Adware.Gexin.18759

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) app.t####.com:9003
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) s####.ml####.cc:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) redi####.network####.com:443
TCP(TLS/1.0) dc1.network####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP cm-1####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5226
TCP zb-cent####.m.ta####.com:443

Запросы DNS:

7j####.c####.z0.####.com
a####.man.aliy####.com
amdc####.m.ta####.com
and####.cli####.go####.com
and####.google####.com
api.map.b####.com
app.t####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.ig####.com
cm-1####.ig####.com
cm-1####.ig####.com
dc1.network####.com
instant####.google####.com
log.u####.com
m####.go####.com
p####.google####.com
pub-####.qin####.com
redi####.network####.com
s####.ml####.cc
safebro####.google####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
umen####.m.ta####.com
umengj####.m.ta####.com
www.google####.com

Запросы HTTP GET:

cdn-sdk####.g####.com.####.com/tdata_yAR554
et2-na6####.wagbr####.ali####.####.com/bar/get/54913efafd98c5aa83000a46/...
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_BAI450
q####.c####.l####.####.com/tdata_EDT369
q####.c####.l####.####.com/tdata_vGW305
sdk.o####.p####.####.com/api/addr.htm

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
app.t####.com:9003/tebp/activities/activesxml.ac
app.t####.com:9003/tebp/promotion/promotion!BottomIcon.ac
app.t####.com:9003/tebp/promotion/promotion!classification.ac
app.t####.com:9003/tebp/promotion/promotionscreen.ac
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/2258d95aad96
/data/data/####/ACCS_BINDumeng;54913efafd98c5aa83000a46.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/NBSCrashStore.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/authStatus_com.inphase.tyfo.xml
/data/data/####/authStatus_com.inphase.tyfo;channel.xml
/data/data/####/authStatus_com.inphase.tyfo;pushservice.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/com.inphase.tyfo_preferences.xml
/data/data/####/com.inphase.tyfo_preferences.xml.bak
/data/data/####/com.networkbench.agent.impl.v2_com.inphase.tyfo.xml
/data/data/####/com.networkbench.agent.impl.v2_com.inphase.tyfo.xml.bak
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/mac.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/persistent_data.xml
/data/data/####/persistent_data.xml.bak
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/tdata_yAR554
/data/data/####/tdata_yAR554.dex
/data/data/####/tdata_yAR554.dex.flock (deleted)
/data/data/####/tdata_yAR554.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/dex2oat --instruction-set=arm --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_yAR554.jar --oat-fd=45 --oat-location=/data/user/0/<Package>/files/tdata_yAR554.dex --compiler-filter=speed
cat /sys/class/net/wlan0/address
mount
sh

Использует следующие алгоритмы для шифрования данных: