Adware.Gexin.12443

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.3.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) www.xianxia####.com:80
TCP(HTTP/1.1) 47.95.2####.159:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) st####.dc####.net.cn:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) lot####.ydl####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) ser####.dc####.net.cn:443
TCP(TLS/1.0) www.xianxia####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

DNS requests:

c####.g####.ig####.com
c-h####.g####.com
lot####.ydl####.com
pub-####.qin####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
ser####.dc####.net.cn
ssl.gst####.com
st####.dc####.net.cn
www.go####.com
www.gst####.com
www.xianxia####.com

HTTP GET requests:

47.95.2####.159/freshMallImages/2019/1/18/adaca792-3b48-4303-b6c4-a4422c...
47.95.2####.159/freshMallImages/2019/1/21/2d02414e-d75e-4e55-8dbd-fad4bf...
47.95.2####.159/freshMallImages/2019/1/21/2db5fbea-f9d9-4021-8823-5abcab...
47.95.2####.159/freshMallImages/2019/1/21/349f6374-fd9b-462d-9c5c-b68c13...
47.95.2####.159/freshMallImages/2019/1/21/758610fd-7154-4e10-b438-55d5b7...
47.95.2####.159/freshMallImages/2019/1/21/a2e74304-6ce1-4d5b-bb48-d649c6...
47.95.2####.159/freshMallImages/2019/1/21/b09c979e-a21d-4d08-b950-9c3f83...
47.95.2####.159/freshMallImages/2019/1/21/f0770e40-f179-43d0-b4c9-e94eaa...
47.95.2####.159/freshMallImages/2019/1/21/f79e7067-3726-4603-aed6-d5f8a3...
47.95.2####.159/freshMallImages/2019/1/23/882263c0-a94a-49e9-b236-578abf...
47.95.2####.159/freshMallImages/2019/1/23/c71f6f4c-7ad2-42e5-8ef3-917756...
47.95.2####.159/freshMallImages/2019/1/29/05c8a2c8-c0e6-4b4c-85e1-4952b9...
47.95.2####.159/freshMallImages/2019/1/29/38558a55-6db0-4495-b8b7-e7d827...
lot####.ydl####.com/freshMallImages/2019/1/31/goodsdesc.jpg
qin####.com.www.####.com/tdata_EDT356
t####.c####.q####.####.com/config/hz-hzv6.conf
www.xianxia####.com/fresh_mall/comments/get_list_by_id?current=####&page...
www.xianxia####.com/fresh_mall/goods/get_by_id?id=####&uid=####&type=####
www.xianxia####.com/fresh_mall/groups/get_list?uid=####&goodsId=####
www.xianxia####.com/fresh_mall/home/get_info?uid=####

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
st####.dc####.net.cn/device/location

File system changes:

Creates the following files:

/data/data/####/.imei.txt
/data/data/####/.jg.ic
/data/data/####/H50084369.xml
/data/data/####/MultiDex.lock
/data/data/####/_adio.dcloud.feature.ad.a.a.xml
/data/data/####/c490f511b771
/data/data/####/clientid_igexin.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dc_ad_type_key.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/html5Geo.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu-697684339.so
/data/data/####/multidex.version.xml
/data/data/####/pdr.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/start_statistics_data.xml
/data/data/####/stream_permission.xml
/data/data/####/test_app
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.imei.txt
/data/media/####/.nomedia
/data/media/####/20190418.log
/data/media/####/60x60.gif
/data/media/####/AdEnable.dat
/data/media/####/README.md
/data/media/####/VIP.png
/data/media/####/a.html
/data/media/####/aboutme.css
/data/media/####/aboutme.html
/data/media/####/act1.html
/data/media/####/address.css
/data/media/####/address.html
/data/media/####/address.png
/data/media/####/address_blank.png
/data/media/####/after-sales.png
/data/media/####/alipay.png
/data/media/####/alipay_one.png
/data/media/####/animate.html
/data/media/####/app.db
/data/media/####/applyAfter.css
/data/media/####/applyAfter.html
/data/media/####/applyRefundDetail.css
/data/media/####/applyRefundDetail.html
/data/media/####/applyRefundSuccess.css
/data/media/####/applyRefundSuccess.html
/data/media/####/apply_refund_success.png
/data/media/####/banner1.png
/data/media/####/bindIphone.css
/data/media/####/bindIphone.html
/data/media/####/bulk_bg.png
/data/media/####/business.png
/data/media/####/camera.png
/data/media/####/camera_one.png
/data/media/####/car.png
/data/media/####/cart.png
/data/media/####/cart_active.png
/data/media/####/cart_one.png
/data/media/####/cart_three.png
/data/media/####/cart_two.png
/data/media/####/changeName.html
/data/media/####/changeNewCode.html
/data/media/####/changeNewPhone.html
/data/media/####/changeOldCode.html
/data/media/####/changeOldPhone.html
/data/media/####/changePassword.html
/data/media/####/changeSex.html
/data/media/####/chat.css
/data/media/####/chat.html
/data/media/####/chat1.html
/data/media/####/class.css
/data/media/####/class.html
/data/media/####/class.png
/data/media/####/class_active.png
/data/media/####/clock.png
/data/media/####/close.png
/data/media/####/close_eye.png
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.xxsh.app.bin
/data/media/####/com.xxsh.app.db
/data/media/####/common.js
/data/media/####/coupon.css
/data/media/####/coupon.html
/data/media/####/coupon.png
/data/media/####/coupon_bg.png
/data/media/####/coupon_gray.png
/data/media/####/customer.png
/data/media/####/del.png
/data/media/####/deleat.png
/data/media/####/distribution.png
/data/media/####/dzsp.png
/data/media/####/edit.png
/data/media/####/eje3cnc
/data/media/####/evaluate.png
/data/media/####/evaluated.png
/data/media/####/evaluationDetail.css
/data/media/####/evaluationDetail.html
/data/media/####/expired.png
/data/media/####/feedback.png
/data/media/####/firstClass.css
/data/media/####/firstClass.html
/data/media/####/fly.js
/data/media/####/forgetPassword.css
/data/media/####/forgetPassword.html
/data/media/####/gb2.png
/data/media/####/getCoupons.css
/data/media/####/getCoupons.html
/data/media/####/group.png
/data/media/####/group_icon.png
/data/media/####/head.png
/data/media/####/help.css
/data/media/####/help.html
/data/media/####/help.png
/data/media/####/help_1.html
/data/media/####/help_2.html
/data/media/####/help_3.html
/data/media/####/help_4.html
/data/media/####/hot_bg.png
/data/media/####/ico.png
/data/media/####/ico1.png
/data/media/####/ico2.png
/data/media/####/icoc.png
/data/media/####/icodd.png
/data/media/####/icofl.png
/data/media/####/icogwc.png
/data/media/####/icohome.png
/data/media/####/icojb.png
/data/media/####/iconfont.ttf
/data/media/####/iconjd.png
/data/media/####/icoss.png
/data/media/####/icotj.png
/data/media/####/icotl.png
/data/media/####/icowd.png
/data/media/####/icoxg.png
/data/media/####/icoyl.png
/data/media/####/icozzgc.png
/data/media/####/igexinTool.js
/data/media/####/index.css
/data/media/####/index.html
/data/media/####/index.png
/data/media/####/index_active.png
/data/media/####/info.css
/data/media/####/jquery.fly.min.js
/data/media/####/jquery.js
/data/media/####/left.png
/data/media/####/loading.gif
/data/media/####/localStorage.js
/data/media/####/logo.png
/data/media/####/ma.png
/data/media/####/manifest.json
/data/media/####/md5.js
/data/media/####/message.css
/data/media/####/message.html
/data/media/####/message.png
/data/media/####/messageDetail.css
/data/media/####/messageDetail.html
/data/media/####/mui.css
/data/media/####/mui.js
/data/media/####/mui.min.css
/data/media/####/mui.min.js
/data/media/####/mui.pullToRefresh.js
/data/media/####/mui.pullToRefresh.material.js
/data/media/####/mui.ttf
/data/media/####/myEvaluation.css
/data/media/####/myEvaluation.html
/data/media/####/no_cart.png
/data/media/####/no_product.png
/data/media/####/not_net.png
/data/media/####/obligation.png
/data/media/####/open_eye.png
/data/media/####/order.css
/data/media/####/order.html
/data/media/####/order.png
/data/media/####/orderDetail.css
/data/media/####/orderDetail.html
/data/media/####/orderSettlement.css
/data/media/####/orderSettlement.html
/data/media/####/order_active.png
/data/media/####/pay.css
/data/media/####/pay.html
/data/media/####/paySuccess.css
/data/media/####/paySuccess.html
/data/media/####/pgico.png
/data/media/####/product.css
/data/media/####/product.html
/data/media/####/productDetail.css
/data/media/####/productDetail.html
/data/media/####/qq.png
/data/media/####/radio.png
/data/media/####/radio_active.png
/data/media/####/recipe.html
/data/media/####/refund.png
/data/media/####/refundAfter.css
/data/media/####/refundAfter.html
/data/media/####/register.css
/data/media/####/register.html
/data/media/####/reset.css
/data/media/####/right.png
/data/media/####/safe.png
/data/media/####/scan.html
/data/media/####/search.css
/data/media/####/search.html
/data/media/####/search.png
/data/media/####/search_one.png
/data/media/####/secondClass.css
/data/media/####/secondClass.html
/data/media/####/select.png
/data/media/####/select_active.png
/data/media/####/setting.css
/data/media/####/setting.html
/data/media/####/setting.png
/data/media/####/setting_one.png
/data/media/####/share.png
/data/media/####/shipping.png
/data/media/####/shopCart.css
/data/media/####/shopCart.html
/data/media/####/signIn.css
/data/media/####/signin.html
/data/media/####/star.png
/data/media/####/star_active.png
/data/media/####/statement.css
/data/media/####/statement.html
/data/media/####/statement.png
/data/media/####/success.png
/data/media/####/successPhone.css
/data/media/####/successPhone.html
/data/media/####/swiper.min.css
/data/media/####/swiper.min.js
/data/media/####/system.png
/data/media/####/template.js
/data/media/####/test.log
/data/media/####/text.html
/data/media/####/tgyh.png
/data/media/####/tjico.png
/data/media/####/toRating.css
/data/media/####/toRating.html
/data/media/####/triangle.png
/data/media/####/twen.png
/data/media/####/typs.png
/data/media/####/used.png
/data/media/####/user.css
/data/media/####/user.html
/data/media/####/user.png
/data/media/####/user_active.png
/data/media/####/user_bg.png
/data/media/####/util.js
/data/media/####/weixin.png
/data/media/####/weixin_one.png
/data/media/####/weixin_pay.png
/data/media/####/wz1.png
/data/media/####/xh1.png

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24191 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24191 300 0

Loads the following dynamic libraries:

getuiext3
libjiagu-697684339

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial