Adware.Gexin.6580

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) api.xian####.com:80
TCP(HTTP/1.1) nav.cn.ron####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) azkj-pr####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) api.xian####.com:443
TCP(TLS/1.0) s####.cn.ron####.com:443
TCP 1####.92.17.116:8629
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5227

DNS requests:

7j####.c####.z0.####.com
api.xian####.com
azkj-pr####.oss-cn-####.aliy####.com
c####.g####.ig####.com
c-h####.g####.com
nav.cn.ron####.com
pub-####.qin####.com
s####.cn.ron####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
www.xian####.com

HTTP GET requests:

api.xian####.com/picture/banner-1.png
api.xian####.com/picture/banner-2.png
azkj-pr####.oss-cn-####.aliy####.com/crawler/164cfb263b16622b0173bdb2580...
azkj-pr####.oss-cn-####.aliy####.com/crawler/67524492ab80b9643e780e8c8ac...
azkj-pr####.oss-cn-####.aliy####.com/crawler/7ba87bff7e109b23f8cd39315d8...
azkj-pr####.oss-cn-####.aliy####.com/crawler/ab4acd1619579e80730b451c616...
azkj-pr####.oss-cn-####.aliy####.com/crawler/ad8cd90f6074b102ea07e13fc60...
azkj-pr####.oss-cn-####.aliy####.com/crawler/f4c2bdd1577739c0d0bb4721520...
azkj-pr####.oss-cn-####.aliy####.com/image/13646412068/20181024085347658...
azkj-pr####.oss-cn-####.aliy####.com/image/20180816095557660GfCKPf8h7B.png
azkj-pr####.oss-cn-####.aliy####.com/image/rQM1pgHP4z
t####.c####.q####.####.com/tdata_SBh025
t####.c####.q####.####.com/tdata_ZKm258
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
nav.cn.ron####.com/navipush.json
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/-1894634998-1117040955
/data/data/####/-18946349981812008964
/data/data/####/-819728435407647165
/data/data/####/.jg.ic
/data/data/####/1389095257-918953242
/data/data/####/3e3bbdf60431a3c229e55fab4a7684790cfde62bce25068....0.tmp
/data/data/####/4494906941232161866
/data/data/####/478ec1fb722dfaccfe7d56b2d4a1e39f679cd04678a50c2....0.tmp
/data/data/####/4cce24eb7110ac76973edf81135ab2b756c0c4aeed2744a....0.tmp
/data/data/####/5ba487cd1f900fac0192e7f99c1a6d93d5d5ee4b60c7ebb....0.tmp
/data/data/####/616545426-189264660
/data/data/####/616545426-298521236
/data/data/####/67021fff782450806500e3f01803c0de0b11ed15c4619d5....0.tmp
/data/data/####/694fceb3a2c93476acd25a182ede344b729b8f717521103....0.tmp
/data/data/####/6c37844a631b59bc72a3cfe899b36fe5c5e3db6dac04dc9....0.tmp
/data/data/####/75799c2e2e34054926d8ad3b182cee46482b27314784659....0.tmp
/data/data/####/9bc6e81495971e96f2b70d605a5ad81530f46c69bd332df....0.tmp
/data/data/####/COUNTLY_STORE.xml
/data/data/####/FwLog.xml
/data/data/####/RongConfiguration.xml
/data/data/####/RongPush.xml
/data/data/####/RongPushAppConfig.xml
/data/data/####/Statistics.xml
/data/data/####/a46441048ccb8bf2347bcef58ecd2d81523726d9eda8c12....0.tmp
/data/data/####/b342f4755146a958738c65b2abe78fce26d5c908df08e00....0.tmp
/data/data/####/cf92a791f0d6fe0e35c88fb91890b86bb482101c3088b27....0.tmp
/data/data/####/da5f95258c24f2e3badcfc842a7a78e717a169125208050....0.tmp
/data/data/####/e48e4b7046318eaf63ac5f673a96d56b411c6faf68bb4c7....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu-328358052.so
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/tdata_SBh025
/data/data/####/tdata_SBh025.jar
/data/data/####/tdata_ZKm258
/data/data/####/tdata_ZKm258.jar
/data/media/####/.nomedia
/data/media/####/app.db
/data/media/####/com.aizhong.aliance.bin
/data/media/####/com.aizhong.aliance.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/logs.csv
/data/media/####/tdata_SBh025
/data/media/####/tdata_ZKm258
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.PushService 24880 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.PushService 24880 300 0

Loads the following dynamic libraries: