Adware.Gexin.20386

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) dcs.co####.com:80
TCP(HTTP/1.1) b####.co####.com:80
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) loc.map.b####.com:443
TCP(TLS/1.0) bp####.co####.com:443
TCP(TLS/1.0) aa.top####.com:443
TCP(TLS/1.0) o####.map.b####.com:443
TCP(TLS/1.0) aa.birdg####.com:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) dd.top####.com:443
TCP(TLS/1.0) pang####.sn####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.217.168.206:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 2####.58.214.3:443

Запросы DNS:

aa.birdg####.com
aa.top####.com
and####.b####.qq.com
and####.google####.com
android####.go####.com
api.map.b####.com
b####.co####.com
bp####.co####.com
dcs.co####.com
dd.top####.com
dig.b####.net
fp.fraudme####.cn
instant####.google####.com
l####.tbs.qq.com
loc.map.b####.com
md####.google####.com
o####.map.b####.com
p####.google####.com
pang####.sn####.com
sf3-ttc####.ps####.com
to####.ctobsn####.com

Запросы HTTP GET:

dcs.co####.com/data/config/Android.conf
dcs.co####.com/ip

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
b####.co####.com/ap-gateway/ap/getConfig
dcs.co####.com/data/v1?project=####
l####.tbs.qq.com/ajax?c=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.cl
/data/data/####/.jg.ic
/data/data/####/.jg.store.report_cf
/data/data/####/.td-3
/data/data/####/1004
/data/data/####/A3AEECD8.dex
/data/data/####/A3AEECD8.dex.flock (deleted)
/data/data/####/anythink.db-journal
/data/data/####/anythink_agent_log
/data/data/####/anythink_placement_strategy_update_check.xml
/data/data/####/anythink_sdk.xml
/data/data/####/anythink_sdk.xml.bak
/data/data/####/authStatus_com.yaotian.ddnc;remote.xml
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bugly_db_-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/com.yaotian.ddnc_preferences.xml
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/firll.dat
/data/data/####/fm_shared.xml
/data/data/####/gal.db
/data/data/####/gal.db-journal
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/libcuid_v3.so
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/native_record_lock
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/proc_auxv
/data/data/####/security_info
/data/data/####/sensorsdata-journal
/data/data/####/sensorsdata.xml
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_push_time.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_config.xml.bak (deleted)
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tramini.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/update.xml
/data/media/####/.td-3
/data/media/####/.tdck
/data/media/####/4d29639a37e58723b0741a323c76858e.tmp
/data/media/####/clientudid.dat
/data/media/####/conlts.dat
/data/media/####/da48d872719fbc49bcfb42e7596c9f0c.tmp
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/tbslog.txt
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.00000000000/A3AEECD8.dex --oat-fd=41 --oat-location=/data/user/0/<Package>/.11111111111/A3AEECD8.dex --compiler-filter=speed
df
getprop
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.sv.version
getprop ro.lenovo.lvp.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.version
grep /sbin/.magisk
grep com.android.commands.monkey
grep magisk
id
ls /sbin
mount
ps
sh -c df | grep /sbin/.magisk
sh -c mount | grep /sbin/.magisk
sh -c ls /sbin | grep magisk
sh -c ps | grep magisk
sh -c ps|grep com.android.commands.monkey