e.js
/data/data/####/common.56725196.js
/data/data/####/common.9c88e62c.css
/data/data/####/common.aa0a2cf4.css
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_tracker_v2.db
/data/data/####/data_tracker_v2.db-journal
/data/data/####/data_tracker_v2.db_pushservice
/data/data/####/data_tracker_v2.db_pushservice-journal
/data/data/####/dn_163
/data/data/####/download.zip
/data/data/####/download_upload
/data/data/####/emoji.apk
/data/data/####/emoji.cfg
/data/data/####/emoji.md5
/data/data/####/finch.db-journal
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/level.apk
/data/data/####/level.md5
/data/data/####/libijkffmpeg.so
/data/data/####/libijkffmpeg.so.md5
/data/data/####/libijkplayer.so
/data/data/####/libijkplayer.so.md5
/data/data/####/libijksdl.so
/data/data/####/libijksdl.so.md5
/data/data/####/libjiagu-1385524905.so
/data/data/####/libquid.so
/data/data/####/libxyvodsdk.so
/data/data/####/libxyvodsdk.so.md5
/data/data/####/local_crash_lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/main_metadata
/data/data/####/main_metadata.bak
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pdm.db
/data/data/####/pdm.db-journal
/data/data/####/pref.xml
/data/data/####/proc_monitor_local_rec_main.xml
/data/data/####/proc_monitor_local_rec_push.xml
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_app_optsp.xml
/data/data/####/qk_push_sp.xml
/data/data/####/security_info
/data/data/####/so.zip
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/statistic_all_new_log.db_pushservice
/data/data/####/statistic_all_new_log.db_pushservice-journal
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/template.65ab0161.css
/data/data/####/template.95afbcd4.js
/data/data/####/template.a5fc0f7c.css
/data/data/####/template.af44e5ac.js
/data/data/####/template.html
/data/data/####/timer_ab.xml
/data/data/####/tmsdk_dualsim_shark.xml
/data/data/####/umeng_common_config.xml
/data/data/####/weibo_sdk_aid1
/data/data/####/wifi_signal_table-journal
/data/data/####/zipPre.bfde96c6.js
/data/media/####/.2e1b3.cuid
/data/media/####/.301d5.openidcom.jifen.qukan
/data/media/####/.3da57.openidcom.jifen.qukan
/data/media/####/.47dcb.acid
/data/media/####/.47dcb.cuid
/data/media/####/.801ab.openidcom.jifen.qukan
/data/media/####/.80662.cuid2
/data/media/####/.9bf72.cuid2
/data/media/####/.9bf72.ncuid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.aa5c5.acid
/data/media/####/.aa5c5.ncuid
/data/media/####/.b11dd.ncuid
/data/media/####/.c3418.cuid
/data/media/####/.com.jifen.ac.ReportCount
/data/media/####/.com.jifen.ac.acid
/data/media/####/.com.jifen.ac.cuid
/data/media/####/.com.jifen.ac.cuid2
/data/media/####/.com.jifen.ac.ncuid
/data/media/####/.com.jifen.op.openidcom.jifen.qukan
/data/media/####/.e84e3.cuid2
/data/media/####/.e8b74.acid
/data/media/####/.nomedia
/data/media/####/.quid
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a38579f9747b93a04b757e18de46a51c
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/cf_lk_2.dat
/data/media/####/cf_st_2.dat
/data/media/####/tbslog.txt

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/app_bin/daemon
date
df
getprop
getprop net.hostname
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.serialno
getprop ro.smartisan.version
getprop ro.vivo.os.version
getprop wifi.interface
ls -i
ls -l
ls /dev/socket
ls /system/fonts
mars_d -p <Package> -s <Package>.push.keepalive.service.MyService2 -p1r 53 -p1w 54 -p2r 55 -p2w 56
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd <SD-Card>/ && ls -i
sh -c echo MzQ2OTFCRTcxNUI5MzlDODA3RDU5Q0E1RjkyRTYwOUFCNDQwRkE6N0RGMEY4OkJFOTY1NQ== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo MzQ2OTFCRTcxNUI5MzlDODA3RDU5Q0E1RjkyRTYwOUFCNDQwRkE6N0RGMEY4OkJFOTY1NQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo OUE0MEVCODU1OTNBODREMTVEQjM0NTI0NDI2NjkwNDMzMzIxOTE6MDUzODA3OjhCOUQ5Rg== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo OUE0MEVCODU1OTNBODREMTVEQjM0NTI0NDI2NjkwNDMzMzIxOTE6MDUzODA3OjhCOUQ5Rg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh <Package Folder>/files/T1kT1ajVkOChiU4SI6z6fkOrNcFxXXz_
sh <Package Folder>/files/T3x0oSHIdfJKdzUc1okuZUCCkF7Yrbgc
sh <Package Folder>/files/T9L-AjmqJwaxp3JQO7WbPkOUSEAgAaaQ
sh <Package Folder>/files/Txyk9dgYzHYg_ZpdL5OeNUXB5kpXyxgp
sh <Package Folder>/files/TyQdveyxZJX3pNezlYQWFEbahGFvcX6q
sh <Package Folder>/files/TyV2TjNRA-1-RfeNM6HuLkz8I6kk-2zT
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat random
uname -a

Загружает динамические библиотеки:

Bugly
InnoSecure
InnoSo
NativeExample
daemon_api20
du
libTmsdk-2.0.8-dual-mfr
libijkffmpeg
libjiagu-1385524905

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней