Adware.Gexin.19150

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) o####.c5####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) i.c5####.com:443
TCP(TLS/1.0) 2####.58.211.106:443
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.2) 2####.58.211.106:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5226
TCP cm-1####.ig####.com:5227
TCP cm-1####.ig####.com:5225

Запросы DNS:

and####.google####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.ig####.com
cm-1####.ig####.com
cm-1####.ig####.com
i.c5####.com
instant####.google####.com
o####.c5####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

Запросы HTTP GET:

cdn-sdk####.g####.com.####.com/tdata_CoH340
cdn-sdk####.g####.com.####.com/tdata_EDB102
cdn-sdk####.g####.com.####.com/tdata_JmH262
cdn-sdk####.g####.com.####.com/tdata_pKX830
q####.c####.l####.####.com/config/hz-hzv6.conf
sdk.o####.p####.####.com/api/addr.htm

Запросы HTTP POST:

c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/1d8f6a244df071d629c572f60414177e228c582d0594c9a....0.tmp
/data/data/####/7f9cceaaca1fcf18ed39aa2cec3cae38d26f7d8d0a3242f....0.tmp
/data/data/####/9faab86b5101d8439dd92447257a18dff0aa661b183bc86....0.tmp
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a6e3aec272e5e8ee0f744ef7fccd0d0f848814767cfecca....0.tmp
/data/data/####/aa8053a174c4
/data/data/####/c0c4feff53b4f5d9c8f812f49febfe396630913c00e3ddf....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/com.imbastar.c5game_preferences.xml
/data/data/####/config.xml
/data/data/####/e7b72a13
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu.so
/data/data/####/metrics_guid
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/tdata_CoH340
/data/data/####/tdata_CoH340.dex.flock (deleted)
/data/data/####/tdata_CoH340.jar
/data/data/####/tdata_JmH262
/data/data/####/tdata_JmH262.dex
/data/data/####/tdata_JmH262.dex.flock (deleted)
/data/data/####/tdata_JmH262.jar
/data/data/####/tdata_pKX830
/data/data/####/tdata_pKX830.dex
/data/data/####/tdata_pKX830.dex.flock (deleted)
/data/data/####/tdata_pKX830.jar
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_cache_1576420360974.env
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_CoH340.jar --oat-fd=61 --oat-location=/data/user/0/<Package>/files/tdata_CoH340.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_JmH262.jar --oat-fd=53 --oat-location=/data/user/0/<Package>/files/tdata_JmH262.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_pKX830.jar --oat-fd=52 --oat-location=/data/user/0/<Package>/files/tdata_pKX830.dex --compiler-filter=speed
cat /proc/uid_stat/10065/tcp_rcv
cat /proc/uid_stat/10065/tcp_snd
cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
mount
sh