Adware.Gexin.533

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) u.pand####.cn:80
TCP(HTTP/1.1) m1.pand####.cn:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) acco####.go####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

acco####.go####.com
adser####.go####.com
f####.gst####.com
i####.pand####.cn
m1.pand####.cn
ssl.gst####.com
u.pand####.cn
www.go####.com
www.go####.nl
www.gst####.com

HTTP GET requests:

m1.pand####.cn/Api/PlatProps/CheckAppVersion?AppType=####
m1.pand####.cn/Api/PlatProps/CheckAppVersion?isDiff=####&android=####&ap...
m1.pand####.cn/assets/2018/04/19/1ff3ed51852-67044_png!300x375.png
m1.pand####.cn/assets/2018/04/19/1ff932f7295-61487_png!400x180.png
m1.pand####.cn/assets/2018/04/29/3311e2b6451-275220_jpg!800x800.jpg
m1.pand####.cn/assets/2018/04/29/336cc5a2041-143150_jpg!800x800.jpg
m1.pand####.cn/assets/2018/04/30/342bcb57815-9600_png!100x100.png
m1.pand####.cn/assets/2018/04/30/342d5249197-9600_png!100x100.png
m1.pand####.cn/assets/2018/04/30/34445b91613-11097_png!100x100.png
m1.pand####.cn/assets/2018/04/30/344a57e3093-13357_png!100x100.png
m1.pand####.cn/assets/2018/04/30/344f7449582-10445_png!100x100.png
m1.pand####.cn/assets/2018/04/30/347614e6113-10754_png!100x100.png
m1.pand####.cn/assets/2018/04/30/348f38e9001-10243_png!100x100.png
m1.pand####.cn/assets/2018/04/30/34add5a1886-10801_png!100x100.png
m1.pand####.cn/assets/2018/04/30/34d94c55671-12192_png!100x100.png
m1.pand####.cn/assets/2018/05/21/6a8dddf6889-223912_jpg!800x800.jpg
m1.pand####.cn/assets/2018/05/25/2b1b2c01005-333809_jpg!1500x1500.jpg
m1.pand####.cn/assets/2018/06/04/26a989b9071-188862_jpg!1134x1134.jpg
m1.pand####.cn/assets/2018/06/04/27654175372-247000_png!800x360.png
m1.pand####.cn/assets/2018/06/06/1ea9b1f4931-83918_jpg!591x591.jpg
m1.pand####.cn/assets/2018/06/07/6bf72da6890-278499_jpg!800x800.jpg
m1.pand####.cn/assets/2018/06/09/1646bc87375-155305_jpg!1181x1181.jpg
m1.pand####.cn/assets/2018/06/09/17785741169-207933_jpg!1181x1181.jpg
m1.pand####.cn/assets/2018/06/09/565c7073129-165210_jpg!1181x1181.jpg
m1.pand####.cn/assets/2018/06/11/3371cf62134-367579_jpg!1600x1600.jpg
m1.pand####.cn/assets/2018/06/13/51728ba6527-197721_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/13/58a3bee6517-193712_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/14/1315d5c5096-215221_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/14/14e9b2c2154-142140_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/15/2818b762328-328732_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/15/342edc23511-287559_jpg!500x500.jpg
m1.pand####.cn/assets/2018/06/22/262c1bd6158-146419_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/22/2aedeb87633-216248_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/22/39756ee3621-121178_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/28/342ea739109-182276_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/07/04/331edf08797-148758_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/07/04/34014673366-203384_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/07/09/2800abb4308-143874_jpg!684x178.jpg
m1.pand####.cn/assets/2018/07/14/2a6476c6096-373514_jpg!750x750.jpg
m1.pand####.cn/assets/2018/07/14/347400a9206-141520_jpg!800x800.jpg
m1.pand####.cn/assets/2018/07/14/34ad2862347-245984_jpg!750x1177.jpg
m1.pand####.cn/assets/2018/07/17/1ced6b59296-231854_jpg!750x360.jpg
m1.pand####.cn/assets/2018/07/17/1d510125956-297743_jpg!750x360.jpg
m1.pand####.cn/assets/2018/07/17/1d55a759768-267501_jpg!750x360.jpg
m1.pand####.cn/assets/images/loading-74-74.gif

HTTP POST requests:

m1.pand####.cn/Api/Ad/IndexAd
m1.pand####.cn/Api/Article/HeadLine
m1.pand####.cn/Api/Product/Index
m1.pand####.cn/Api/Slide/IndexBanner
m1.pand####.cn/api/PlatProps/PlatBaseData
u.pand####.cn/api/PlatProps/PlatVendor
u.pand####.cn/api/PlatProps/SetUserMenuStates
u.pand####.cn/api/PlatProps/UserMenuStates

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/003406b2de617e6639f8d0abca6da6970f0fe184928437b....0.tmp
/data/data/####/05b6db77f693393124f8a6aec0328195420b304dde0abdf....0.tmp
/data/data/####/11356bc48f066c037f759bd6f1d2dc0ae3b3f1ef13612f2....0.tmp
/data/data/####/127c28775d58ff86a46da8dffeeff45773dc29c1ef227e4....0.tmp
/data/data/####/157806c1fcab91f2523edd409a2de223272fa28aacb5ab2....0.tmp
/data/data/####/16f24bff1b3c37ddca1c29f3e0ed9ab25782a6a8cc6197e....0.tmp
/data/data/####/263806090db857964d9ea2878b10ac534cf4abf2e1b2cbe....0.tmp
/data/data/####/29a397d8bee17938933261a49102c384452f40957d1d320....0.tmp
/data/data/####/2ebacbfd9641db8d854b33277aac86ab88aac208a1d7419....0.tmp
/data/data/####/32ef0ee0a49e3668864245536fbcd48d7250849ea258563...0a11.0
/data/data/####/3393dd130842f48b98e1dea50d1861d555920175dff6f93....0.tmp
/data/data/####/3c0dc1587f6c048105d61aed6736b1dda01518adcec81e5....0.tmp
/data/data/####/419f32f4d8448c79e0798636efcab59a2e5ae89ab3f1c85...a558.0
/data/data/####/4696f0a1b848a3ac6ea3ed2280274492b96a39dd31eb70b....0.tmp
/data/data/####/4d403c89a19ce446a803dfd12d193989c36fe907d95906c...ab80.0
/data/data/####/545d4bfd6ae1f8ef79f4e4e103eb792ce35b1bb1f2ae135....0.tmp
/data/data/####/5cfeaca236a16fdc29e8fa55b2a8fa88ee8a37655f805d7....0.tmp
/data/data/####/5f1fe2a3d04c097f2b16d0fd4cc73935789a0daa9846930....0.tmp
/data/data/####/627f032d0dc96e2ccaed9c418de3fbfcb9bc27e3e8fba84....0.tmp
/data/data/####/6636e7d21ca3bf686c794e7fc9be31c0a725a9980a346b4....0.tmp
/data/data/####/67764763cbfe6f4cb24e6c6119327ede9878231fc6a61f9....0.tmp
/data/data/####/6a3639b2b634f2529732859c63ad1247f2db2bc54f5a415....0.tmp
/data/data/####/6be8ca62053f136437bc2488f290fc7b390e9218c511ae6....0.tmp
/data/data/####/6df68fc5e88f4f2a61c7d460fb7e9a125a86a76c98c02ae....0.tmp
/data/data/####/729d057447c6ddd9da3209f2a763c9089c3ace8bbba2c45...e8cf.0
/data/data/####/80c936794af6a728a150c8df6d96e1b5560519bfbff58c5...84f7.0
/data/data/####/81a6488ebe5c8f34285faf8a1052021d0dba9630780b20f....0.tmp
/data/data/####/89e224dc80a2543dbf8eaf84c6efbaea3c1caf0e82fa86e....0.tmp
/data/data/####/8c5c7e3573f91d921efec8e60eebca2bdd93565e6344ec0....0.tmp
/data/data/####/8d51c683344556c1035d5caad4aba5504ba5f32662c59a6....0.tmp
/data/data/####/BMWEEXOPEN_NATIVE_SP.xml
/data/data/####/CookiePrefsFile.xml
/data/data/####/MultiDex.lock
/data/data/####/Updater.xml
/data/data/####/WXStorage-journal
/data/data/####/a0349013119a33077d21422517bce145dd141284af4adee....0.tmp
/data/data/####/a3ddea343629048da7ecf445fb77938f5e84d67cee71cb2....0.tmp
/data/data/####/a866d9924085ee8f34ef3ca85b281f62213790fc7f87b4d....0.tmp
/data/data/####/ab2b34fc6dc63c39298a6defe8a10a118ad1081ab8b07fd....0.tmp
/data/data/####/aba2dfec2ba4efd3294f3124fb2cb9960e17c7d10ea995c....0.tmp
/data/data/####/b00693d6f74b3e821b857e67c97448c623e5d20b0deafa3....0.tmp
/data/data/####/bb88f479d5be07bf027bde882a707ebfb0cafeefc40f931....0.tmp
/data/data/####/bd962bba59d019359d7f05f5013201769053874f659cb89....0.tmp
/data/data/####/c19e7f1d5450b3c50a118970dc9419894ac6e81873b8dda....0.tmp
/data/data/####/c3fa7ccc560042c85e1ae135db80852c54584294f8f4089....0.tmp
/data/data/####/c5c56aa4f6f0378aa5d28e4a3808f60e5a103363f7c2343....0.tmp
/data/data/####/cb1a0aadaa770e107345cf2251aa50fef7f772271892ae8....0.tmp
/data/data/####/ccef1c860c7e291985e1563b108acc9e8d234a119e588c6....0.tmp
/data/data/####/d702871a7d680bc87cbcbcec2bb5cb3a22086061748ba8d....0.tmp
/data/data/####/e0424e8ffcf4e7563289d5d093a78a235403e17c9a915a1....0.tmp
/data/data/####/e270d14a37e990a2f91e98092b3b9b1e7d5505c70afc891....0.tmp
/data/data/####/e338d1fa72a13826a35aa7df1376975abaa97b9fbc358a6....0.tmp
/data/data/####/e4f3382968ac99eadbcf9c26dd9e9650d45b888ce72524d....0.tmp
/data/data/####/f9feef708e21d3a96ed74ca01247fd88489afd260e8d243....0.tmp
/data/data/####/fb446f29e66abf7783097f81a36ffd5692ba2352b751d15....0.tmp
/data/data/####/fe857b92f4999ca2c210239c53dc4ccca42c806fb46a8a3....0.tmp
/data/data/####/journal.tmp
/data/data/####/libjiagu1390117721.so
/data/data/####/libweexjsb.so
/data/data/####/multidex.version.xml
/data/media/####/.nomedia
/data/media/####/Share.png
/data/media/####/ad_sel.png
/data/media/####/add.png
/data/media/####/addAddress.js
/data/media/####/addressEdit.js
/data/media/####/agencyArea.js
/data/media/####/agencyAreaStat.js
/data/media/####/agentDistribution.js
/data/media/####/appSaveImageSlider.js
/data/media/####/applyAgent.js
/data/media/####/applyUpgrade.js
/data/media/####/arror.png
/data/media/####/award.js
/data/media/####/b1.png
/data/media/####/b10.png
/data/media/####/b11.png
/data/media/####/b12.png
/data/media/####/b2.png
/data/media/####/b3.png
/data/media/####/b4.png
/data/media/####/b5.png
/data/media/####/b6.png
/data/media/####/b7.png
/data/media/####/b8.png
/data/media/####/b9.png
/data/media/####/bankEdit.js
/data/media/####/blank.html
/data/media/####/blank.png
/data/media/####/bot_arrow_1.png
/data/media/####/bot_arrow_2.png
/data/media/####/bundle.zip
/data/media/####/buy.png
/data/media/####/c10_ico.png
/data/media/####/c11_ico.png
/data/media/####/c12_ico.png
/data/media/####/c13_ico.png
/data/media/####/c14_ico.png
/data/media/####/c15_ico.png
/data/media/####/c16_ico.png
/data/media/####/c17_ico.png
/data/media/####/c18_ico.png
/data/media/####/c19_ico.png
/data/media/####/c1_ico.png
/data/media/####/c20_ico.png
/data/media/####/c21_ico.png
/data/media/####/c22_ico.png
/data/media/####/c23_ico.png
/data/media/####/c24_ico.png
/data/media/####/c25_ico.png
/data/media/####/c26_ico.png
/data/media/####/c27_ico.png
/data/media/####/c2_ico.png
/data/media/####/c31_ico.png
/data/media/####/c32_ico.png
/data/media/####/c33_ico.png
/data/media/####/c3_ico.png
/data/media/####/c4_ico.png
/data/media/####/c5_ico.png
/data/media/####/c6_ico.png
/data/media/####/c7_ico.png
/data/media/####/c8_ico.png
/data/media/####/c9_ico.png
/data/media/####/card.png
/data/media/####/card_pic.png
/data/media/####/center_bg.png
/data/media/####/close.png
/data/media/####/code.png
/data/media/####/code_ico.png
/data/media/####/collect_off.png
/data/media/####/collect_on.png
/data/media/####/commission.js
/data/media/####/cumulativeInventory.js
/data/media/####/evaluationList.js
/data/media/####/evaluationSubmission.js
/data/media/####/exchange.js
/data/media/####/face.jpg
/data/media/####/face.png
/data/media/####/face1.jpg
/data/media/####/face1.png
/data/media/####/face2.png
/data/media/####/fhadd.png
/data/media/####/font_1469606063_76593.ttf
/data/media/####/font_1469606522_9417143.woff
/data/media/####/font_zn5b3jswpofuhaor.ttf
/data/media/####/forget.js
/data/media/####/fx_ico1.png
/data/media/####/fx_ico2.png
/data/media/####/fx_ico3.png
/data/media/####/gamesList.js
/data/media/####/home_ico.png
/data/media/####/icon_close.png
/data/media/####/iconfont-eros.ttf
/data/media/####/iconfont.ttf
/data/media/####/index.js
/data/media/####/index_banner_bg.png
/data/media/####/integral.js
/data/media/####/join.js
/data/media/####/joininfo.js
/data/media/####/kefu.js
/data/media/####/kefu.png
/data/media/####/kejian.png
/data/media/####/list-card.png
/data/media/####/lmtt_ico.png
/data/media/####/loading-50-50.gif
/data/media/####/loading-74-74.gif
/data/media/####/login.js
/data/media/####/logo.png
/data/media/####/md5.json
/data/media/####/messageDetail.js
/data/media/####/messages.js
/data/media/####/modifyPwd.js
/data/media/####/msg_agent.png
/data/media/####/msg_distribution.png
/data/media/####/msg_finance.png
/data/media/####/msg_ico.png
/data/media/####/msg_order.png
/data/media/####/msg_other.png
/data/media/####/msg_system.png
/data/media/####/myCollect.js
/data/media/####/myFans.js
/data/media/####/myTeam.js
/data/media/####/n1_ico.png
/data/media/####/n2_ico.png
/data/media/####/n3_ico.png
/data/media/####/n4_ico.png
/data/media/####/n5_ico.png
/data/media/####/nav1.png
/data/media/####/nav2.png
/data/media/####/nav3.png
/data/media/####/nav4.png
/data/media/####/nav5.png
/data/media/####/nearbyStores.js
/data/media/####/none_ico.png
/data/media/####/off_check.png
/data/media/####/off_radio.png
/data/media/####/onlinekefu.png
/data/media/####/orderDetail.js
/data/media/####/orderList.js
/data/media/####/orderLogistics.js
/data/media/####/orderPay.js
/data/media/####/orderPut.js
/data/media/####/parentchildComment.js
/data/media/####/parentchildLive.js
/data/media/####/parentchildTV.js
/data/media/####/parentchildTVList.js
/data/media/####/paySuccess.js
/data/media/####/pcode_ico.png
/data/media/####/photo_ico.png
/data/media/####/pl_ico.png
/data/media/####/pl_ico1.png
/data/media/####/post_ico.png
/data/media/####/post_icoy.png
/data/media/####/price.png
/data/media/####/pro.png
/data/media/####/pro1.png
/data/media/####/pro2.png
/data/media/####/proDetail.js
/data/media/####/proList.js
/data/media/####/pro_1.png
/data/media/####/pro_2.png
/data/media/####/product1.png
/data/media/####/psd.png
/data/media/####/purchase.js
/data/media/####/purchaseApplications.js
/data/media/####/purchaseMoney.js
/data/media/####/q1.png
/data/media/####/q2.png
/data/media/####/q3.png
/data/media/####/q4.png
/data/media/####/qou.png
/data/media/####/qq_ico.png
/data/media/####/rebate.js
/data/media/####/rebatePerformance.js
/data/media/####/rebateStat.js
/data/media/####/rebateTable.js
/data/media/####/recharge.js
/data/media/####/recommendFriends.js
/data/media/####/register.js
/data/media/####/remittanceCertificate.js
/data/media/####/resetpwd.js
/data/media/####/saixuan.png
/data/media/####/salesSend.js
/data/media/####/saveImageSlider.js
/data/media/####/search.png
/data/media/####/search_ico.png
/data/media/####/sel_check.png
/data/media/####/sel_radio.png
/data/media/####/sendBackProduct.js
/data/media/####/sendGoods.js
/data/media/####/set_face.png
/data/media/####/setting.js
/data/media/####/sfz1.png
/data/media/####/sfz2.png
/data/media/####/share.js
/data/media/####/share_wx_circle.png
/data/media/####/share_wx_friend.png
/data/media/####/ship1.js
/data/media/####/ship2.js
/data/media/####/ship3.js
/data/media/####/shipOrder.js
/data/media/####/shipmentMoney.js
/data/media/####/shop.png
/data/media/####/shop_ico.png
/data/media/####/star-off.png
/data/media/####/star-on.png
/data/media/####/star.png
/data/media/####/statistics.js
/data/media/####/stock.js
/data/media/####/stockRecord.js
/data/media/####/storeDetail.js
/data/media/####/storeManage.js
/data/media/####/subordinate.js
/data/media/####/suc_pic.png
/data/media/####/t_bg.png
/data/media/####/teamOrder.js
/data/media/####/tel.png
/data/media/####/tj_banner.png
/data/media/####/top_arrow_1.png
/data/media/####/top_arrow_2.png
/data/media/####/tvDetail.js
/data/media/####/tv_ico.png
/data/media/####/tz1.png
/data/media/####/tz2.png
/data/media/####/up.jpg
/data/media/####/upgrade.js
/data/media/####/userBill.js
/data/media/####/userinfo.js
/data/media/####/vip_ico.png
/data/media/####/warehouseStock.js
/data/media/####/webView.js
/data/media/####/weix_ico.png
/data/media/####/withdraw.js
/data/media/####/withdrawList.js
/data/media/####/wx_ico.png
/data/media/####/xz_ico.png
/data/media/####/xzlogo.png
/data/media/####/yuer_ico.png
/data/media/####/zan.png
/data/media/####/zan1.png
/data/media/####/zt_ico1.png
/data/media/####/zt_ico2.png
/data/media/####/zy_img.png

Miscellaneous:

Executes next shell scripts:

/data/app-lib/<Package>-1/libweexjsb.so 48 0
chmod 755 <Package Folder>/.jiagu/libjiagu1390117721.so

Loads the following dynamic libraries:

Patcher
libjiagu1390117721
weexjsc

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial