Adware.Gexin.19088

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) cm13-cc####.p####.bo####.####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) njdx####.d####.tv:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) njd####.d####.tv:8083
TCP(HTTP/1.1) appact####.d####.tv:8081
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) ani####.d####.tv:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(TLS/1.0) 1####.217.19.206:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 1####.217.17.106:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) dxp.b####.com:443
TCP(TLS/1.0) bj####.j####.cn:443
TCP(TLS/1.0) sdk.verific####.jig####.cn:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) 1####.217.17.138:443
TCP(TLS/1.2) 1####.217.17.106:443
TCP 1####.232.25.173:21007
TCP 1####.232.25.176:21006
TCP sdk.o####.t####.####.com:5224
UDP s.j####.cn:19000
TCP cm-1####.ig####.com:5226
TCP 1####.230.236.22:7002
TCP 1####.232.25.176:21005
TCP cm-1####.ig####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
and####.b####.qq.com
and####.google####.com
ani####.d####.tv
api.w####.com
appact####.d####.tv
bj####.j####.cn
c-h####.g####.com
cdn-sdk####.g####.com
cgi.con####.qq.com
cm-1####.ig####.com
cm-1####.ig####.com
cm-1####.ig####.com
cm13-cc####.p####.bo####.com
dxp.b####.com
dzc####.a####.tv
easytom####.com
f####.a####.tv
h####.b####.com
i####.me
instant####.google####.com
l####.cmpass####.com
njd####.d####.tv
njdx####.d####.tv
o####.e.189.cn
one####.cmpass####.com
openc####.wos####.cn
s.j####.cn
safebro####.google####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sdk.verific####.jig####.cn
sis.j####.io
wap.cmpass####.com
www.google####.com
zj####.d####.tv

Запросы HTTP GET:

ani####.d####.tv/2019/05/22/b48926020edfe13fb52fcc92d24a2fa2.png
ani####.d####.tv/2019/06/21/b0e2da654a8601b6b5cb28a71a91434c.png?devid=8...
ani####.d####.tv/2019/09/20/4340eb64b75d306986955d9a44e8e2d9.png
ani####.d####.tv/2019/09/27/bc0397bc17c2ffdbdf92880b34362db1.png
ani####.d####.tv/2019/10/08/7449a55f09d234d5591d713cb2e7376d.png
ani####.d####.tv/2019/10/14/035f862f0641be257c17645b9c75881d.png
ani####.d####.tv/2019/10/14/228f086eaabe39e276d40917392d6d5e.png
ani####.d####.tv/2019/10/14/a0a67fcb996943ddc53eeaba28262d70.png
ani####.d####.tv/2019/10/24/ac7af671ba8493d0b24bd8f9c2b86fa4.png
ani####.d####.tv/2019/11/09/67efded1d1ba6de717d93927a488c36e.png
ani####.d####.tv/2019/11/22/7178f7effd04b30d3bb7797fc7a9dc24.png
ani####.d####.tv/2019/12/10/b88770c8598b1c6d307d91dbc26e1513.png
ani####.d####.tv/5.8.6/css/iconfont.css
ani####.d####.tv/5.8.6/css/index/indexRecommend.css
ani####.d####.tv/5.8.6/css/mescroll/mescroll-option.css
ani####.d####.tv/5.8.6/css/mescroll/mescroll-totop.png
ani####.d####.tv/5.8.6/css/mescroll/mescroll.min.css
ani####.d####.tv/5.8.6/css/public.css
ani####.d####.tv/5.8.6/css/swiper/swiper.min.css
ani####.d####.tv/5.8.6/css/videoDemand.css
ani####.d####.tv/5.8.6/css/videojs.min.css
ani####.d####.tv/5.8.6/fonts/iconfont.ttf?t=####
ani####.d####.tv/5.8.6/html/index/index_ColumnList.html?c_type=####
ani####.d####.tv/5.8.6/html/video/video_Demand_detail.html?type=####&com...
ani####.d####.tv/5.8.6/images/ClipboardImage.gif
ani####.d####.tv/5.8.6/images/banner_v3.jpg
ani####.d####.tv/5.8.6/images/lloading.gif
ani####.d####.tv/5.8.6/images/loading.gif
ani####.d####.tv/5.8.6/images/video_loading.gif
ani####.d####.tv/5.8.6/js/fastclick.js
ani####.d####.tv/5.8.6/js/iconfont.js
ani####.d####.tv/5.8.6/js/jquery.base64.js
ani####.d####.tv/5.8.6/js/jquery.md5.js
ani####.d####.tv/5.8.6/js/jquery.min.js
ani####.d####.tv/5.8.6/js/mescroll/mescroll-option.js
ani####.d####.tv/5.8.6/js/mescroll/mescroll.min.js
ani####.d####.tv/5.8.6/js/public.js
ani####.d####.tv/5.8.6/js/video.min.js
ani####.d####.tv/5.8.6/template/index/style.IndexColumnList.js
ani####.d####.tv/5.8.6/template/index/tpl.IndexColumnList.js
ani####.d####.tv/5.8.6/template/pub.ColLabel.js
ani####.d####.tv/5.8.6/template/tpl.Video_DemandDetail.js
ani####.d####.tv/aniuapi/api/v2/ad/getadforapp?channelid=####&clientid=#...
ani####.d####.tv/aniuapi/api/v2/ad/getadvertisement.html?id=####
ani####.d####.tv/aniuapi/api/v2/aniuChannelUserDialog/doDialog?page=####...
ani####.d####.tv/aniuapi/api/v2/comment/appQuery?channelid=####&clientid...
ani####.d####.tv/aniuapi/api/v2/transcript/query?channelid=####&clientid...
ani####.d####.tv/favicon.ico
cdn-sdk####.g####.com.####.com/tdata_EDB102
cdn-sdk####.g####.com.####.com/tdata_SIq813
cdn-sdk####.g####.com.####.com/tdata_xEA084
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?status_os=####&stat...
cm13-cc####.p####.bo####.####.com/flvs/7CEFDE16F4DC35B6/2019-10-14/7EF3B...
cm13-cc####.p####.bo####.####.com/flvs/7CEFDE16F4DC35B6/2019-11-22/703A2...
njd####.d####.tv:8083/aniuapi/api/v2/video/getccplayurl?callback=####&ch...
njdx####.d####.tv/aniuapi/api/v2/ad/appconfig?devid=####&clienttype=####...
njdx####.d####.tv/aniuapi/api/v2/menumanager/gethasmenu?platform=####&de...
njdx####.d####.tv/aniuapi/api/v2/video/getvodlist?labelid=####&psize=###...
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_LRe817
sdk.o####.p####.####.com/api/addr.htm

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
appact####.d####.tv:8081/addAniuApp
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/1002
/data/data/####/1004
/data/data/####/1426fb1d2ae21a89_0
/data/data/####/18ff8590-71c8-4708-b1fb-f7e1de6fcdda
/data/data/####/1a486800ef78f289_0
/data/data/####/1c7ceac37a3443af_0
/data/data/####/1dd0228e2e0d531b_0
/data/data/####/232d5db5c872ad91276a60f9c54c6fe1.0.tmp
/data/data/####/232d5db5c872ad91276a60f9c54c6fe1.1.tmp
/data/data/####/236dc6aa3399184a_0
/data/data/####/23b7bd75b2322053049a38ae20c50bf5.0.tmp
/data/data/####/23b7bd75b2322053049a38ae20c50bf5.1.tmp (deleted)
/data/data/####/253238eb007352d6_0
/data/data/####/25ecde42fd502e81873dc0ff4309449b.0
/data/data/####/25ecde42fd502e81873dc0ff4309449b.1
/data/data/####/2d63c44fbcd10056_0
/data/data/####/2f5c9479a05c1f9c_0
/data/data/####/3baeaa30e3bc85c4_0
/data/data/####/3baeaa30e3bc85c4_1
/data/data/####/3c818bcac8452425_0
/data/data/####/3c818bcac8452425_1
/data/data/####/419ff4b5e849276f_0
/data/data/####/419ff4b5e849276f_1
/data/data/####/4432d535294eec9923baf9b45b0e314a.0
/data/data/####/4432d535294eec9923baf9b45b0e314a.1
/data/data/####/45dda39c700ca8b6_0
/data/data/####/466b9ee9b4cdd666_0
/data/data/####/4bd5d7bbd99c337b_0
/data/data/####/4bd5d7bbd99c337b_1
/data/data/####/5238503fe97d3eb5_0
/data/data/####/52a5a41146aa6c77_0
/data/data/####/52a5a41146aa6c77_1
/data/data/####/5472b67efba03418_0
/data/data/####/5510a4e8a6e54bde_0
/data/data/####/57579599
/data/data/####/5bacdfbc-1049-479c-9683-25c0d20b50f2
/data/data/####/5cc78265c0fb33a1_0
/data/data/####/5cc78265c0fb33a1_1
/data/data/####/5dda445a6331977d_0
/data/data/####/5dda445a6331977d_1
/data/data/####/602f88a9bddb657f_0 (deleted)
/data/data/####/6108ef679820e31c_0
/data/data/####/6601de44-8e46-4a5e-b973-0201506b8c38
/data/data/####/6a0303079577200d_0
/data/data/####/6a0303079577200d_1
/data/data/####/6bed52911b2c6ef6_0
/data/data/####/6f796fe353b9585d_0
/data/data/####/74400bb4c6c3c39d_0
/data/data/####/76b91e136b68164f_0
/data/data/####/76edefbdfe87e9af_0
/data/data/####/7811e35b8a9ff40f_0
/data/data/####/7f848d74afb15fd4_0
/data/data/####/876a3c2aba24cff5_0
/data/data/####/90888c9e-02c7-4dce-98ad-46ad33381819
/data/data/####/90888c9e-02c7-4dce-98ad-46ad33381819 (deleted)
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/Cookies-journal
/data/data/####/IpInfos.xml
/data/data/####/IpInfos.xml.bak
/data/data/####/Push_Page_Config.xml
/data/data/####/VERIFY_SP.xml
/data/data/####/VERIFY_SP.xml.bak
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak
/data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak (deleted)
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__local_stat_full_cache.json
/data/data/####/__send_data_1575987727740
/data/data/####/a411026061d81da2_0
/data/data/####/a411026061d81da2_1
/data/data/####/a55fea85-b587-478f-95a2-a1ed7de62c20
/data/data/####/a8068ea094f1
/data/data/####/a984397f-bf3f-449a-a959-4279e793c3b6
/data/data/####/aa016a6c-4293-4666-917b-b18a4c7bf0b1
/data/data/####/b4064fb33dbb8d6f_0
/data/data/####/b4064fb33dbb8d6f_s
/data/data/####/b5e4733e09096611_0
/data/data/####/b9e3b4a6924dd465_0
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/bal.catch
/data/data/####/bc9d10fdd7565de1_0
/data/data/####/bd4e5a049d324037_0
/data/data/####/bugly_db_-journal
/data/data/####/bwc.catch
/data/data/####/c304e4f4de9a6c09d176f8ffcebaf946117920142964226...de06.0
/data/data/####/cdef824d-4d14-4d37-b2f2-4284890da24a
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/cn.jiguang.common.xml
/data/data/####/cn.jiguang.common.xml.bak
/data/data/####/cn.jiguang.jverify.xml
/data/data/####/cn.jiguang.sdk.address.xml
/data/data/####/cn.jiguang.sdk.user.profile.xml
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.tencent.open.config.json.101081844
/data/data/####/comment.db
/data/data/####/comment.db-journal
/data/data/####/content.db
/data/data/####/content.db-journal
/data/data/####/crashrecord.xml
/data/data/####/d0bca31963602f3d_0
/data/data/####/d0bca31963602f3d_1
/data/data/####/d5f3aa9c98f2e7e9_0
/data/data/####/d6464608012539f20016a375488bdd0c.0
/data/data/####/d6464608012539f20016a375488bdd0c.1
/data/data/####/dfcb0d22fc21a2d6_0
/data/data/####/dzcj.xml
/data/data/####/e0a8406e5edb0c06_0
/data/data/####/e0a8406e5edb0c06_1
/data/data/####/e294fde8-79e9-4590-ade7-87a1c39d977c
/data/data/####/e858ff72be469294_0
/data/data/####/ea7584dd63c78ed5_0
/data/data/####/f7b535b2e4bfd0ce_0
/data/data/####/f8d6ee06a67b08e5_0
/data/data/####/f8d6ee06a67b08e5_1
/data/data/####/fa8a1f0890453968_0
/data/data/####/fe49b61ff44876fe_0
/data/data/####/fe49b61ff44876fe_1
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/http_dzcjapp.aniu.tv_0.localstorage-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/liveAd_data
/data/data/####/local_crash_lock
/data/data/####/metrics_guid
/data/data/####/mtj_autoTracker.js
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/preload_ad
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/push_stat_cache.json
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/rl.catch
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_SIq813
/data/data/####/tdata_SIq813.dex
/data/data/####/tdata_SIq813.dex.flock (deleted)
/data/data/####/tdata_SIq813.jar
/data/data/####/tdata_xEA084
/data/data/####/tdata_xEA084.dex.flock (deleted)
/data/data/####/tdata_xEA084.jar
/data/data/####/the-real-index
/data/data/####/tj.db-journal
/data/data/####/trace_circle.data
/data/data/####/tv.aniu.app.dzlc.BETA_VALUES.xml
/data/data/####/tv.aniu.app.dzlc_preferences.xml
/data/data/####/weibo_sdk_aid1
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_SIq813.jar --oat-fd=74 --oat-location=/data/user/0/<Package>/files/tdata_SIq813.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_xEA084.jar --oat-fd=70 --oat-location=/data/user/0/<Package>/files/tdata_xEA084.dex --compiler-filter=speed
cat /proc/uid_stat/10065/tcp_rcv
cat /proc/uid_stat/10065/tcp_snd
cat /sys/class/net/wlan0/address
getprop
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
mount
ps
sh

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней