Android.Gexin.989

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Gexin.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) api.hzg####.com:80
TCP(HTTP/1.1) c.appj####.com:80
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.250.179.195:443
TCP(TLS/1.2) 1####.250.179.138:443
TCP(TLS/1.2) 1####.217.17.78:443
TCP sdk.o####.t####.####.com:5224

DNS requests:

and####.google####.com
android####.go####.com
api.hzg####.com
c.appj####.com
cm-1####.g####.com
cm-1####.g####.com
l####.tbs.qq.com
m####.go####.com
ope####.mob####.360.cn
p####.google####.com
sdk.c####.g####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

d####.c####.l####.####.com/config/hzv9.conf

HTTP POST requests:

api.hzg####.com/
c.appj####.com/ad/splash/stats.html
l####.tbs.qq.com/ajax?c=####&k=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/080baed39b2152655496b090ba9d59f2.png
/data/data/####/094e6629f8a0951576d6659451c0a11d.jpg
/data/data/####/11fc4d592899ff40bfac479260c523f9.png
/data/data/####/164dcdcfb1443aaf514b724110834d0e.png
/data/data/####/1c6090544ba90aaa37a7d477074002bc.png
/data/data/####/25804797a2f9e2858067fa59b848cf98.png
/data/data/####/2b13d4ad7fd0d3edb8b1bd3a21cbf5a8.jpg
/data/data/####/2d119d523fcdc019973526a284cb6ed2.jpg
/data/data/####/2f4e96618251d80230097a8647135fc6.png
/data/data/####/40c93515adbfe243e7d13f248bb38c1d.png
/data/data/####/45f3bdfe1f3edbb8b41dd9d5cf391fcc.png
/data/data/####/474787d1657b78a82d75b791c120982d.png
/data/data/####/4d5c3d5e4c0793d5692c669f97045468.png
/data/data/####/5174134781911267839
/data/data/####/6bbbf9d28c034a15c27cf59b025a0a59.png
/data/data/####/6d822821e85a774ccdf4fbd7a3ac19dc.png
/data/data/####/82eeeed2c442d6d732738e39f791fbca.png
/data/data/####/8ffa0751a55ba9f8296655c4248b1cc4.png
/data/data/####/90062eb67f82da80811194ed8826b3bc.jpg
/data/data/####/951eb0c0e983713be5a0eae95d93e0ba.png
/data/data/####/97f1e7c87dc51eadbe69037f4e797232.png
/data/data/####/9d9ffa24e335f728eeeadd960efc4647.png
/data/data/####/LegoPageletLoader_75c4d5c.js
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a6908114f37ecba66d77699b15bdc90d.png
/data/data/####/activity-detail.html
/data/data/####/activity-list.html
/data/data/####/activity-order-detail.html
/data/data/####/ad.jpg
/data/data/####/ad_show_time.xml
/data/data/####/additional-evaluate.html
/data/data/####/address-edit.html
/data/data/####/address-list.html
/data/data/####/aes.js
/data/data/####/app.js
/data/data/####/auction-agreement.html
/data/data/####/auction-earnest-money.html
/data/data/####/auction-goods-detail.html
/data/data/####/auction-list.html
/data/data/####/auction-record-list.html
/data/data/####/b0d19806e96f69ced0c26057d0ca2368.png
/data/data/####/b2cf0c5006a1af6859c479809c679d4b.png
/data/data/####/b58611cce8d4d7f8c394abe61474cc6f.png
/data/data/####/b66c1627e9c23b412d26796865105e74.png
/data/data/####/b7e892a23d8e3605b55932aa34323336.png
/data/data/####/base64.js
/data/data/####/bridge.js
/data/data/####/c1a4ba3de58439c51dadd6f452594ff3.png
/data/data/####/c63830eb36d99ee877bf8a84df23f1f1.png
/data/data/####/candidate-detail.html
/data/data/####/cart.html
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/com.dgbiz.huiwanjia_preferences.xml
/data/data/####/common.css
/data/data/####/common.js
/data/data/####/config.js
/data/data/####/constant.css
/data/data/####/copper-member.jpg
/data/data/####/core_info
/data/data/####/counter.js
/data/data/####/d5e78d6fe45318ec5509fa71a4e0e595.png
/data/data/####/default-shop-banner-bg.jpg
/data/data/####/diamonds-member.jpg
/data/data/####/district-popup.js
/data/data/####/district.js
/data/data/####/e3d9ab7ed1f153967d31df9152ec874e.png
/data/data/####/e6a100d53ce63136e12f730456b1c5ba.png
/data/data/####/earnest-money.jpg
/data/data/####/ejs.js
/data/data/####/evaluate.html
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f5b466662efd1d09fcf73d23921f49d7.png
/data/data/####/f7abed6a061340a240275c49c062317e.png
/data/data/####/fa787333779dcfba0be554c1afeba6b1.png
/data/data/####/flexible_d171afb.js
/data/data/####/function.css
/data/data/####/gold-member.jpg
/data/data/####/goods-collocation.jpg
/data/data/####/goods-combo.html
/data/data/####/goods-comment.html
/data/data/####/goods-detail-comment-list.html
/data/data/####/goods-detail.html
/data/data/####/goods-detail.jpg
/data/data/####/goods-list.html
/data/data/####/goods.js
/data/data/####/header_b68c1dc.jpg
/data/data/####/icon.eot
/data/data/####/icon.svg
/data/data/####/icon.ttf
/data/data/####/icon.woff
/data/data/####/index
/data/data/####/index.html
/data/data/####/init.pid
/data/data/####/init_c.pid
/data/data/####/integral-goods-confirm.html
/data/data/####/integral-goods-detail.html
/data/data/####/integral-shop.html
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/lib.js
/data/data/####/libjiagu.so
/data/data/####/localResizeIMG.js
/data/data/####/logistics-info.html
/data/data/####/m_customers_888602e.css.js
/data/data/####/md5.js
/data/data/####/member.html
/data/data/####/metrics_guid
/data/data/####/mobileBUGFix.mini.js
/data/data/####/my-enroll-list.html
/data/data/####/my-order.html
/data/data/####/my-panic-purchase-list.html
/data/data/####/news-list-title.png
/data/data/####/news-list.html
/data/data/####/order-confirm.html
/data/data/####/order-detail.html
/data/data/####/page-activity-detail.css
/data/data/####/page-activity-list.css
/data/data/####/page-activity-order-detail.css
/data/data/####/page-additional-evaluate.css
/data/data/####/page-auction-agreement.css
/data/data/####/page-auction-earnest-money.css
/data/data/####/page-auction-goods-detail.css
/data/data/####/page-auction-list.css
/data/data/####/page-auction-record-list.css
/data/data/####/page-candidate-detail.css
/data/data/####/page-cart.css
/data/data/####/page-evaluate.css
/data/data/####/page-goods-combo.css
/data/data/####/page-goods-comment.css
/data/data/####/page-goods-detail-comment-list.css
/data/data/####/page-goods-detail.css
/data/data/####/page-goods-list.css
/data/data/####/page-integral-goods-detail.css
/data/data/####/page-integral-shop.css
/data/data/####/page-logistics-info.css
/data/data/####/page-main.css
/data/data/####/page-member.css
/data/data/####/page-my-enroll-list.css
/data/data/####/page-my-order.css
/data/data/####/page-news-list.css
/data/data/####/page-order-detail.css
/data/data/####/page-order-distribution.css
/data/data/####/page-order-self-delivery.css
/data/data/####/page-panic-purchase-confirm.css
/data/data/####/page-panic-purchase-detail.css
/data/data/####/page-panic-purchase.css
/data/data/####/page-popularity-list.css
/data/data/####/page-refund-apply.css
/data/data/####/page-refund-detail.css
/data/data/####/page-service.css
/data/data/####/page-setting-address.css
/data/data/####/page-shop-category.css
/data/data/####/page-shop-index.css
/data/data/####/page-shop-main.css
/data/data/####/page-template.css
/data/data/####/page-vote-activity.css
/data/data/####/page-vote-enroll.css
/data/data/####/page-vote-index.css
/data/data/####/page-vote-list.css
/data/data/####/page-vote-popularity-list.css
/data/data/####/panic-purchase-bg.jpg
/data/data/####/panic-purchase-confirm.html
/data/data/####/panic-purchase-detail.html
/data/data/####/panic-purchase.html
/data/data/####/pic_jifen.jpg
/data/data/####/pic_paimai.jpg
/data/data/####/platinum-member.jpg
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qiyu_save_7dd175826909f45f8f2922b8e060c0b1.xml
/data/data/####/refund-apply.html
/data/data/####/refund-detail.html
/data/data/####/refund-log.html
/data/data/####/rights-order.html
/data/data/####/run.pid
/data/data/####/select-bg.png
/data/data/####/service.html
/data/data/####/share_data_updatesdk.xml
/data/data/####/sharedPreferences.xml
/data/data/####/shop-category.html
/data/data/####/shop-index.html
/data/data/####/shop-list.html
/data/data/####/silver-member.jpg
/data/data/####/slider.js
/data/data/####/swipe.js
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_download_stat.xml.bak
/data/data/####/tbslock.txt
/data/data/####/template.html
/data/data/####/the-real-index
/data/data/####/timg.jpg
/data/data/####/title_news.png
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/unicorn#cheese#
/data/data/####/version.txt
/data/data/####/vote-activity.html
/data/data/####/vote-enroll.html
/data/data/####/vote-index.html
/data/data/####/vote-list.html
/data/data/####/vote-list.png
/data/data/####/vote-popularity-list.html
/data/data/####/vote-popularity-list.png
/data/data/####/wastat_4feea64.js
/data/media/####/.nomedia
/data/media/####/tbslog.txt
/data/media/####/tmp_c_20210501
/data/media/####/tmp_u_20210501
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
RSA
RSA-ECB-NoPadding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial