Adware.Gexin.22180

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) so####.y####.cn:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) api.s####.mob.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(TLS/1.0) 1####.251.39.99:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) new.yoho####.com:443
TCP(TLS/1.0) 1####.251.39.106:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) 1####.251.39.99:443
TCP(TLS/1.2) 1####.251.39.106:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP new.yoho####.com:443

DNS requests:

a####.b####.qq.com
a####.exc.mob.com
a####.u####.com
aexcep####.b####.qq.com
and####.b####.qq.com
and####.cli####.go####.com
api.s####.mob.com
ezi####.yoho####.com
g####.face####.com
instant####.google####.com
l####.tbs.qq.com
m####.go####.com
m.d####.mob.com
md####.google####.com
new.yoho####.com
so####.y####.cn

HTTP GET requests:

api.face####.com:443/v2.5/543249632492200?fields=####&format=####&sdk=####
api.s####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####...

HTTP POST requests:

a####.u####.com/app_logs
aexcep####.b####.qq.com:8011/rqd/async?aid=####
aexcep####.b####.qq.com:8012/rqd/async?aid=####
and####.b####.qq.com/rqd/async?aid=####
api.s####.mob.com/conf5
api.s####.mob.com/conn
api.s####.mob.com/snsconf
l####.tbs.qq.com/ajax?c=####&k=####
new.yoho####.com:443/index.php?r=####&magId=####&deviceType=####
new.yoho####.com:443/index.php?r=####&start=####&end=####&device=####&sc...
new.yoho####.com:443/yohoboyins/v5/channel/channelPop
new.yoho####.com:443/yohoboyins/v5/channel/getContentDetail
new.yoho####.com:443/yohoboyins/v5/channel/getNewExpression
new.yoho####.com:443/yohoboyins/v5/channel/isUpdate
new.yoho####.com:443/yohoboyins/v5/common/getUpdateInfo
new.yoho####.com:443/yohoboyins/v5/qcloud/setLiveTotal
so####.y####.cn/social

File system changes:

Creates the following files:

/data/data/####/.dex2oatlock
/data/data/####/.dic_lock
/data/data/####/.duid
/data/data/####/.globalLock
/data/data/####/.imprint
/data/data/####/.lock
/data/data/####/.mrecord
/data/data/####/.mrlock
/data/data/####/.pkg_lock
/data/data/####/.rc_lock
/data/data/####/.statistics
/data/data/####/.updateIV.dat
/data/data/####/.updateIV.dat_0
/data/data/####/.updateIV.dat_1
/data/data/####/0000000lllll_0.dex
/data/data/####/0000000lllll_1.dex
/data/data/####/000O00ll111l_0.dex
/data/data/####/000O00ll111l_1.dex
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_0.dex (deleted)
/data/data/####/00O000ll111l_0.dex.flock
/data/data/####/00O000ll111l_0.dex.flock (deleted)
/data/data/####/00O000ll111l_1.dex
/data/data/####/00O000ll111l_1.dex (deleted)
/data/data/####/00O000ll111l_1.dex.flock
/data/data/####/00O000ll111l_1.dex.flock (deleted)
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/1002
/data/data/####/1004
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/Cookies-journal
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/YOHONEWS_PLATEFORM.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_last_session.json
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_yaq
/data/data/####/bugly_db_yaq-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.yoho.magazine.BETA_VALUES.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/libcuid.so
/data/data/####/libshellx-super.2019.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/magazine.db
/data/data/####/magazine.db-journal
/data/data/####/map_record.txt
/data/data/####/mob_commons_1.xml
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/proc_auxv
/data/data/####/reg_record.txt
/data/data/####/rqd_record.eup
/data/data/####/security_info
/data/data/####/security_info (deleted)
/data/data/####/share_sdk_1.xml
/data/data/####/sharesdk.db-journal
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tomb.zip (deleted)
/data/data/####/tomb_1641159457545.txt
/data/data/####/tomb_1641159473423.txt
/data/data/####/tomb_1641159507460.txt
/data/data/####/tosversion
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/yohoCommunityTempPre.xml
/data/data/####/yoho_analytics.db-journal
/data/data/####/yohoinfo.xml
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
getprop
getprop ro.product.cpu.abi
logcat -d -v threadtime
logcat -d -v threadtime -s dalvikvm art zygote zygote64 OpenGLRenderer Bugly-libunwind:S
logcat -t 1000 -v threadtime Bugly-libunwind:S
ls /data/local

Uses the following algorithms to encrypt data: