Adware.Gexin.19694

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) 1####.192.110.203:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) ping####.qq.com:80
TCP(HTTP/1.1) t####.qq.com:80
TCP(HTTP/1.1) n####.co####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) pan.b####.com:80
TCP(HTTP/1.1) sc-we####.co####.com:80
TCP(TLS/1.0) t####.qq.com:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5224

Запросы DNS:

c####.mm####.com
c-h####.g####.com
c.c####.com
cdn-sdk####.g####.com
cm-1####.ig####.com
i####.c####.com
n####.co####.com
pan.b####.com
pco####.c####.com
ping####.qq.com
s11.c####.com
sc-we####.co####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
t####.qq.com
z13.c####.com

Запросы HTTP GET:

c.c####.com/core.php?web_id=####&show=####&t=####
c.c####.com/img/pic.gif
c.c####.com/stat.php?id=####&show=####
cdn-sdk####.g####.com.####.com/tdata_CoH340
cdn-sdk####.g####.com.####.com/tdata_EDB102
cdn-sdk####.g####.com.####.com/tdata_JmH262
cdn-sdk####.g####.com.####.com/tdata_pKX830
gm.mm####.com/9.gif?abc=####&rnd=####
n####.co####.com/
n####.co####.com/data/js/0.js
n####.co####.com/images/defaultpic.gif
n####.co####.com/news/caijing/
n####.co####.com/news/caijing/110129222018.html
n####.co####.com/news/dongtai/
n####.co####.com/news/dongtai/0221292H019.html
n####.co####.com/news/dongtai/0I029122018.html
n####.co####.com/templets/webenh/css/font_1433401008_2229297.ttf
n####.co####.com/templets/webenh/css/sm.min.css
n####.co####.com/templets/webenh/css/style.v1.8.css
n####.co####.com/templets/webenh/images/bg_pen.png
n####.co####.com/templets/webenh/images/share/qq-chat.png
n####.co####.com/templets/webenh/images/share/share-more.png
n####.co####.com/templets/webenh/images/share/wx-chat.png
n####.co####.com/templets/webenh/images/share/wx-collect.png
n####.co####.com/templets/webenh/images/share/wx-moments.png
n####.co####.com/templets/webenh/js/backfunction_replace.js
n####.co####.com/templets/webenh/js/comment.v1.2.js
n####.co####.com/templets/webenh/js/jquery.js
n####.co####.com/templets/webenh/js/share.v1.18.js
n####.co####.com/templets/webenh/js/sm.js
n####.co####.com/templets/webenh/js/swiper.js
n####.co####.com/templets/webenh/js/zepto.js
n####.co####.com/uploads/180907/11-1PZG03525311.png
n####.co####.com/uploads/180917/11-1P91GAIB11.jpg
n####.co####.com/uploads/allimg/170628/1F054B04-0-lp.jpg
n####.co####.com/uploads/allimg/170628/1F41955W-0-lp.jpg
n####.co####.com/uploads/allimg/170628/1F5502393-0-lp.jpg
n####.co####.com/uploads/allimg/170628/1F6325O2-0-lp.png
n####.co####.com/uploads/allimg/170703/1556454196-0-lp.png
n####.co####.com/uploads/allimg/170815/16291JE9-0-lp.png
n####.co####.com/uploads/allimg/171115/160H11W3-0-lp.png
n####.co####.com/uploads/allimg/171206/1I03LO5-0-lp.png
n####.co####.com/uploads/allimg/171228/1419313147-0-lp.png
n####.co####.com/uploads/allimg/171230/145S413T-0-lp.png
n####.co####.com/uploads/allimg/180110/1010121G1-0-lp.png
n####.co####.com/uploads/allimg/180111/1143343M5-0-lp.png
n####.co####.com/uploads/allimg/180407/095045D60-0-lp.png
n####.co####.com/uploads/allimg/180427/1619191632-0-lp.png
n####.co####.com/uploads/allimg/180427/1619391419-0-lp.png
n####.co####.com/uploads/allimg/180427/161Q33318-0-lp.png
n####.co####.com/uploads/allimg/180427/1620034636-0-lp.png
n####.co####.com/uploads/allimg/180427/162231L92-0-lp.png
n####.co####.com/uploads/allimg/180427/1623146009-0-lp.png
n####.co####.com/uploads/allimg/180427/1630421632-0-lp.png
n####.co####.com/uploads/allimg/180427/16332MV1-0-lp.png
n####.co####.com/uploads/allimg/180427/16334633E-0-lp.png
n####.co####.com/uploads/allimg/180427/1634122E3-0-lp.jpg
n####.co####.com/uploads/allimg/180514/162K161V-0-lp.png
n####.co####.com/uploads/allimg/180529/0959333315-0-lp.jpg
n####.co####.com/uploads/allimg/180529/09595a1M-0-lp.png
n####.co####.com/uploads/allimg/180529/095I06013-0-lp.png
n####.co####.com/uploads/allimg/180529/095K04623-0-lp.png
n####.co####.com/uploads/allimg/180529/10005120P-0-lp.png
n####.co####.com/uploads/allimg/180529/1002513929-0-lp.png
n####.co####.com/uploads/allimg/180529/1003243b9-0-lp.png
n####.co####.com/uploads/allimg/180607/16454RB2-0-lp.png
n####.co####.com/uploads/allimg/180625/09102A3C-0-lp.png
n####.co####.com/uploads/allimg/180625/0Z9343a6-0-lp.png
n####.co####.com/uploads/allimg/180625/0ZQG040-0-lp.png
n####.co####.com/uploads/allimg/180629/1F1215X3-0-lp.png
n####.co####.com/uploads/allimg/180629/1F155LW-0-lp.png
n####.co####.com/uploads/allimg/180629/1F2193623-0-lp.png
n####.co####.com/uploads/allimg/180629/1F24532D-0-lp.png
n####.co####.com/uploads/allimg/180629/1F3103054-0-lp.png
n####.co####.com/uploads/allimg/180629/1F342MA-0-lp.png
n####.co####.com/uploads/allimg/180712/14315940U-0-lp.png
n####.co####.com/uploads/allimg/180730/1130222529-1.jpg
n####.co####.com/uploads/allimg/180730/1130223037-0-lp.jpg
n####.co####.com/uploads/allimg/180730/1130223037-0.jpg
n####.co####.com/uploads/allimg/180730/113022KB-2.jpg
n####.co####.com/uploads/allimg/180825/1044164233-0-lp.png
n####.co####.com/uploads/allimg/180825/104J640B-0-lp.jpg
n####.co####.com/uploads/allimg/180829/11-1PRZT6350-L.png
n####.co####.com/uploads/allimg/180903/1625463C4-0-lp.png
n####.co####.com/uploads/allimg/180903/16321QB5-0-lp.png
n####.co####.com/uploads/allimg/181013/15120L5G-0-lp.png
n####.co####.com/uploads/allimg/181026/11-1Q0261J3380-L.png
n####.co####.com/uploads/allimg/181101/11-1Q1011I2580-L.jpg
n####.co####.com/uploads/allimg/181101/1I3214R3-0.jpg
n####.co####.com/uploads/allimg/181122/11-1Q1221J6270-L.png
n####.co####.com/uploads/allimg/181224/102314I61-0-lp.png
n####.co####.com/uploads/allimg/190108/11-1Z10Q621590-L.png
n####.co####.com/uploads/allimg/190221/11-1Z2211443470-L.png
n####.co####.com/uploads/allimg/190221/1446211055-13.png
n####.co####.com/uploads/allimg/190221/14462110J-4.png
n####.co####.com/uploads/allimg/190221/1446212147-10.png
n####.co####.com/uploads/allimg/190221/1446212319-15.png
n####.co####.com/uploads/allimg/190221/1446212491-6.png
n####.co####.com/uploads/allimg/190221/1446212934-8.png
n####.co####.com/uploads/allimg/190221/14462132c-14.png
n####.co####.com/uploads/allimg/190221/14462134V-11.png
n####.co####.com/uploads/allimg/190221/1446214555-12.png
n####.co####.com/uploads/allimg/190221/1446214640-9.png
n####.co####.com/uploads/allimg/190221/1446214M5-2.png
n####.co####.com/uploads/allimg/190221/14462152G-16.png
n####.co####.com/uploads/allimg/190221/1446215C3-5.png
n####.co####.com/uploads/allimg/190221/1446215K8-1.png
n####.co####.com/uploads/allimg/190221/1446215O3-7.png
n####.co####.com/uploads/allimg/190221/144621N26-3.png
n####.co####.com/uploads/allimg/190221/144621N54-0.png
pan.b####.com/share/qrcode?w=####&h=####&url=####
pco####.ta####.com/app.gif?&cna=####
ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=####...
q####.c####.l####.####.com/config/hz-hzv6.conf
sdk.o####.p####.####.com/api/addr.htm
t####.qq.com/ping_hotclick_min.js
t####.qq.com/stats?sId=####
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

Запросы HTTP POST:

c-h####.g####.com/api.php?format=####&t=####
sc-we####.co####.com/api/Cms/GetComments?aid=####
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/ApplicationCache.db-journal
/data/data/####/H51E72B37.xml
/data/data/####/act.html
/data/data/####/ad_show_time.xml
/data/data/####/add.jpg
/data/data/####/alipay.png
/data/data/####/arr.png
/data/data/####/back.png
/data/data/####/bignumber.js
/data/data/####/ca.html
/data/data/####/cas.js
/data/data/####/cashier.html
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/city.data-3.js
/data/data/####/ckea.png
/data/data/####/ckeao.png
/data/data/####/ckecks.png
/data/data/####/cla.jpg
/data/data/####/clb.jpg
/data/data/####/clc.jpg
/data/data/####/cld.jpg
/data/data/####/cle.jpg
/data/data/####/clf.jpg
/data/data/####/clg.jpg
/data/data/####/clh.jpg
/data/data/####/cli.jpg
/data/data/####/clientid_igexin.xml
/data/data/####/clj.jpg
/data/data/####/clk.jpg
/data/data/####/cll.jpg
/data/data/####/clm.jpg
/data/data/####/cln.jpg
/data/data/####/clo.jpg
/data/data/####/close.png
/data/data/####/clp.jpg
/data/data/####/clq.jpg
/data/data/####/clr.jpg
/data/data/####/cls.jpg
/data/data/####/clt.jpg
/data/data/####/comp.html
/data/data/####/consola.ttf
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/det.png
/data/data/####/df0849dc8bd8
/data/data/####/dj.png
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/f_00003e
/data/data/####/f_00003f
/data/data/####/f_000040
/data/data/####/f_000041
/data/data/####/f_000042
/data/data/####/f_000043
/data/data/####/f_000044
/data/data/####/f_000045
/data/data/####/f_000046
/data/data/####/f_000047
/data/data/####/f_000048
/data/data/####/f_000049
/data/data/####/f_00004a
/data/data/####/f_00004b
/data/data/####/f_00004c
/data/data/####/f_00004d
/data/data/####/f_00004e
/data/data/####/f_00004f
/data/data/####/f_000050
/data/data/####/f_000051
/data/data/####/f_000052
/data/data/####/f_000053
/data/data/####/f_000054
/data/data/####/file__0.localstorage-journal
/data/data/####/fpy.png
/data/data/####/fqq.png
/data/data/####/fwx.png
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/ina.png
/data/data/####/inb.png
/data/data/####/inc.png
/data/data/####/inca.css
/data/data/####/ind.png
/data/data/####/index
/data/data/####/index.html
/data/data/####/ine.png
/data/data/####/inf.png
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/ka.html
/data/data/####/kb.html
/data/data/####/kc.html
/data/data/####/kd.html
/data/data/####/ke.html
/data/data/####/kf.html
/data/data/####/kg.html
/data/data/####/kh.html
/data/data/####/ki.html
/data/data/####/libjiagu.so
/data/data/####/line.png
/data/data/####/login.html
/data/data/####/logo.png
/data/data/####/manifest.json
/data/data/####/mea.png
/data/data/####/meb.png
/data/data/####/mec.png
/data/data/####/med.png
/data/data/####/mee.png
/data/data/####/mef.png
/data/data/####/meg.png
/data/data/####/mem.html
/data/data/####/mess.html
/data/data/####/mui.min.js
/data/data/####/mui.picker.all.css
/data/data/####/mui.picker.min.js
/data/data/####/mui.poppicker.js
/data/data/####/mui.previewimage.js
/data/data/####/mui.zoom.js
/data/data/####/notice.js
/data/data/####/pdr.xml
/data/data/####/photoswipe-ui-default.min.js
/data/data/####/photoswipe.css
/data/data/####/photoswipe.min.js
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qzmoo.js
/data/data/####/rad.png
/data/data/####/rado.png
/data/data/####/ref.png
/data/data/####/run.pid
/data/data/####/score.html
/data/data/####/scorea.html
/data/data/####/scoreb.html
/data/data/####/set.html
/data/data/####/sli.png
/data/data/####/stream_permission.xml
/data/data/####/style.css
/data/data/####/tadd.png
/data/data/####/tadda.png
/data/data/####/tdata_CoH340
/data/data/####/tdata_CoH340.jar
/data/data/####/tdata_JmH262
/data/data/####/tdata_JmH262.jar
/data/data/####/tdata_pKX830
/data/data/####/tdata_pKX830.jar
/data/data/####/tipa.png
/data/data/####/tipb.png
/data/data/####/tipc.png
/data/data/####/tipd.png
/data/data/####/tipq.png
/data/data/####/umeng_general_config.xml
/data/data/####/user.png
/data/data/####/utap.png
/data/data/####/video1.png
/data/data/####/vip.html
/data/data/####/vip.png
/data/data/####/wba.png
/data/data/####/wbb.png
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/weixin.png
/data/data/####/zoom.css
/data/media/####/app.db
/data/media/####/com.cost88.H51E72B37.bin
/data/media/####/com.cost88.H51E72B37.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/tdata_CoH340
/data/media/####/tdata_JmH262
/data/media/####/tdata_pKX830
/data/media/####/temp.arm
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
<Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24484 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24484 300 0

Загружает динамические библиотеки:

getuiext2
libjiagu

Использует следующие алгоритмы для шифрования данных:

AES-CFB-NoPadding
RSA
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней