Adware.Gexin.3386

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) mo####.b####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) cdn.aicli####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) api.qudu####.cn:443
TCP(TLS/1.0) c####.v####.com:443
TCP(TLS/1.0) push-re####.qudu####.cn:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) re####.qudu####.cn:443
TCP(TLS/1.0) 1####.217.20.110:443
UDP 1####.168.111.1:137
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5227
TCP ope####.m.ta####.com:443

DNS requests:

7j####.c####.z0.####.com
a####.man.aliy####.com
a####.u####.com
ag####.m.ta####.com
amdc####.m.ta####.com
and####.b####.qq.com
api.qudu####.cn
c####.g####.ig####.com
c####.v####.com
c-h####.g####.com
cdn.aicli####.com
mo####.b####.com
plb####.u####.com
pub-####.qin####.com
push-re####.qudu####.cn
pv.s####.com
qfy.innot####.com
re####.qudu####.cn
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
u####.u####.com
umen####.m.ta####.com
upd####.a####.com

HTTP GET requests:

gdv.a.s####.com/cityjson
mo####.b####.com/ads/pa/proxy/proxy036.jar
mo####.b####.com/ads/pa/proxy/remote_banner.php?v=####&tp=####&os=####&b...
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_EDT356
t####.c####.q####.####.com/tdata_vHH584
t####.c####.q####.####.com/tdata_wmL809

HTTP POST requests:

a####.u####.com/app_logs
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/ACCS_BINDumeng;58fea91dae1bf80b85001b11.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/T-kEtfHKtp9IjWiEI54vmEVFns8Prris
/data/data/####/T05asxbHfjbTMQXzNrq7gExjpqpMNOYP
/data/data/####/T12N9HuCSYNe9llRG5HIyE8WQMh3Ny4u
/data/data/####/T1Hp76BgR5BE3ly9G73P1EL3HiZw4miB
/data/data/####/T1QX8d90Nx6OIf8go5mqT0An-0mVT9_e
/data/data/####/T1zTk2iSFRAl_RdwHJ5dcU3HjLavMumL
/data/data/####/T2S37n9U5ZY0KaCPeYWfAUTgMmWuej_B
/data/data/####/T3BEY5sDgvhfXYtnlJis_U9mj-Nn6-hT
/data/data/####/T3zbe_4nuGOh6GW5JY6n10-O0I6xnqTn
/data/data/####/T4eci1-biMXfExP96YX-40XcUdCUjiTL
/data/data/####/T4wnTO68x_QXSajSO6Jx8UklXAf5fMXQ
/data/data/####/T5EsEv_hVhyNs593ILL6Fk7VP5307SSQ
/data/data/####/T5FFafv14Fs98T5wFK7y10xgk_EzfAG6
/data/data/####/T5NR66eWzatOoMxdMpjjFk4lKW-9Twlx
/data/data/####/T6S9viKhyoWT_dcDOrCLREAyPfRLvsFy
/data/data/####/T6se2qqooPE8JeWy9KwwiUyl1xpB25Aj
/data/data/####/T8s9NIzVAipUbNithY1JGU-E6vUmKmX-
/data/data/####/T8udWRjbkF7rfnV3wa7uSUE4U-M37OzX
/data/data/####/T9TGXQz15DGWyyjkbrWAQ0rAWPq18JJN
/data/data/####/T9VTaHuR1Oat5ay_nq6dVkfPNvaN330J
/data/data/####/T_2CTLMjcubM8y-AsoUwc0bn67qWJLmP
/data/data/####/T_Ae8uFLkqjb5QaYw68sPEVTBROZhUaq
/data/data/####/T_NVO5EA88V12nz2KYO38ErK0IcEhced
/data/data/####/TyQDRaqwsjEASD1Nw4kmVkbDG6tefvS7
/data/data/####/TzDycpplosQf3aHjA6WUUUZphSiLg5PO
/data/data/####/TzmrFHUw79IT03PmIY0tgEjI6Ht3AdmF
/data/data/####/_aisdk_local.dex
/data/data/####/_aisdk_local.jar
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.xike.yipai.xml
/data/data/####/com.xike.yipai.xml.bak
/data/data/####/com.xike.yipai.xml.bak (deleted)
/data/data/####/com.xike.yipai_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_cache.xml.bak (deleted)
/data/data/####/i==1.2.0&&2.7.9.0_1538518151533_envelope.log
/data/data/####/i==1.2.0&&2.7.9.0_1538518162266_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu805543184.so
/data/data/####/local_crash_lock
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/proxy_banner.php
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/remote_downloaded.jar
/data/data/####/remote_running.dex
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_vHH584
/data/data/####/tdata_vHH584.jar
/data/data/####/tdata_wmL809
/data/data/####/tdata_wmL809.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/v5kf_client.xml
/data/data/####/v5kf_emoticons.db
/data/data/####/v5kf_emoticons.db-journal
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/data/####/yipai_db_report-journal
/data/data/####/yp_app.xml
/data/data/####/yp_app.xml.bak
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.acid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.6829d1667526200f340b0ebbc50f1799.acid
/data/media/####/.6829d1667526200f340b0ebbc50f1799.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/.a.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.a813fc513e2acbdc7dbb94a2b0444a01.acid
/data/media/####/.a813fc513e2acbdc7dbb94a2b0444a01.cuid
/data/media/####/.adfwe.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.c9da02a7b35c2bf0d98f818c0b85e914.acid
/data/media/####/.c9da02a7b35c2bf0d98f818c0b85e914.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.acid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.cc8dd1145e0a2d862cf37183282bd82c.acid
/data/media/####/.cc8dd1145e0a2d862cf37183282bd82c.cuid
/data/media/####/.cca.dat
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/653882a3e4294504bdf5e6b9a46ce04b
/data/media/####/7a9f204a87af44fe9899775664d23fbc
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/aacout
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.xike.yipai.bin
/data/media/####/com.xike.yipai.db
/data/media/####/crash-2018-10-02-1538518196857.log
/data/media/####/crash-2018-10-02-1538518202272.log
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/deviceToken
/data/media/####/qtac
/data/media/####/sysid.dat
/data/media/####/systemccu
/data/media/####/tdata_vHH584
/data/media/####/tdata_wmL809
/data/media/####/test.log
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:58fea91dae1bf80b85001b11","utdid":"W7Pshu6HBgMDAGdzx1Hz8+CL","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.yppushmodule.service.GTCoreService 24384 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu805543184.so
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
id
logcat -d -v threadtime
ls -i
ls -l
ls /sys/class/thermal
mount
ps
sh
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/mounts
sh -c cat /proc/self/maps
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh <Package Folder>/files/T-kEtfHKtp9IjWiEI54vmEVFns8Prris
sh <Package Folder>/files/T05asxbHfjbTMQXzNrq7gExjpqpMNOYP
sh <Package Folder>/files/T12N9HuCSYNe9llRG5HIyE8WQMh3Ny4u
sh <Package Folder>/files/T1Hp76BgR5BE3ly9G73P1EL3HiZw4miB
sh <Package Folder>/files/T1QX8d90Nx6OIf8go5mqT0An-0mVT9_e
sh <Package Folder>/files/T1zTk2iSFRAl_RdwHJ5dcU3HjLavMumL
sh <Package Folder>/files/T2S37n9U5ZY0KaCPeYWfAUTgMmWuej_B
sh <Package Folder>/files/T3BEY5sDgvhfXYtnlJis_U9mj-Nn6-hT
sh <Package Folder>/files/T3zbe_4nuGOh6GW5JY6n10-O0I6xnqTn
sh <Package Folder>/files/T4eci1-biMXfExP96YX-40XcUdCUjiTL
sh <Package Folder>/files/T4wnTO68x_QXSajSO6Jx8UklXAf5fMXQ
sh <Package Folder>/files/T5EsEv_hVhyNs593ILL6Fk7VP5307SSQ
sh <Package Folder>/files/T5FFafv14Fs98T5wFK7y10xgk_EzfAG6
sh <Package Folder>/files/T5NR66eWzatOoMxdMpjjFk4lKW-9Twlx
sh <Package Folder>/files/T6S9viKhyoWT_dcDOrCLREAyPfRLvsFy
sh <Package Folder>/files/T6se2qqooPE8JeWy9KwwiUyl1xpB25Aj
sh <Package Folder>/files/T8s9NIzVAipUbNithY1JGU-E6vUmKmX-
sh <Package Folder>/files/T8udWRjbkF7rfnV3wa7uSUE4U-M37OzX
sh <Package Folder>/files/T9TGXQz15DGWyyjkbrWAQ0rAWPq18JJN
sh <Package Folder>/files/T9VTaHuR1Oat5ay_nq6dVkfPNvaN330J
sh <Package Folder>/files/T_2CTLMjcubM8y-AsoUwc0bn67qWJLmP
sh <Package Folder>/files/T_Ae8uFLkqjb5QaYw68sPEVTBROZhUaq
sh <Package Folder>/files/T_NVO5EA88V12nz2KYO38ErK0IcEhced
sh <Package Folder>/files/TyQDRaqwsjEASD1Nw4kmVkbDG6tefvS7
sh <Package Folder>/files/TzDycpplosQf3aHjA6WUUUZphSiLg5PO
sh <Package Folder>/files/TzmrFHUw79IT03PmIY0tgEjI6Ht3AdmF
stat app
stat cat
stat etc
stat net
stat random
uname -a
uname -r

Loads the following dynamic libraries:

Bugly
InnoSecure
InnoSo
getuiext2
libjiagu805543184
nama
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial