Adware.Gexin.22551

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.3.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) st####.dc####.net.cn:80
TCP(HTTP/1.1) adash####.man.aliy####.com:80
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) 1####.251.36.42:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.251.36.3:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) 1####.251.36.42:443
TCP 1####.251.36.42:443

Запросы DNS:

a####.man.aliy####.com
and####.cli####.go####.com
android####.go####.com
instant####.google####.com
m####.go####.com
md####.google####.com
plb####.u####.com
st####.dc####.net.cn
u####.u####.com

Запросы HTTP POST:

adash####.man.aliy####.com/man/api?ak=####&s=####
st####.dc####.net.cn/collect/crash
st####.dc####.net.cn/device/location

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imei.txt
/data/data/####/.jg.ic
/data/data/####/.lock
/data/data/####/ACCS_SDK.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/H5085281D.xml
/data/data/####/MessageStore.db
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/Web Data-journal (deleted)
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/_adio.dcloud.feature.ad.a.a.xml
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/disk_entries_list_image_cache_-882886834.xml
/data/data/####/html5Geo.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/info.xml
/data/data/####/libjiagu.so
/data/data/####/libweexjsb.so
/data/data/####/metrics_guid
/data/data/####/pdr.xml
/data/data/####/proc_auxv
/data/data/####/um_pri.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_message_state.xml
/data/data/####/webview_data.lock
/data/media/####/.imei.txt
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/crash_1644172747070_2022-02-06-21-39-07.log
/data/media/####/crash_1644172750233_2022-02-06-21-39-10.log
/data/media/####/crash_1644172753683_2022-02-06-21-39-13.log
/data/media/####/crash_1644172756630_2022-02-06-21-39-16.log
/data/media/####/crash_1644172759205_2022-02-06-21-39-19.log
/data/media/####/crash_1644172761903_2022-02-06-21-39-21.log
/data/media/####/crash_1644172764555_2022-02-06-21-39-24.log
/data/media/####/crash_1644172767504_2022-02-06-21-39-27.log
/data/media/####/crash_1644172773238_2022-02-06-21-39-33.log
/data/media/####/crash_1644172776010_2022-02-06-21-39-36.log
/data/media/####/crash_1644172779047_2022-02-06-21-39-39.log
/data/media/####/crash_1644172781652_2022-02-06-21-39-41.log
/data/media/####/crash_1644172787695_2022-02-06-21-39-47.log
/data/media/####/crash_1644172791750_2022-02-06-21-39-51.log
/data/media/####/crash_1644172796732_2022-02-06-21-39-56.log
/data/media/####/crash_1644172799501_2022-02-06-21-39-59.log
/data/media/####/crash_1644172804893_2022-02-06-21-40-04.log
/data/media/####/crash_1644172808366_2022-02-06-21-40-08.log
/data/media/####/crash_1644172812287_2022-02-06-21-40-12.log
/data/media/####/crash_1644172815819_2022-02-06-21-40-15.log
/data/media/####/crash_1644172818940_2022-02-06-21-40-18.log
/data/media/####/crash_1644172821763_2022-02-06-21-40-21.log
/data/media/####/crash_1644172824670_2022-02-06-21-40-24.log

Другие:

Запускает следующие shell-скрипты:

/data/app/<Package>-1/lib/arm/libweexjsb.so 62 0
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 48 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 51 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 52 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 58 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 59 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 60 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 63 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 64 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 65 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 67 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 68 0
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libweexjsb.so /data/app/<Package>-1/lib/arm/libweexjsb.so 74 0
ls /
ls /sys/class/thermal