Adware.Gexin.22083

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
TCP(HTTP/1.1) www.fenfen####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) plb####.u####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) def####.cn.zb.####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) www.google####.com:443
UDP 1####.24.104.47:44448
UDP 1####.24.104.47:44447
UDP 1####.24.104.47:44445
UDP 1####.24.104.47:44444
UDP 1####.24.104.47:44450
UDP 1####.24.104.47:44452
UDP 1####.0.9.1:137
UDP 1####.24.104.47:44446
UDP 1####.24.104.47:44449
UDP 1####.24.104.47:44454
UDP 1####.24.104.47:44453
UDP 1####.24.104.47:44451

Запросы DNS:

a####.man.aliy####.com
ad####.m.ta####.com
and####.b####.qq.com
and####.cli####.go####.com
and####.google####.com
android####.go####.com
api.fenfen####.com
instant####.google####.com
is.sn####.com
l####.tbs.qq.com
log.sn####.com
log.u####.com
m####.go####.com
plb####.u####.com
sec.u####.com
sf3-fe####.pglstat####.com
sf3-ttc####.ps####.com
u####.u####.com
www.fenfen####.com
www.google####.com
www.gst####.com

Запросы HTTP GET:

def####.cn.zb.####.com:443/bar/get/4db7a195112cf76abd00000c/?pcv=####&de...
sf3-ttc####.ps####.com:443/obj/ad-pattern/renderer/9eee41/index.js
sf3-ttc####.ps####.com:443/obj/ad-pattern/renderer/package.json

Запросы HTTP POST:

al####.u####.com:443/unify_logs
and####.b####.qq.com/rqd/async?aid=####
na61-####.wagbr####.ali####.####.com:443/max.json
plb####.u####.com:443/umpx_internal
sf3-ttc####.ps####.com/service/2/app_log_exception/?os_api=####&device_p...
sf3-ttc####.ps####.com:443/api/ad/union/sdk/settings/
www.fenfen####.com/snsApi.php?do=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/1641056647788
/data/data/####/37CF018B.dex
/data/data/####/37CF018B.dex.flock (deleted)
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/PINK_DIARY.xml
/data/data/####/UTCommon.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/ad_reload_form.xml
/data/data/####/ap.Lock
/data/data/####/be7b7b05-7ca6-433e-b4b8-e26585aa3a9b
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_-journal (deleted)
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/core_info
/data/data/####/crash_dump.log
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNjQxMDU2NjIwMjc4;
/data/data/####/dc6B4A50B052A05811
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/i==1.2.0&&7.58_1641056619824_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/jsb.version
/data/data/####/libjiagu.so
/data/data/####/libweexjsb.so
/data/data/####/local_crash_lock
/data/data/####/metrics_guid
/data/data/####/native_record_lock
/data/data/####/passcode.xml
/data/data/####/pink_config.xml
/data/data/####/proc_auxv
/data/data/####/security_info
/data/data/####/setting.xml
/data/data/####/share_data.xml
/data/data/####/sp_sessionid.xml
/data/data/####/sp_uuid.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/the-real-index
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak (deleted)
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/update.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/data/app/<Package>-1/lib/arm//libweexjsb.so 78 83 1 /data/user/0/<Package>/app_crash/crash_dump.log
/data/user/0/<Package>/app_06851326-179e-4f06-8472-d5e78a1ab259/dc6B4A50B052A05811
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c type su
getprop
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
logcat -d -v threadtime
ls /
ls /sys/class/thermal