Adware.Gexin.17638

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) qfy.innot####.com:80
TCP(HTTP/1.1) cfg.a####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) b####.qutou####.net:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) h####.1####.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) qfc.innot####.com:80
TCP(HTTP/1.1) apk.1####.com:80
TCP(HTTP/1.1) rcv.a####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) st####.1####.com.####.com:80
TCP(HTTP/1.1) m####.3g.qq.com:80
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) only-41####.ns####.net####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) only-83####.ns####.net####.com:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) b####.qutou####.net:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) cdn.a####.com.####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) st####.1####.com.####.com:443
TCP(TLS/1.0) static####.qutou####.net:443
TCP(TLS/1.0) ns####.net####.com:443
UDP 1####.168.101.1:137

Запросы DNS:

a####.man.aliy####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
api.shu####.cn
api.w####.com
apk.1####.com
b####.qutou####.net
cdn.a####.com
cfg.a####.com
dai.shu####.cn
ddd.1####.com
h####.1####.com
i####.1####.com
l####.tbs.qq.com
log.1####.com
m####.3g.qq.com
ns####.net####.com
only-41####.ns####.net####.com
only-83####.ns####.net####.com
qfc.innot####.com
qfy.innot####.com
rcv.a####.com
res####.a####.com
sdk-glo####.a####.com
st####.1####.com
static####.qutou####.net
upd####.a####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&tuid=#...
api.1####.com/app/bottomBar?model=####&lon=####&tuid=####&device_code=##...
api.1####.com/app/coldStart?lon=####&tuid=####&device_code=####&plugins=...
api.1####.com/app/getAdConfig?lon=####&tuid=####&device_code=####&OSVers...
api.1####.com/app/getCloudPluginV3?os=####&lon=####&tuid=####&device_cod...
api.1####.com/app/getConfig?lon=####&tuid=####&device_code=####&OSVersio...
api.1####.com/app/getGuide?lon=####&tuid=####&device_code=####&OSVersion...
api.1####.com/app/getResource?os=####&lon=####&tuid=####&device_code=###...
api.1####.com/app/start?model=####&tuid=####&OSVersion=####&from=####&tk...
api.1####.com/component/getFeComponentInfo?name=####&currtime=####&sign=...
api.1####.com/content/getDefaultChannelList?lon=####&tuid=####&device_co...
api.1####.com/memberinvite/getSkinDetail?lon=####&tuid=####&device_code=...
api.1####.com/remain/getIncreaseRead?lon=####&tuid=####&device_code=####...
api.a####.com/trace?iclicashsid=####&opt_chan=####&opt_dat####&opt_imei=...
apk.1####.com/dt_download/qtt_1000038.apk
apk.1####.com/qukan_resource_emoji_244_302.apk
apk.1####.com/qukan_resource_level_897_295.apk
b####.qutou####.net/download/qutoutiao_9198_apkfile
cfg.a####.com/reqMotPkgLst
h####.1####.com/search_middle/release/middle/static/release/middle.zip?l...
i####.1####.com/module_detail/release/template/release/static/template.z...
i####.1####.com/module_detail/release/template/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip....
log.1####.com/a.gif?lon=####&tuid=####&device_code=####&OSVersion=####&d...
log.1####.com/a.gif?tuid=####&OSVersion=####&tk=####&network=####&versio...
rcv.a####.com/trace?op1=####&opt_app_name=####&op2=####&op3=####&opt_v=#...
st####.1####.com.####.com/image/sp/2018/09/07/1fb25e7fac2ef1e66bd41e94dd...
st####.1####.com.####.com/image/sp/2018/12/20/1d0076ef795337253b3f366b11...
st####.1####.com.####.com/image/sp/2019/06/04/5cf5d99d6d9c7.png

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.1####.com/member/isDeviceReport
api.1####.com/operate/resource/openScreen
api.a####.com/v4/json
cfg.a####.com/req?aid=####
ddd.1####.com/report
l####.tbs.qq.com/ajax?c=####&k=####
m####.3g.qq.com/
qfc.innot####.com/report/v1
qfy.innot####.com/report/v1
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/04273ce96b51d4f755c3f585c317e7a458a5a72f5e64c54....0.tmp
/data/data/####/0df678a7f3143bbd019b845ec9cebd2d
/data/data/####/1004
/data/data/####/4077e5503ef4b24525f37558ff2a91f7
/data/data/####/578B62A16DA3AC930921316D40FC750B.so
/data/data/####/7e78d79200e8112826994e4d8aa4f911
/data/data/####/7e78d79200e8112826994e4d8aa4f911.tmp
/data/data/####/826323f8e625037fca9ee615af2eb214.ttf
/data/data/####/882b1dd744185a542fb95470acd67713
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/SupportABImpl.xml
/data/data/####/T1Ky90j_ktFrwXrfVYr4f0jIrS9UxbnF
/data/data/####/T1chSbLa_4d2kF9-s5qMM0jiJ4GME066
/data/data/####/T1f_hcryjD18P6IZnr3f90A02__IsOGf
/data/data/####/T2g3coYmtQ1XH_07VLUbr0_6WsrhQhjp
/data/data/####/T4F_sWcWAgrNZuU6zoMmf0ilHdKNwNqP
/data/data/####/T5-KBjQEeQp62bVT7rbayEWG3mNABjQB
/data/data/####/T5Tcl8r9_1IcgMhy3ZxfG0S5wyqr6GRi
/data/data/####/T7WKYvu-kqaHkkgZzLd_400kR3UWikSo
/data/data/####/T841rMy_rgHBTk0LbYMTP0wNjbjtVQAJ
/data/data/####/TMSPropertiesb_d_pre.xml
/data/data/####/TMSPropertiesw_s_c.xml
/data/data/####/Twpxn9ahXD2cO-pdgpEYRU59QT8skLzD
/data/data/####/Tx_Jf8dcXwF7e9jVkKR7U0Mv1ktDzV_G
/data/data/####/TzHDCKhCt9StWdXFmoXcRk9cM5TsBReN
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_loadremote_config.xml
/data/data/####/_s_base_switch.xml
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/avatar_default-5610d054.png
/data/data/####/b2d8b18f576da3a380d720aec0bacdfdde1f2895e4fc44a....0.tmp
/data/data/####/bab88900339133204787b53a66a0f812
/data/data/####/base.xml
/data/data/####/bugly_db_-journal
/data/data/####/c7971fb5498978d5669a8f1527370a0a.0.tmp
/data/data/####/c7971fb5498978d5669a8f1527370a0a.1
/data/data/####/cmd_data_tracker_v2.db
/data/data/####/cmd_data_tracker_v2.db-journal
/data/data/####/cmd_data_tracker_v2.db_pushservice
/data/data/####/cmd_data_tracker_v2.db_pushservice-journal
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.iclicash.advlib.xml.bak
/data/data/####/com.jifen.qkbase.web.template.source.SourceManager.xml
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.jifen.qukan_prefs.xml.bak (deleted)
/data/data/####/common.536c570e.js
/data/data/####/common.56725196.js
/data/data/####/common.9c88e62c.css
/data/data/####/common.aa0a2cf4.css
/data/data/####/common.acbf1d6f.css
/data/data/####/common.f5e3c832.js
/data/data/####/config.json
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_tracker_v2.db
/data/data/####/data_tracker_v2.db-journal
/data/data/####/data_tracker_v2.db_pushservice
/data/data/####/data_tracker_v2.db_pushservice-journal
/data/data/####/dn_163
/data/data/####/download.zip
/data/data/####/download_upload
/data/data/####/emoji.cfg
/data/data/####/emoji.md5
/data/data/####/f4747c234b0f608a33b61a13613e44a9418a6b419aa6118....0.tmp
/data/data/####/finch.db-journal
/data/data/####/first_page_fy.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/ic_return-c01af319.png
/data/data/####/ic_search-a9054d83.png
/data/data/####/icon-delete-7e1541c7.png
/data/data/####/icon-history-28be26f0.png
/data/data/####/icon-hotnews-3b31a624.png
/data/data/####/icon_article-77ec0e08.png
/data/data/####/icon_close_search-bf54bcc6.png
/data/data/####/icon_hot-fccf250e.png
/data/data/####/icon_more-9568d56c.png
/data/data/####/icon_picture-03fc07e6.png
/data/data/####/icon_play-bcdf2dfb.png
/data/data/####/icon_qutoutiaohao-98fbbebd.png
/data/data/####/icon_success-fac4a5d6.png
/data/data/####/icon_video-567efe5a.png
/data/data/####/icon_vip-d40ce791.png
/data/data/####/icon_wemedia_more-897cdcb9.png
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/level.md5
/data/data/####/libijkffmpeg.so
/data/data/####/libijkffmpeg.so.md5
/data/data/####/libijkplayer.so
/data/data/####/libijkplayer.so.md5
/data/data/####/libijksdl.so
/data/data/####/libijksdl.so.md5
/data/data/####/libjiagu-1385524905.so
/data/data/####/libquid.so
/data/data/####/libxyvodsdk.so
/data/data/####/libxyvodsdk.so.md5
/data/data/####/loading-6525f20e.gif
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/main_metadata
/data/data/####/main_metadata.bak
/data/data/####/middle.7efde61c.js
/data/data/####/middle.926cf01a.css
/data/data/####/middle.html
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/noactivity-eaac7382.png
/data/data/####/noresult-e375458a.png
/data/data/####/open_screen_image.png
/data/data/####/pdm.db
/data/data/####/pdm.db-journal
/data/data/####/pref.xml
/data/data/####/proc_monitor_local_rec_main.xml
/data/data/####/proc_monitor_local_rec_push.xml
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_app_optsp.xml
/data/data/####/qk_push_sp.xml
/data/data/####/search_middle.zip
/data/data/####/security_info
/data/data/####/so.zip
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/statistic_all_new_log.db_pushservice
/data/data/####/statistic_all_new_log.db_pushservice-journal
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tempfile
/data/data/####/template.1c84dfcf.css
/data/data/####/template.312b218d.js
/data/data/####/template.52c060d5.css
/data/data/####/template.ee7db35d.js
/data/data/####/template.html
/data/data/####/timer_ab.xml
/data/data/####/tmsdk_dualsim_shark.xml
/data/data/####/umeng_common_config.xml
/data/data/####/vendor.0678e785.js
/data/data/####/weibo_sdk_aid1
/data/data/####/wifi_signal_table-journal
/data/data/####/zipPre.bfde96c6.js
/data/media/####/.301d5.cuid
/data/media/####/.301d5.ncuid
/data/media/####/.3f05f.acid
/data/media/####/.3f05f.openidcom.jifen.qukan
/data/media/####/.47dcb.ncuid
/data/media/####/.48504.cuid2
/data/media/####/.801ab.acid
/data/media/####/.9bf72.cuid2
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.aio.dat
/data/media/####/.b11dd.ncuid
/data/media/####/.b11dd.openidcom.jifen.qukan
/data/media/####/.c3418.acid
/data/media/####/.c3418.cuid2
/data/media/####/.com.jifen.ac.ReportCount
/data/media/####/.com.jifen.ac.acid
/data/media/####/.com.jifen.ac.cuid
/data/media/####/.com.jifen.ac.cuid2
/data/media/####/.com.jifen.ac.ncuid
/data/media/####/.com.jifen.op.openidcom.jifen.qukan
/data/media/####/.e84e3.openidcom.jifen.qukan
/data/media/####/.e8b74.cuid
/data/media/####/.nomedia
/data/media/####/.quid
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a38579f9747b93a04b757e18de46a51c
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/cf_lk_2.dat
/data/media/####/cf_st_2.dat
/data/media/####/tbslog.txt

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/app_bin/daemon
date
df
getprop
getprop net.hostname
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.serialno
getprop ro.smartisan.version
getprop ro.vivo.os.version
getprop wifi.interface
id
ls -i
ls -l
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd <SD-Card>/ && ls -i
sh -c echo MzQ2OTFCRTcxNUI5MzlDODA3RDU5Q0E1RjkyRTYwOUFCNDQwRkE6N0RGMEY4OkJFOTY1NQ== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo MzQ2OTFCRTcxNUI5MzlDODA3RDU5Q0E1RjkyRTYwOUFCNDQwRkE6N0RGMEY4OkJFOTY1NQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo REIyMDA0OEQ1RTE0RjFCRkZFQUUyNzk2NTY1MTMwMTIxNTY3Njg2MTU1 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo REIyMDA0OEQ1RTE0RjFCRkZFQUUyNzk2NTY1MTMwMTIxNTY3Njg2MTU1 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c echo RjAxMTE4NzJDQjNDRUVCNTIxMDU1MzJBRkJBMEVFRDdFODE5MEU6Q0E3NzgxOjY3M0YwNg== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo RjAxMTE4NzJDQjNDRUVCNTIxMDU1MzJBRkJBMEVFRDdFODE5MEU6Q0E3NzgxOjY3M0YwNg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh <Package Folder>/files/T1Ky90j_ktFrwXrfVYr4f0jIrS9UxbnF
sh <Package Folder>/files/T1chSbLa_4d2kF9-s5qMM0jiJ4GME066
sh <Package Folder>/files/T1f_hcryjD18P6IZnr3f90A02__IsOGf
sh <Package Folder>/files/T2g3coYmtQ1XH_07VLUbr0_6WsrhQhjp
sh <Package Folder>/files/T4F_sWcWAgrNZuU6zoMmf0ilHdKNwNqP
sh <Package Folder>/files/T5-KBjQEeQp62bVT7rbayEWG3mNABjQB
sh <Package Folder>/files/T5Tcl8r9_1IcgMhy3ZxfG0S5wyqr6GRi
sh <Package Folder>/files/T7WKYvu-kqaHkkgZzLd_400kR3UWikSo
sh <Package Folder>/files/T841rMy_rgHBTk0LbYMTP0wNjbjtVQAJ
sh <Package Folder>/files/Twpxn9ahXD2cO-pdgpEYRU59QT8skLzD
sh <Package Folder>/files/Tx_Jf8dcXwF7e9jVkKR7U0Mv1ktDzV_G
sh <Package Folder>/files/TzHDCKhCt9StWdXFmoXcRk9cM5TsBReN
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat random
uname -a

Загружает динамические библиотеки:

Bugly
InnoSecure
InnoSo
NativeExample
du
libTmsdk-2.0.8-dual-mfr
libijkffmpeg
libijkplayer
libijksdl
libjiagu-1385524905

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней