Adware.Gexin.3543

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) o####.pape####.cn:80
TCP(HTTP/1.1) 2####.107.1.1:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 2c52####.cdn.uc####.####.cn:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(TLS/1.0) schedul####.yo####.com:443
TCP(TLS/1.0) bbl.xueb####.com:443
TCP c####.g####.ig####.com:5224
TCP sdk.o####.t####.####.com:5224

DNS requests:

7j####.c####.z0.####.com
7x####.c####.z0.####.com
bbl.xueb####.com
c####.g####.ig####.com
c-h####.g####.com
o####.pape####.cn
pi####.qq.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
tj.youza####.com
wb####.u####.uc####.####.cn

HTTP GET requests:

2c52####.cdn.uc####.####.cn/1848fcfba85a1389198bc9b04ff69c89.apk
2c52####.cdn.uc####.####.cn/38e578add2bd4ca775fc539b6184a2d5.apk
2c52####.cdn.uc####.####.cn/4495db0141dd528db1467358c9208949.apk
2c52####.cdn.uc####.####.cn/4f6bf9061211c831b0b2a452a9ef649c.apk
2c52####.cdn.uc####.####.cn/5cc92db959669161a4a78092a5b87f7a.apk
2c52####.cdn.uc####.####.cn/5fb2808e573a0db9a5c4026229e92281.apk
2c52####.cdn.uc####.####.cn/6310dcb4847b21bcda0ee50675da8dbe.apk
2c52####.cdn.uc####.####.cn/65515251ff01dd7eb97e3c8f7dcbc6eb.apk
2c52####.cdn.uc####.####.cn/979be035e116c22dd1d007c13681077e.apk
2c52####.cdn.uc####.####.cn/a976d6d4a6fcd9b5391ffa0300d5060d.apk
2c52####.cdn.uc####.####.cn/bf090f4bcaa72c94cc29574f4307dcf3.apk
2c52####.cdn.uc####.####.cn/e4996c87d08b2f67ebee8c9b5a2198dc.apk
2c52####.cdn.uc####.####.cn/eff3cff84607b852e9ffed54403bec12.apk
2c52####.cdn.uc####.####.cn/fd67ed9c9a60ad5fd8f61727088a6764.apk
t####.c####.q####.####.com/android_theme_special_christmas.apk
t####.c####.q####.####.com/android_theme_special_newyear.apk
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_RbW195
t####.c####.q####.####.com/tdata_YEE769
t####.c####.q####.####.com/tdata_hqM577

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
o####.pape####.cn/api/v1/ClientCheck
pi####.qq.com/mstat/report/?index=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/.mta-wxop.xml
/data/data/####/.setting
/data/data/####/UUID
/data/data/####/UUID_N
/data/data/####/_nohttp_cache_db.db
/data/data/####/_nohttp_cache_db.db-journal
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.wenba.bangbang_preferences.xml
/data/data/####/com.wenba.bangbang_prefs.xml
/data/data/####/com.youzan.mobile.AnalyticsPrefs.xml
/data/data/####/events
/data/data/####/events-journal
/data/data/####/gdaemon_20161017
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c.pid
/data/data/####/libjiagu53689302.so
/data/data/####/mobclick_agent_cached_com.wenba.bangbang5003000
/data/data/####/multidex.version.xml
/data/data/####/pri_wxop_tencent_analysis.db-journal
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/setting.xml
/data/data/####/shuzilm.db
/data/data/####/special_christmas-5003000.temp
/data/data/####/special_christmas-5003000.temp.nohttp
/data/data/####/special_newyear-5003000.temp
/data/data/####/special_newyear-5003000.temp.nohttp
/data/data/####/tdata_RbW195
/data/data/####/tdata_RbW195.jar
/data/data/####/tdata_YEE769
/data/data/####/tdata_YEE769.jar
/data/data/####/tdata_hqM577
/data/data/####/tdata_hqM577.jar
/data/data/####/umeng_general_config.xml
/data/data/####/wxop_tencent_analysis.db-journal
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/UUID
/data/media/####/UUID_N
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.wenba.bangbang.db
/data/media/####/event_c422486e50594d1ba5d75a9dfdc1c18b.args
/data/media/####/event_c422486e50594d1ba5d75a9dfdc1c18b.log
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/lut
/data/media/####/sequence_number
/data/media/####/tdata_RbW195
/data/media/####/tdata_YEE769
/data/media/####/tdata_hqM577
/data/media/####/test.log

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24752 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
ls /dev/socket
netstat
service call iphonesubinfo 1
sh -c cat /proc/cpuinfo
sh -c cat /proc/net/arp
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24752 300 0