Adware.Gexin.17874

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(DNS) <Google DNS>
TCP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) ani####.d####.tv:8081
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) njdx####.d####.tv:80
TCP(HTTP/1.1) zj####.d####.tv:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) appact####.d####.tv:8081
TCP(HTTP/1.1) zj####.d####.tv:8083
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) ani####.d####.tv:80
TCP(TLS/1.0) 1####.217.20.106:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) bj####.j####.cn:443
TCP(TLS/1.0) gd-s####.j####.cn:443
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) t####.j####.cn:443
TCP(TLS/1.0) dxp.b####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.2) 1####.217.20.106:443
TCP i####.j####.cn:7008
TCP 1####.202.138.24:7004
UDP 1####.196.118.23:19000
TCP cm-1####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224
UDP s.j####.cn:19000
UDP 1####.121.49.100:19000
UDP 43.2####.88.106:19000
UDP 1####.229.215.60:19000
UDP easytom####.com:19000

Запросы DNS:

7j####.c####.z0.####.com
ali-s####.j####.cn
and####.b####.qq.com
and####.google####.com
ani####.d####.tv
api.w####.com
appact####.d####.tv
bj####.j####.cn
c-h####.g####.com
cgi.con####.qq.com
cm-1####.ig####.com
dxp.b####.com
dzc####.a####.tv
easytom####.com
f####.a####.tv
f####.a####.tv
gd-s####.j####.cn
h####.b####.com
i####.j####.cn
instant####.google####.com
m####.go####.com
njdx####.d####.tv
pub-####.qin####.com
s.j####.cn
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sis.j####.io
t####.j####.cn
zj####.d####.tv

Запросы HTTP GET:

ani####.d####.tv/5.8.1/css/iconfont.css
ani####.d####.tv/5.8.1/css/index/indexRecommend.css
ani####.d####.tv/5.8.1/css/mescroll/mescroll-option.css
ani####.d####.tv/5.8.1/css/mescroll/mescroll.min.css
ani####.d####.tv/5.8.1/css/public.css
ani####.d####.tv/5.8.1/css/swiper/swiper.min.css
ani####.d####.tv/5.8.1/css/zjtArticleDetail.css
ani####.d####.tv/5.8.1/fonts/iconfont.ttf?t=####
ani####.d####.tv/5.8.1/html/index/index_ColumnList.html?c_type=####
ani####.d####.tv/5.8.1/html/zjt/zjt_content_detail.html?content_id=####&...
ani####.d####.tv/5.8.1/images/ClipboardImage.gif
ani####.d####.tv/5.8.1/images/banner_v3.jpg
ani####.d####.tv/5.8.1/images/course_bg.gif
ani####.d####.tv/5.8.1/images/lloading.gif
ani####.d####.tv/5.8.1/js/fastclick.js
ani####.d####.tv/5.8.1/js/iconfont.js
ani####.d####.tv/5.8.1/js/jquery.base64.js
ani####.d####.tv/5.8.1/js/jquery.md5.js
ani####.d####.tv/5.8.1/js/jquery.min.js
ani####.d####.tv/5.8.1/js/mescroll/mescroll-option.js
ani####.d####.tv/5.8.1/js/mescroll/mescroll.min.js
ani####.d####.tv/5.8.1/js/public.js
ani####.d####.tv/5.8.1/template/index/style.IndexColumnList.js
ani####.d####.tv/5.8.1/template/index/tpl.IndexColumnList.js
ani####.d####.tv/5.8.1/template/pub.ColLabel.js
ani####.d####.tv/5.8.1/template/tpl.ZJT_ArticleDetail.js
ani####.d####.tv/aniuapi/api/v2/ad/getadvertisement.html?id=####
ani####.d####.tv/aniuapi/api/v2/aniuChannelUserDialog/doDialog?page=####...
ani####.d####.tv/aniuapi/api/v2/menumanager/gethasmenu?platform=####&dev...
ani####.d####.tv/favicon.ico
ani####.d####.tv:8081/useravatar1540527/20160803/useravatar1540527_20160...
ani####.d####.tv:8081/wxoaFF4jo25GVXq31TNMp3shWrftIU/20151208/wxoaFF4jo2...
ani####.d####.tv:8081/wxoaFF4jqeBS4-zlfABcb5sGJpjH9I/20151129/wxoaFF4jqe...
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?status_os=####&stat...
njdx####.d####.tv/201610171108286770/201610171108286770.jpg
njdx####.d####.tv/2019/02/13/f86016e0424a947add7c787728c608f6.png
njdx####.d####.tv/2019/04/21/04e6e0466c1719a5a405e4bc9efbdefd.jpg
njdx####.d####.tv/2019/04/29/10652115b25eee40d083d925467bfaf8.jpg
njdx####.d####.tv/2019/06/21/b0e2da654a8601b6b5cb28a71a91434c.png?devid=...
njdx####.d####.tv/2019/07/15/cfcabd0568f25db17a112ec21779333c.jpg
njdx####.d####.tv/2019/09/12/65979057b56593316b1a818905f5b989.jpg
njdx####.d####.tv/2019/09/17/09b2b83d9c2f8e82d26a3952b5f90fa7.jpeg
njdx####.d####.tv/2019/09/17/2bc7e7f15f5326999162b5dd26c7b991.png
njdx####.d####.tv/2019/09/18/ceb914f741ba17ba8be8428ae74ce274.png
njdx####.d####.tv/2019/09/18/f6cc4970d91cf3a5fc50d244b54c9224.png
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_EDT369
q####.c####.l####.####.com/tdata_LRe817
q####.c####.l####.####.com/tdata_OxN092
q####.c####.l####.####.com/tdata_ZPR725
q####.c####.l####.####.com/tdata_bca864
sdk.o####.p####.####.com/api/addr.htm
zj####.d####.tv/aniuapi/api/v2/comment/appQuery?channelid=####&clientid=...
zj####.d####.tv/aniuapi/api/v2/transcript/getTsPayDetail?callback=####&a...
zj####.d####.tv/aniuapi/api/v2/transcript/query?channelid=####&clientid=...
zj####.d####.tv:8083/aniuapi/api/v2/adrecommend/queryXqyTj?callback=####...

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
appact####.d####.tv:8081/addAniuApp
c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/00406005d5bc27e3_0
/data/data/####/00406005d5bc27e3_1
/data/data/####/07b5735d-178d-4768-859b-ae8b5b28ed4a
/data/data/####/08395e5833c135dd_0
/data/data/####/1002
/data/data/####/1004
/data/data/####/105a16cedf10698a_0
/data/data/####/105a16cedf10698a_1
/data/data/####/1bc22729af84354c_0
/data/data/####/1f769501cfc232f9_0
/data/data/####/232d5db5c872ad91276a60f9c54c6fe1.0.tmp
/data/data/####/232d5db5c872ad91276a60f9c54c6fe1.1.tmp
/data/data/####/2e943819e0664b24_0
/data/data/####/383a2eac-a68a-4310-b2c3-3983e659c419
/data/data/####/44cffe79-9f16-4516-8d0e-9fb39c71da5b
/data/data/####/4c3fe0152f98e4b2_0
/data/data/####/58bbb4464741bf91_0
/data/data/####/61e46dc2b122a4b3_0
/data/data/####/61e46dc2b122a4b3_1
/data/data/####/65f923552f43d00f_0
/data/data/####/65f923552f43d00f_1
/data/data/####/668e1a221bad9c7a_0
/data/data/####/668e1a221bad9c7a_1
/data/data/####/68f9a1a30519f862_0
/data/data/####/68f9a1a30519f862_1
/data/data/####/69b323bc089c4b31_0
/data/data/####/6dbf6633d1564f69_0
/data/data/####/70b9d70ad1142446_0
/data/data/####/7811e35b8a9ff40f_0
/data/data/####/858c2b6534e921fe_0
/data/data/####/89ba2e1f-02a8-47db-bf05-a8b24b7a7913
/data/data/####/9128b11cbdc3e146_0
/data/data/####/9128b11cbdc3e146_1
/data/data/####/957b493bcd90216d_0
/data/data/####/9a6f9f1ad2808f09_0
/data/data/####/9dc48486c7020929_0
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/Cookies-journal
/data/data/####/IpInfos.xml
/data/data/####/IpInfos.xml.bak
/data/data/####/Push_Page_Config.xml
/data/data/####/VERIFY_SP.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1568749501537
/data/data/####/a2f61712e1b5bc6d_0
/data/data/####/a2f61712e1b5bc6d_1
/data/data/####/a444049f12db93b3_0
/data/data/####/a44d20cd06d7c656_0
/data/data/####/a73aa952-ee1b-424e-b865-b83b27583a2a
/data/data/####/a8068ea094f1
/data/data/####/ac7bb02bdc3831908f9baa6d883e7702.0.tmp
/data/data/####/ac7bb02bdc3831908f9baa6d883e7702.1.tmp
/data/data/####/ae9db8e078c7ebef_0
/data/data/####/ae9db8e078c7ebef_1
/data/data/####/b0d60573e997c9f2a5278cd911cfa01d.0.tmp
/data/data/####/b0d60573e997c9f2a5278cd911cfa01d.1.tmp
/data/data/####/b4c901d2b92fb6c5_0
/data/data/####/b4c901d2b92fb6c5_1
/data/data/####/b575706e60968184_0
/data/data/####/b7163e8d-4c8a-40f7-b395-f740371d53d5
/data/data/####/b7dd56f5f14a5786_0
/data/data/####/b7dd56f5f14a5786_1
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/baidu_mtj_sdk_record.xml.bak
/data/data/####/bal.catch
/data/data/####/bugly_db_-journal
/data/data/####/bwc.catch
/data/data/####/c24c19ae-165f-42a2-8da9-11e2aaf65e17
/data/data/####/cc33cca804154251_0
/data/data/####/cc33cca804154251_1
/data/data/####/cfdde8739bab7db4_0
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/cn.jiguang.common.xml
/data/data/####/cn.jiguang.common.xml.bak
/data/data/####/cn.jiguang.sdk.address.xml
/data/data/####/cn.jiguang.sdk.report.xml
/data/data/####/cn.jiguang.sdk.user.profile.xml
/data/data/####/cn.jiguang.sdk.user.profile.xml.bak
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.tencent.open.config.json.101081844
/data/data/####/comment.db
/data/data/####/comment.db-journal
/data/data/####/content.db
/data/data/####/content.db-journal
/data/data/####/crashrecord.xml
/data/data/####/d0926b22544f34e1_0
/data/data/####/d0926b22544f34e1_1
/data/data/####/ddaa8c6a6be3c31c_0
/data/data/####/dzcj.xml
/data/data/####/e02bf331573b49cd_0
/data/data/####/e02bf331573b49cd_1
/data/data/####/e12d15644b1b4665_0
/data/data/####/e29c382374c2334d_0
/data/data/####/e7e64b6674560471_0
/data/data/####/ec714e60-937c-406b-bd53-d7f4603845ff
/data/data/####/ec714e60-937c-406b-bd53-d7f4603845ff (deleted)
/data/data/####/ee5bc52e99369dac_0
/data/data/####/f0e62d69dcc25604_0
/data/data/####/f24b8a94868cf7ed_0
/data/data/####/f4adbfc2d0ef3d76_0
/data/data/####/f7343fc68aca3e02_0
/data/data/####/f8839bd20e0d11ed_0
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/http_dzcjapp.aniu.tv_0.localstorage-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/metrics_guid
/data/data/####/mtj_autoTracker.js
/data/data/####/native_record_lock
/data/data/####/preload_ad
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/push_stat_cache.json
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/rl.catch
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_LRe817
/data/data/####/tdata_LRe817.dex
/data/data/####/tdata_LRe817.dex.flock (deleted)
/data/data/####/tdata_LRe817.jar
/data/data/####/tdata_OxN092
/data/data/####/tdata_OxN092.dex
/data/data/####/tdata_OxN092.dex.flock (deleted)
/data/data/####/tdata_OxN092.jar
/data/data/####/tdata_ZPR725
/data/data/####/tdata_ZPR725.dex
/data/data/####/tdata_ZPR725.dex.flock (deleted)
/data/data/####/tdata_ZPR725.jar
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.dex
/data/data/####/tdata_bca864.dex.flock (deleted)
/data/data/####/tdata_bca864.jar
/data/data/####/the-real-index
/data/data/####/tj.db-journal
/data/data/####/trace_circle.data
/data/data/####/tv.aniu.app.dzlc.BETA_VALUES.xml
/data/data/####/tv.aniu.app.dzlc.BETA_VALUES.xml.bak
/data/data/####/tv.aniu.app.dzlc_preferences.xml
/data/data/####/weibo_sdk_aid1
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_LRe817.jar --oat-fd=70 --oat-location=/data/user/0/<Package>/files/tdata_LRe817.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_OxN092.jar --oat-fd=56 --oat-location=/data/user/0/<Package>/files/tdata_OxN092.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_ZPR725.jar --oat-fd=71 --oat-location=/data/user/0/<Package>/files/tdata_ZPR725.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_bca864.jar --oat-fd=56 --oat-location=/data/user/0/<Package>/files/tdata_bca864.dex --compiler-filter=speed
cat /sys/class/net/wlan0/address
getprop
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
mount
ps
sh

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней