Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) and####.cl####.yanqing####.com:80
- TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP sdk.o####.t####.####.com:5224
- TCP cm-1####.g####.com:5225
Запросы DNS:
- and####.cl####.yanqing####.com
- c-h####.g####.com
- cdn-sdk####.g####.com
- cm-1####.g####.com
- i####.yanqing####.com
- log.u####.com
- mt####.go####.com
- sdk-ope####.g####.com
- sdk.c####.g####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
Запросы HTTP GET:
- and####.cl####.yanqing####.com//Bookajax/getUserMsgNum.do?&version=####&...
- and####.cl####.yanqing####.com/bookface/0/1/143_large.jpg
- and####.cl####.yanqing####.com/bookface/0/24/2428_large.jpg
- and####.cl####.yanqing####.com/bookface/0/25/2578_large.jpg
- and####.cl####.yanqing####.com/bookface/0/31/3168_large.jpg
- and####.cl####.yanqing####.com/bookface/0/32/3222_large.jpg
- and####.cl####.yanqing####.com/bookface/0/33/3396_large.jpg
- and####.cl####.yanqing####.com/bookface/0/46/4636_large.jpg
- and####.cl####.yanqing####.com/bookface/0/58/5863_large.jpg
- and####.cl####.yanqing####.com/bookface/0/60/6041_large.jpg
- and####.cl####.yanqing####.com/bookface/0/61/6125_large.jpg
- and####.cl####.yanqing####.com/bookface/0/67/6715_large.jpg
- and####.cl####.yanqing####.com/bookface/0/67/6737_large.jpg
- and####.cl####.yanqing####.com/bookface/0/67/6758_large.jpg
- and####.cl####.yanqing####.com/bookface/0/68/6803_large.jpg
- and####.cl####.yanqing####.com/bookface/0/68/6839_large.jpg
- and####.cl####.yanqing####.com/bookface/0/69/6979_large.jpg
- and####.cl####.yanqing####.com/bookface/0/69/6980_large.jpg
- and####.cl####.yanqing####.com/bookface/0/71/7121_large.jpg
- and####.cl####.yanqing####.com/bookface/0/74/7464_large.jpg
- and####.cl####.yanqing####.com/bookface/0/74/7488_large.jpg
- and####.cl####.yanqing####.com/bookface/0/74/7496_large.jpg
- and####.cl####.yanqing####.com/bookface/0/76/7629_large.jpg
- and####.cl####.yanqing####.com/bookface/0/76/7638_large.jpg
- and####.cl####.yanqing####.com/bookface/0/77/7711_large.jpg
- and####.cl####.yanqing####.com/bookface/0/78/7858_large.jpg
- and####.cl####.yanqing####.com/bookface/0/78/7859_large.jpg
- and####.cl####.yanqing####.com/bookface/0/78/7865_large.jpg
- and####.cl####.yanqing####.com/bookface/0/78/7879_large.jpg
- and####.cl####.yanqing####.com/bookface/0/78/7890_large.jpg
- and####.cl####.yanqing####.com/bookface/0/79/7928_large.jpg
- and####.cl####.yanqing####.com/img/bangdan/20190626.baonian.540.jpg
- and####.cl####.yanqing####.com/img/bangdan/20200724.6950.540.jpg
- and####.cl####.yanqing####.com/img/bangdan/20200724.free.540.jpg
- and####.cl####.yanqing####.com/img/bangdan/20200724.shudan.540.jpg
- and####.cl####.yanqing####.com/upload/190819144301_5d5a44f5651f3.gif
- cdn-sdk####.g####.com.####.com/tdata_cpZ817
- cdn-sdk####.g####.com.####.com/tdata_hlV706
- cdn-sdk####.g####.com.####.com/tdata_lbt428
- d####.c####.l####.####.com/config/hzv9.conf
- et2-na6####.wagbr####.ali####.####.com/bar/get/5982befd7f2c741f3a001470/...
- sdk.o####.p####.####.com/api/addr.htm
Запросы HTTP POST:
- and####.cl####.yanqing####.com//ajax/getpopup.do?&version=####&P27=####&...
- and####.cl####.yanqing####.com//ajax/getpopupconfig.do?&version=####&P27...
- and####.cl####.yanqing####.com//listmodules?pageconfig=####&version=####...
- and####.cl####.yanqing####.com/Bookajax/getversion.do?&P27=####&P30=####...
- and####.cl####.yanqing####.com/Pushajax/addUserBehavior?&version=####&P2...
- and####.cl####.yanqing####.com/Pushajax/bindDevice?sex_flag=####&version...
- and####.cl####.yanqing####.com/clientbanner?version=####&P27=####&P30=##...
- c-h####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/03678d8aefec1740e593158be930a4a8fa075328df7c18c....0.tmp
- /data/data/####/176de83c631b11c523754294488a3ccfd71fb7bd6f7941c....0.tmp
- /data/data/####/19981e31950e67e46724fa2d2f79cfbc1dc4763cc9d37f0....0.tmp
- /data/data/####/1a8e89fe9af9fd99bafb6c86e17de3f58a1cfad1164b839....0.tmp
- /data/data/####/275378afcde48d06aa83949fc1d4b46477df30ecaf214e0....0.tmp
- /data/data/####/2e8737c79599d80e3b24f5c0ef3afedc0e082ffe4e9bd2b....0.tmp
- /data/data/####/3460e7117f548a41e1c34f19e9590652c954b5d424b676e....0.tmp
- /data/data/####/38c109f15a5f19aaca0fb07276a211e5c25476b6764bd0f....0.tmp
- /data/data/####/44b19b859677fff0331197bab2a717f29b1c7a077cb0b0d....0.tmp
- /data/data/####/6c8c0aa18aa9bb42ec3f8e6aa3e89d2cd3ee40ebf59cb7a....0.tmp
- /data/data/####/7687f325f1e3c56556adbe654317ae57afdde6f60134820....0.tmp
- /data/data/####/7e92f747345ea5a871805c1c883e1a377abbbc622b220ff....0.tmp
- /data/data/####/850c97d2959bf6bcddd282416e711ea1c635edceda325ad....0.tmp
- /data/data/####/86bfad8c3c815498d3a5a341e3c27efd4539afd25a46d96....0.tmp
- /data/data/####/8be6ed6eb5bed792c226f7d07538bf255f951b97a8d7ea3....0.tmp
- /data/data/####/8c2fe463d7cd998a987d13beff22814644799aa5991c2ae....0.tmp
- /data/data/####/8fc86139559479d6c6714023536edf0f9656741b2df35e8....0.tmp
- /data/data/####/9d6855aac029e80396843ff0de2d6cccc6964aad5cd9c7f....0.tmp
- /data/data/####/MiscDATA.xml
- /data/data/####/ReadSetting.xml
- /data/data/####/a852f80dedd2b467affb299bc10cbc75cd283b30bf2707a....0.tmp
- /data/data/####/b5d6d19fbd93273d2a8bdb34309c99548bb761a4af7f115....0.tmp
- /data/data/####/ba824760bf4a9f9409eaa462593d7392e77c7a325883af9....0.tmp
- /data/data/####/bcdd581e8e4fa186c1f3d4b3680887dd7664b768cde7a97....0.tmp
- /data/data/####/bd28213d07c9cf3ba5073b41e26398510b7533e7cf15571....0.tmp
- /data/data/####/c270557958c09bad504dde28fba2f18a63b0a60a6be762e....0.tmp
- /data/data/####/cd32225c81f284a5cf618cf91589af437cbe1069bb923d4....0.tmp
- /data/data/####/cee853376b3a0d331ee7b789e70aafc82b29b25c3dcfc0a....0.tmp
- /data/data/####/core_info
- /data/data/####/d08a9cbee6bfde3e582bc3680927459e9781115a2995718....0.tmp
- /data/data/####/d1886aa64588283e1843f25241f2db034a4a56312f602f7....0.tmp
- /data/data/####/d25a0e5e6dc993064f9cbec9770960b913b2c639dbd5a4f....0.tmp
- /data/data/####/d72a2b0c443c39e714651910a39c20881ee37fcf106528f....0.tmp
- /data/data/####/dfc97bb145b135d957aa2deb32b1ce9d6d61656025407cb....0.tmp
- /data/data/####/dfe3ff48f878bd91fccb26fe2aa7b9fb82047a762b71b29....0.tmp
- /data/data/####/f8e865922db108fac28e9f0c7e52bf5b82baa12b8d9d786....0.tmp
- /data/data/####/fecf0f04e8aff2ffd259fe7cb230577b90c3ff390ec667f....0.tmp
- /data/data/####/fistInstall.xml
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/hong.db
- /data/data/####/hong.db-journal
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu1631306394.so
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/run.pid
- /data/data/####/tdata_cpZ817
- /data/data/####/tdata_cpZ817.jar
- /data/data/####/tdata_hlV706
- /data/data/####/tdata_hlV706.jar
- /data/data/####/tdata_lbt428
- /data/data/####/tdata_lbt428.jar
- /data/data/####/umeng_socialize.xml
- /data/media/####/.nomedia
- /data/media/####/1090005.sht
- /data/media/####/1090006.sht
- /data/media/####/1134735.sht
- /data/media/####/1134736.sht
- /data/media/####/1136228.sht
- /data/media/####/1138679.sht
- /data/media/####/1139126.sht
- /data/media/####/1139170.sht
- /data/media/####/1139282.sht
- /data/media/####/1139379.sht
- /data/media/####/1170693.sht
- /data/media/####/1170695.sht
- /data/media/####/1170697.sht
- /data/media/####/1170699.sht
- /data/media/####/1170701.sht
- /data/media/####/1170702.sht
- /data/media/####/1170704.sht
- /data/media/####/1170706.sht
- /data/media/####/1170708.sht
- /data/media/####/1170710.sht
- /data/media/####/1219259.sht
- /data/media/####/1219260.sht
- /data/media/####/1219261.sht
- /data/media/####/1244429.sht
- /data/media/####/1247574.sht
- /data/media/####/1248696.sht
- /data/media/####/1249981.sht
- /data/media/####/1251818.sht
- /data/media/####/1252888.sht
- /data/media/####/1255397.sht
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.yanqingkong.m.bin
- /data/media/####/com.yanqingkong.m.db
- /data/media/####/crash-2020-07-25-20-57-18-1595699838343.log
- /data/media/####/gkt
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/store_cache_grilzh_TW
- /data/media/####/store_category_grilzh_TW
- /data/media/####/store_free_grilzh_TW
- /data/media/####/store_rank_grilzh_TW
- /data/media/####/tbslog.txt
- /data/media/####/tdata_cpZ817
- /data/media/####/tdata_hlV706
- /data/media/####/tdata_lbt428
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.miqingshucheng.PushService 24710 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu1631306394.so
Загружает динамические библиотеки:
- getuiext2
- libjiagu1631306394
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-ECB-PKCS5Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
