Adware.Gexin.18263

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) h####.b####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) gs.g####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c####.g####.com:80
TCP(HTTP/1.1) a####.b####.com:80
TCP(HTTP/1.1) hiph####.jom####.com:80
TCP(HTTP/1.1) b####.g####.com:80
TCP(TLS/1.0) nsc####.b####.com:443
TCP(TLS/1.0) uf####.b####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) wynac####.b####.com:443
TCP(TLS/1.0) wap####.b####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) k####.b####.com:443
TCP(TLS/1.0) 1####.217.20.78:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) ssls####.jom####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) www.baif####.com:443
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) so####.bdst####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) gi####.b####.com:443
TCP(TLS/1.0) edu-y####.b####.com.####.com:443
TCP(TLS/1.0) so####.b####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP cm-1####.ig####.com:5224
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
a####.b####.com
and####.google####.com
b####.g####.com
b####.pi####.com
bos.p####.com
c####.b####.com
c####.baidust####.com
c####.g####.com
c####.g####.com
c-h####.g####.com
cm-1####.ig####.com
down####.b####.com
edu-y####.b####.com
exp.p####.com
f####.gst####.com
g####.b####.com
g####.bdst####.com
g.hiph####.b####.com
gi####.b####.com
gs.g####.com
h####.b####.com
h####.b####.com
hiph####.b####.com
hm.b####.com
instant####.google####.com
k####.b####.com
laun####.tcloudf####.com
m####.go####.com
m.b####.com
mis.y####.b####.com
mo####.b####.com
norma-e####.m####.com
nsc####.b####.com
p####.google####.com
p.g####.b####.com
s0.hao12####.com
safebro####.google####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
so####.b####.com
so####.bdst####.com
t####.laun####.tcloudf####.com
uf####.b####.com
w####.boc.cn
w####.ccb.com
w####.jd.com
w####.pps.tv
w####.qq.com
wap####.b####.com
www.abc####.com
www.al####.com
www.b####.com
www.baif####.com
www.ceb####.com
www.cmbc####.com
www.g####.com.cn
www.i####.com.cn
www.k####.com
www.su####.com
wynac####.b####.com

Запросы HTTP GET:

a####.b####.com/nabook/sync?mc=####&fcy=####&sign=####&is_new=####&cuid=...
h####.b####.com/sys/portraitn/item/646be6a0b7e68891e7bb99e4bda0e9a5bfe4b...
h####.b####.com/sys/portraitn/item/ccc76d61676963747574615014
hiph####.jom####.com/doc/abpic/item/37d12f2eb9389b50e30e04bc8235e5dde611...
hiph####.jom####.com/doc/abpic/item/37d3d539b6003af30900cf05362ac65c1038...
hiph####.jom####.com/doc/abpic/item/562c11dfa9ec8a1334dcab8dfd03918fa1ec...
hiph####.jom####.com/doc/abpic/item/78310a55b319ebc4b79eb1c58826cffc1f17...
hiph####.jom####.com/doc/abpic/item/7dd98d1001e939019de20efc71ec54e737d1...
hiph####.jom####.com/doc/abpic/item/c2fdfc039245d6883b0e5452a8c27d1ed21b...
hiph####.jom####.com/doc/abpic/item/eac4b74543a98226702f28b38082b9014b90...
hiph####.jom####.com/doc/abpic/item/fd039245d688d43ff728f0c5761ed21b0ef4...
hiph####.jom####.com/doc/pic/item/2e2eb9389b504fc2005420f8eedde71191ef6d...
hiph####.jom####.com/doc/pic/item/3812b31bb051f8194e3e0e07d1b44aed2e73e7...
hiph####.jom####.com/doc/pic/item/3812b31bb051f819fd1ab073d0b44aed2e73e7...
hiph####.jom####.com/doc/pic/item/3c6d55fbb2fb4316349d9cbf2ba4462308f7d3...
hiph####.jom####.com/doc/pic/item/7a899e510fb30f2494a1df97c395d143ad4b03...
hiph####.jom####.com/doc/pic/item/7aec54e736d12f2e52ea162a45c2d562843568...
hiph####.jom####.com/doc/pic/item/cefc1e178a82b901d9ea9e6c7b8da9773912ef...
hiph####.jom####.com/doc/pic/item/e824b899a9014c080538bbb7077b02087bf4f4...
hiph####.jom####.com/doc/pic/item/eac4b74543a98226702f28b38082b9014b90eb...
hiph####.jom####.com/space/wh=84,114;q=90/sign=6680e91da64bd1130498bf3a6...
norma-e####.m####.com/android/exchange/getpublickey.do
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_LRe817
q####.c####.l####.####.com/tdata_OxN092
q####.c####.l####.####.com/tdata_ZPR725
q####.c####.l####.####.com/tdata_bca864
sdk.o####.p####.####.com/api/addr.htm

Запросы HTTP POST:

a####.b####.com//nauser/ydsendbooks?
a####.b####.com/cart/interface/getcartdetails?
a####.b####.com/naapi/api/updatesetting
a####.b####.com/naapi/push/storenologintoken?
a####.b####.com/naapi/user/usercenter
a####.b####.com/nabook/bookroomoperate
a####.b####.com/nabook/cview?
a####.b####.com/nabook/getnovelcatalogs?
a####.b####.com/naencourage/yueli/getall
a####.b####.com/nahome/nacolumns
a####.b####.com/naproxy/combinedbookdetail
a####.b####.com/nauser/checkinv2?
a####.b####.com/nauser/yuedutasklist
b####.g####.com/api.php?format=####&t=####
c####.g####.com/api.php?format=####&t=####
gs.g####.com/encryption/key/fetch
gs.g####.com/geshu/sdkStatistics/bd
gs.g####.com/geshu/sdkStatistics/ubi
norma-e####.m####.com/push/android/external/add.do
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.meth
/data/data/####/.sinfo
/data/data/####/.x3736
/data/data/####/.x3822
/data/data/####/.x3901
/data/data/####/1-3.4.2.8
/data/data/####/1-3.4.2.8.dex
/data/data/####/1-3.4.2.8.dex.flock (deleted)
/data/data/####/1-3.4.2.8.tmp
/data/data/####/1-3.4.2.8.zip
/data/data/####/4f67d32a
/data/data/####/918689903d7309f1c83e68165e7c1eab
/data/data/####/BaiduGid.db-journal
/data/data/####/Cookies-journal
/data/data/####/SDK_NLOG_SP_2018.xml
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/SP_BOOK_SHELF.xml
/data/data/####/Stat_SDK_SendRem.xml
/data/data/####/UfoSharePreference.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1571165849365
/data/data/####/_nlog_0_wenku.1a6f509a543dd0f21dcecfb658aaaae1.dat
/data/data/####/_nlog_6051_wenkunew.85caa35389464f71b2ba9b6992ea082b.dat
/data/data/####/_pay.preferences.xml
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/baidu_mtj_sdk_record.xml.bak
/data/data/####/bd_pass_cuid_system.xml
/data/data/####/bdg_system.xml
/data/data/####/bdg_system.xml.bak
/data/data/####/bdreader.xml
/data/data/####/bio_pass_face_system.xml
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/classes.oat
/data/data/####/com.baidu.wallet.preferences_name.xml
/data/data/####/com.baidu.yuedu_preferences.xml
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.1.xml.bak
/data/data/####/com.x.y.2.xml
/data/data/####/crab_app_life.xml
/data/data/####/crab_crash_switch.xml
/data/data/####/crab_user_info.xml
/data/data/####/crab_user_info.xml.bak
/data/data/####/customerservice.db-journal
/data/data/####/d.db-journal
/data/data/####/download.db-journal
/data/data/####/fdid.xml
/data/data/####/fffppcfg.xml
/data/data/####/fffppcfg.xml.bak
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gtc.db-journal
/data/data/####/gx_sp.xml
/data/data/####/gzpfc.xml
/data/data/####/gzpfc.xml.bak
/data/data/####/ias.db-journal
/data/data/####/ias_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/is_newer.txt
/data/data/####/last_init_crab.xml
/data/data/####/leroadcfg.xml
/data/data/####/leroadcfg.xml.bak
/data/data/####/leroadcfg.xml.bak (deleted)
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/libsofiresec3428.so
/data/data/####/metrics_guid
/data/data/####/myrsdb.db-journal
/data/data/####/mz_push_preference.xml
/data/data/####/nextreader.db-journal
/data/data/####/playDuer.db-journal
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/re_po_rt.xml
/data/data/####/reader.db-journal
/data/data/####/run.pid
/data/data/####/sapi_system.xml
/data/data/####/sapi_system.xml.bak
/data/data/####/tdata_LRe817
/data/data/####/tdata_LRe817.dex
/data/data/####/tdata_LRe817.dex.flock (deleted)
/data/data/####/tdata_LRe817.jar
/data/data/####/tdata_OxN092
/data/data/####/tdata_OxN092.dex.flock (deleted)
/data/data/####/tdata_OxN092.jar
/data/data/####/tdata_ZPR725
/data/data/####/tdata_ZPR725.dex
/data/data/####/tdata_ZPR725.dex.flock (deleted)
/data/data/####/tdata_ZPR725.jar
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.dex
/data/data/####/tdata_bca864.dex.flock (deleted)
/data/data/####/tdata_bca864.jar
/data/data/####/tpgcc.db-journal
/data/data/####/ttsModel.db
/data/data/####/ttsModel.db-journal
/data/data/####/user_center_cache
/data/data/####/version.dat
/data/data/####/volcano.db-journal
/data/data/####/wappass.baidu.com-passport-login.html
/data/data/####/wenku.xml
/data/data/####/wenku.xml.bak
/data/data/####/x0_p_s_n.xml
/data/data/####/x0dnscache.db-journal
/data/data/####/yuedusp.xml
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes4.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes5.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes6.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes7.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/.tmp/1-3.4.2.8.zip --oat-fd=97 --oat-location=<Package Folder>/files/.1/dex/apkDex/1-3.4.2.8.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_LRe817.jar --oat-fd=53 --oat-location=/data/user/0/<Package>/files/tdata_LRe817.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_OxN092.jar --oat-fd=37 --oat-location=/data/user/0/<Package>/files/tdata_OxN092.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_ZPR725.jar --oat-fd=37 --oat-location=/data/user/0/<Package>/files/tdata_ZPR725.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_bca864.jar --oat-fd=52 --oat-location=/data/user/0/<Package>/files/tdata_bca864.dex --compiler-filter=speed
cat /proc/net/route
cat /proc/uptime
cat /sys/class/net/wlan0/address
chmod 664 /data/user/0/<Package>/.BD_SAPI_CACHE/918689903d7309f1c83e68165e7c1eab
chmod 701 /data/user/0/<Package>
chmod 701 /data/user/0/<Package>/.BD_SAPI_CACHE
chmod 771 /data/user/0/<Package>/files/.tmp
chmod 771 /data/user/0/<Package>/files/.tmp/1-3.4.2.8.zip
chmod 771 <Package Folder>/files/.1/dex
chmod 771 <Package Folder>/files/.1/lib/3.4.2.8/537640171/armeabi
chmod 771 <Package Folder>/files/.1/lib/3.4.2.8/537640171/armeabi/libsofiresec3428.so
cut -f 1 -d
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.build.version.security_patch
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
ls -l /system/bin/su
ls -ld /data/user/0/<Package>
ls /sys/bus
ls /sys/bus/i2c/devices
ls /sys/bus/sdio/devices
ls /sys/class/uio
lsmod
md5sum /system/bin/app_process
md5sum /system/bin/app_process32
md5sum /system/bin/app_process64
md5sum /system/bin/servicemanager
mount
ps
sh
stat /system/bin/netstat
stat /system/lib/libc.so

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней