Adware.Gexin.17417

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) rtur####.anal####.cn:8089
TCP(HTTP/1.1) a####.b####.qq.com:8011
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) a####.b####.qq.com:8012
TCP(HTTP/1.1) s####.m####.com:80
TCP(HTTP/1.1) b.qchann####.cn:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) gs.g####.com:80
TCP(HTTP/1.1) c####.g####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 1####.134.99.98:80
TCP(TLS/1.0) s####.we####.com:443
TCP(TLS/1.0) log.qchann####.cn:443
TCP(TLS/1.0) sns.api.m####.com:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) msg.api.m####.com:443
TCP(TLS/1.0) s####.api.m####.com:443
TCP(TLS/1.0) oss####.m####.com:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) rtn.api.m####.com:443
TCP(TLS/1.0) t####.qchann####.cn:443
TCP(TLS/1.0) gs.g####.com:443
TCP(TLS/1.0) d####.shu####.cn:443
TCP(TLS/1.0) a####.shu####.cn:443
TCP(TLS/1.0) daa.shu####.cn:443
TCP 43.2####.161.136:5224
TCP sdk.o####.t####.####.com:5224
TCP adla####.m####.com:8080
TCP t####.bz.ig####.com:5224

DNS requests:

a####.b####.qq.com
a####.shu####.cn
a####.u####.com
adla####.m####.com
aexcep####.b####.qq.com
and####.b####.qq.com
b.qchann####.cn
c####.g####.com
c####.g####.com
c-h####.g####.com
d####.shu####.cn
daa.shu####.cn
dai.shu####.cn
dcc.shu####.cn
gs.g####.com
log.qchann####.cn
msg.api.m####.com
norma-e####.m####.com
oss####.m####.com
rtn.api.m####.com
rtur####.anal####.cn
s####.api.m####.com
s####.m####.com
s####.we####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sns.api.m####.com
t####.bz.g####.net
t####.bz.ge####.com
t####.bz.ig####.com
t####.qchann####.cn
www.qchann####.cn

HTTP GET requests:

norma-e####.m####.com/android/exchange/getpublickey.do
q####.c####.l####.####.com/config/bjmjq-bjmjqv6.conf
q####.c####.l####.####.com/config/hz-bjmjqv7.conf

HTTP POST requests:

a####.b####.qq.com:8011/rqd/async?aid=####
a####.b####.qq.com:8012/rqd/async?aid=####
a####.u####.com/app_logs
and####.b####.qq.com/rqd/async?aid=####
b.qchann####.cn/n/ard?type=####&uid=####&appkey=####&sdk=####&r=####
c####.g####.com/api.php?format=####&t=####
gs.g####.com/geshu/sdk/getBaseConfs
gs.g####.com/geshu/sdkStatistics/bd
gs.g####.com/geshu/sdkStatistics/ubi
gs.g####.com/geshu/smartStatistics/upe
norma-e####.m####.com/push/android/external/add.do
rtur####.anal####.cn:8089/
s####.m####.com/aMoUp
www.qchann####.cn/center/adj?uid=####&ak=####&offline=####&r=####&sv=####
www.qchann####.cn/center/ard?type=####&uid=####&appkey=####&sdk=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.qts_flg
/data/data/####/1004
/data/data/####/205be5f297d06ecee137ff17a96bc4e5
/data/data/####/205be5f297d06ecee137ff17a96bc4e5.tmp
/data/data/####/552d1f58b3cb6832b7f66dec51711aba
/data/data/####/552d1f58b3cb6832b7f66dec51711aba.tmp
/data/data/####/ALERT_ICON.lock
/data/data/####/CITY_DB.lock
/data/data/####/MJLog.mmap3
/data/data/####/MultiDex.lock
/data/data/####/OF
/data/data/####/QT.xml
/data/data/####/WEATHER_LOTTIE_ICON.lock
/data/data/####/alarms.db-journal
/data/data/####/arch.xml
/data/data/####/bugly_db_-journal
/data/data/####/callupconfig.db
/data/data/####/callupconfig.db-journal
/data/data/####/cc
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.moji.mjweather_dna.xml
/data/data/####/com.moji.mjweather_prefs.xml
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.2.xml
/data/data/####/config
/data/data/####/config.gz
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/datause.db-journal
/data/data/####/deanag.data
/data/data/####/deanag.data-journal
/data/data/####/du.lock
/data/data/####/dw_10_2.png
/data/data/####/dw_10_3.png
/data/data/####/dw_10_4.png
/data/data/####/dw_11_1.png
/data/data/####/dw_11_2.png
/data/data/####/dw_11_3.png
/data/data/####/dw_12_2.png
/data/data/####/dw_12_3.png
/data/data/####/dw_12_4.png
/data/data/####/dw_13_2.png
/data/data/####/dw_13_3.png
/data/data/####/dw_13_4.png
/data/data/####/dw_14_2.png
/data/data/####/dw_14_3.png
/data/data/####/dw_14_4.png
/data/data/####/dw_15_1.png
/data/data/####/dw_15_2.png
/data/data/####/dw_15_3.png
/data/data/####/dw_15_4.png
/data/data/####/dw_18_1.png
/data/data/####/dw_18_2.png
/data/data/####/dw_1_1.png
/data/data/####/dw_1_2.png
/data/data/####/dw_1_3.png
/data/data/####/dw_1_4.png
/data/data/####/dw_1_5.png
/data/data/####/dw_2_1.png
/data/data/####/dw_2_2.png
/data/data/####/dw_2_3.png
/data/data/####/dw_2_4.png
/data/data/####/dw_3_1.png
/data/data/####/dw_3_2.png
/data/data/####/dw_3_3.png
/data/data/####/dw_3_4.png
/data/data/####/dw_4_1.png
/data/data/####/dw_4_2.png
/data/data/####/dw_4_3.png
/data/data/####/dw_4_4.png
/data/data/####/dw_5_1.png
/data/data/####/dw_5_2.png
/data/data/####/dw_5_3.png
/data/data/####/dw_5_4.png
/data/data/####/dw_6_1.png
/data/data/####/dw_6_2.png
/data/data/####/dw_6_3.png
/data/data/####/dw_6_4.png
/data/data/####/dw_7_1.png
/data/data/####/dw_7_2.png
/data/data/####/dw_7_3.png
/data/data/####/dw_7_4.png
/data/data/####/dw_8_3.png
/data/data/####/dw_8_4.png
/data/data/####/dw_9_1.png
/data/data/####/dw_9_2.png
/data/data/####/dw_9_3.png
/data/data/####/dw_9_4.png
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f91e60b1f4561b3c99cb2ce94fb28ea5
/data/data/####/f91e60b1f4561b3c99cb2ce94fb28ea5.tmp
/data/data/####/getui_sp.xml
/data/data/####/gtc.db-journal
/data/data/####/ias.db-journal
/data/data/####/ias_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/install
/data/data/####/libjiagu963593963.so
/data/data/####/lla.log
/data/data/####/lla.zip
/data/data/####/local_crash_lock
/data/data/####/locations.db-journal
/data/data/####/mj_down_load.xml
/data/data/####/mjadreddot.db
/data/data/####/mjadreddot.db-journal
/data/data/####/mjsplashad.db
/data/data/####/mjsplashad.db-journal
/data/data/####/moji_log_filter-journal
/data/data/####/mojicity11.db
/data/data/####/mojicity15.db
/data/data/####/mojicity15_big.db
/data/data/####/mojiweather-journal
/data/data/####/mona_resource_update.xml
/data/data/####/multidex.version.xml
/data/data/####/mz_push_preference.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/qtsession.xml
/data/data/####/remove
/data/data/####/replace
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/sputil.sp
/data/data/####/sputil.sp.bak
/data/data/####/sputil.xml
/data/data/####/tmp
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/w0.zip
/data/data/####/w1.zip
/data/data/####/w10.zip
/data/data/####/w13.zip
/data/data/####/w14.zip
/data/data/####/w15.zip
/data/data/####/w16.zip
/data/data/####/w17.zip
/data/data/####/w18.zip
/data/data/####/w19.zip
/data/data/####/w2.zip
/data/data/####/w20.zip
/data/data/####/w29.zip
/data/data/####/w3.zip
/data/data/####/w30.zip
/data/data/####/w31.zip
/data/data/####/w32.zip
/data/data/####/w33.zip
/data/data/####/w34.zip
/data/data/####/w35.zip
/data/data/####/w4.zip
/data/data/####/w45.zip
/data/data/####/w5.zip
/data/data/####/w6.zip
/data/data/####/w7.zip
/data/data/####/w8.zip
/data/data/####/w9.zip
/data/data/####/weather.db-journal
/data/media/####/._android.dat
/data/media/####/._system.dat
/data/media/####/.duid
/data/media/####/.n_a
/data/media/####/.n_b
/data/media/####/.n_c
/data/media/####/.n_d
/data/media/####/.nomedia
/data/media/####/023315C826BA99E5C3A476610E31B3D6.zip
/data/media/####/023315C826BA99E5C3A476610E31B3D6.zip.tmp
/data/media/####/2019-08-23.log.txt
/data/media/####/205be5f297d06ecee137ff17a96bc4e5
/data/media/####/44c10f7ba900c1609fbf7af6a36fd604
/data/media/####/552d1f58b3cb6832b7f66dec51711aba
/data/media/####/AN.csv-1566574978442
/data/media/####/AN.csv-20190823154258
/data/media/####/MJLog_20190823.xlog
/data/media/####/TruthInfo.csv-1566574978019
/data/media/####/TruthInfo.csv-1566574978441
/data/media/####/UA.csv-1566574978442
/data/media/####/UA.csv-20190823154258
/data/media/####/_android.dat
/data/media/####/_system.dat
/data/media/####/app
/data/media/####/app.db
/data/media/####/avatarDefault7_8.png
/data/media/####/avatarDefault7_8_1.png
/data/media/####/avatarDefault7_8_2.png
/data/media/####/avatar_mona.csv
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.moji.mjweather.bin
/data/media/####/com.moji.mjweather.db
/data/media/####/com.moji.mjweather_.db
/data/media/####/d072db124135034eea57e06114e38c45
/data/media/####/duid
/data/media/####/eg.a
/data/media/####/f2a2130789266358aec56bb322b0169e
/data/media/####/f71440e05eabf153857881bfbf1f0f9b
/data/media/####/f91e60b1f4561b3c99cb2ce94fb28ea5
/data/media/####/mona_1.png
/data/media/####/mona_10.png
/data/media/####/mona_11-1.png
/data/media/####/mona_13.png
/data/media/####/mona_15-3.png
/data/media/####/mona_16.png
/data/media/####/mona_2.png
/data/media/####/mona_22.png
/data/media/####/mona_23.png
/data/media/####/mona_3.png
/data/media/####/mona_4.png
/data/media/####/mona_5.png
/data/media/####/mona_6.png
/data/media/####/mona_7.png
/data/media/####/mona_8.png
/data/media/####/mona_9.png
/data/media/####/mona_default_7.png
/data/media/####/n_a
/data/media/####/n_b
/data/media/####/n_c
/data/media/####/n_d
/data/media/####/qt.csv.1566574958063.txt
/data/media/####/uuid

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/meminfo
/system/bin/sh -c getprop
cat /proc/cpuinfo
date
df
getprop
getprop wifi.interface
id
ip link
ls -l /system/bin/su
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
ps -P
service call iphonesubinfo 1
sh -c cat /proc/meminfo
sh -c cat /sys/class/net/eth0/address
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c echo MzRCNkNGQTE4NDYzOUEzMEEyMEE0NEUzNDQ5NDQ2MUMwMjAxMDA= > <SD-Card>/../../../../../..<SD-Card>/.n_b
sh -c echo MzRCNkNGQTE4NDYzOUEzMEEyMEE0NEUzNDQ5NDQ2MUMwMjAxMDA= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_b
sh -c echo MzUwNDEwNjFCMjY0MjVEM0E5QTAyOUY2M0I3QkM0MjMwMDFB > <SD-Card>/../../../../../..<SD-Card>/.n_c
sh -c echo MzUwNDEwNjFCMjY0MjVEM0E5QTAyOUY2M0I3QkM0MjMwMDFB > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_c
sh -c echo OEVCMTkwNEE1OTgyQzBFQ0UxOTkxQ0YxQTIzOUFGQTYwMDA4OTdCMA== > <SD-Card>/../../../../../..<SD-Card>/.n_a
sh -c echo OEVCMTkwNEE1OTgyQzBFQ0UxOTkxQ0YxQTIzOUFGQTYwMDA4OTdCMA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_a
sh -c echo OTY5OUU5NDRCMkMyMzE3NEE1NTlFNDlDNkMzOEVBNzZBMTYwOUI6NUM2NkVCOkEwQTJDNQ== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo OTY5OUU5NDRCMkMyMzE3NEE1NTlFNDlDNkMzOEVBNzZBMTYwOUI6NUM2NkVCOkEwQTJDNQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo QTVERDVCNTFDODkwRUNFNDkzQkI1RTJERkRCNDMzMUI5RjAw > <SD-Card>/../../../../../..<SD-Card>/.n_d
sh -c echo QTVERDVCNTFDODkwRUNFNDkzQkI1RTJERkRCNDMzMUI5RjAw > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_d
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo QzYwNzUyQTUwNzNBNEE2MTBGQzUwMjQ0NTYwQzBFRjJlNTc5ZjIzMzg1MDQ0ZjViOGE4YzYzM2I5NzlmZTQ4NQo= > <SD-Card>/../../../../../..<SD-Card>/.duid
sh -c echo QzYwNzUyQTUwNzNBNEE2MTBGQzUwMjQ0NTYwQzBFRjJlNTc5ZjIzMzg1MDQ0ZjViOGE4YzYzM2I5NzlmZTQ4NQo= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/duid

Loads the following dynamic libraries:

Bugly
c++_shared
du
encrypt
getuiext3
libjiagu963593963
marsxlog
mmkv

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней