Adware.Gexin.23219

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) sdk.c####.g####.####.cn:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) m.d####.mob.com:80
TCP(HTTP/1.1) c.d####.mob.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) api.dianb####.com:443
TCP(TLS/1.0) digital####.google####.com:443
TCP(TLS/1.0) rr7---s####.g####.com:443
TCP(TLS/1.0) rr5---s####.g####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) rr1---s####.g####.com:443
TCP(TLS/1.2) 1####.217.16.206:443
TCP(TLS/1.2) md####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) digital####.google####.com:443
TCP(TLS/1.2) 1####.250.185.174:443
TCP sdk.o####.t####.####.com:5224
UDP md####.google####.com:443
TCP cm-1####.g####.com:5224
UDP digital####.google####.com:443

Запросы DNS:

7j####.c####.z0.####.com
a####.exc.mob.com
a.appj####.com
and####.b####.qq.com
api.dianb####.com
api.map.b####.com
api.s####.mob.com
c-h####.g####.com
c.d####.mob.com
cdn-sdk####.g####.com
cm-1####.g####.com
connect####.gst####.com
d####.d####.mob.com
digital####.google####.com
m.d####.mob.com
md####.google####.com
rr1---s####.g####.com
rr5---s####.g####.com
rr7---s####.g####.com
sdk-ope####.g####.com
sdk.c####.g####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

Запросы HTTP GET:

m.d####.mob.com/cconf?appkey=####&plat=####&apppkg=####&appver=####&netw...
sdk.c####.g####.####.cn/config/hzv9.conf
sdk.c####.g####.####.cn/tdata_svG098
sdk.c####.g####.####.cn/tdata_zNZ623
sdk.o####.p####.####.com/api/addr.htm
ti####.c####.l####.####.com/tdata_BAI450

Запросы HTTP POST:

a####.exc.mob.com/errconf
a.appj####.com/ad-service/ad/mark
and####.b####.qq.com/rqd/async
api.map.b####.com:443/sdkcs/verify
c-h####.g####.com/api.php?format=####&t=####
c.d####.mob.com/cdata
m.d####.mob.com/conf5
m.d####.mob.com/conn
m.d####.mob.com/data2
m.d####.mob.com/dinfo
m.d####.mob.com/dsign
m.d####.mob.com/log4
m.d####.mob.com/snsconf
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/.lock
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/.mrecord
/data/data/####/.mrecord (deleted)
/data/data/####/.mrlock
/data/data/####/.statistics
/data/data/####/87f75c18
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/authStatus_com.asiasofti.banma.xml
/data/data/####/bugly_db_-journal
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/mac.xml
/data/data/####/mob_commons_1.xml
/data/data/####/mob_commons_1.xml.bak
/data/data/####/mob_sdk_exception_1.xml
/data/data/####/mob_sdk_exception_1.xml.bak
/data/data/####/proc_auxv
/data/data/####/profile
/data/data/####/push.pid
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/share_sdk_1.xml
/data/data/####/sharesdk.db-journal
/data/data/####/tdata_svG098
/data/data/####/tdata_svG098.dex
/data/data/####/tdata_svG098.dex.flock (deleted)
/data/data/####/tdata_svG098.jar
/data/data/####/tdata_zNZ623
/data/data/####/tdata_zNZ623.dex
/data/data/####/tdata_zNZ623.dex.flock (deleted)
/data/data/####/tdata_zNZ623.jar
/data/media/####/.al
/data/media/####/.ccLock
/data/media/####/.ccc
/data/media/####/.cuid
/data/media/####/.dh
/data/media/####/.dh-journal
/data/media/####/.dhlock
/data/media/####/.dic_lock
/data/media/####/.dk
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.nomedia
/data/media/####/.nulal
/data/media/####/.nulplt
/data/media/####/.pkg_lock
/data/media/####/.plst
/data/media/####/.rc_lock
/data/media/####/.usLock
/data/media/####/app.db
/data/media/####/com.asiasofti.banma.bin
/data/media/####/com.asiasofti.banma.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/gkt
/data/media/####/gkt-journal
/data/media/####/gktper (deleted)
/data/media/####/tdata_svG098
/data/media/####/tdata_zNZ623

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
getprop ro.board.platform
grep -E -v root|shell|system
sh
top -d 0 -n 1
top -d 0 -n 1 | grep -E -v 'root|shell|system' >> /storage/emulated/0/Mob/comm/dbs/.plst && echo "======================" >> /storage/emulated/0/Mob/comm/dbs/.plst

Загружает динамические библиотеки: