Adware.Gexin.7630

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) img.la####.com:80
TCP(HTTP/1.1) m.la####.com:80
TCP(HTTP/1.1) yan####.n####.127.net:80
TCP(HTTP/1.1) i####.j####.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(TLS/1.0) as.alipayo####.com:443
TCP(TLS/1.0) api.growi####.com:443
TCP(TLS/1.0) m.la####.com:443
TCP(TLS/1.0) new####.la####.com:443
TCP(TLS/1.0) c####.la####.com:443
TCP(TLS/1.0) dl.la####.com:443
TCP(TLS/1.0) img.la####.com:443
TCP(TLS/1.0) i####.j####.com:443
TCP(TLS/1.0) as####.growi####.com.####.net:443
TCP(TLS/1.0) t####.growi####.com:443
TCP(TLS/1.0) p####.tc.qq.com:443
TCP(TLS/1.0) s####.tc.qq.com:443
TCP(TLS/1.0) hk.wagbr####.non####.####.com:443

DNS requests:

a####.exc.mob.com
api.growi####.com
as####.growi####.com
as.alipayo####.com
c####.la####.com
dl.la####.com
i####.360bu####.com
img.la####.com
m.la####.com
new####.la####.com
p02.s####.cn
qzones####.g####.cn
r####.wx.qq.com
t####.growi####.com
y####.al####.com
yan####.n####.127.net

HTTP GET requests:

i####.j####.com/2016/1500219077/original_1500219077_1_1.jpg?x-oss-proces...
i####.j####.com/2017/1500260397/original_1500260397_1_1.jpg?x-oss-proces...
i####.j####.com/2018/5100291143/original_5100291143_1_01.jpg?x-oss-proce...
img.la####.com/jianbao/website/2015/06/8aec6a547f83d8062216d74aa39fba9c....
img.la####.com/jianbao/website/2015/08/24/6bdaf0e771804f7e92f0f8f65556e1...
img.la####.com/jianbao/website/2015/08/24/e3d9de2943dd4ae88923809d3d6087...
img.la####.com/jianbao/website/2015/11/20/4efbbff2d7744248b1d1e29df1e04b...
img.la####.com/jianbao/website/2015/11/20/c599dadc5bd94763a4e39ea6d2519d...
img.la####.com/jianbao/website/2016/07/19/84f8929eeeff4782a1077cca244464...
img.la####.com/jianbao/website/2016/07/29/25078a73f20a48459cc84345b7da94...
img.la####.com/jianbao/website/2016/08/18/1891ce5c3edf4edc887f2a1e55902e...
img.la####.com/jianbao/website/2018/03/15/13/0c2bf21e5e6b4454954a4b4539d...
img.la####.com/jianbao/website/2018/04/20/18/ee5d8be85eb64553822b25af407...
img.la####.com/jianbao/website/2018/05/03/13/cd24d034f50540ac9f69a04007f...
img.la####.com/jianbao/website/2018/05/11/16/f80ad4815cfa42fda1932552d0a...
img.la####.com/jianbao/website/2018/05/15/15/35f7ed69852049a2955515b706d...
img.la####.com/jianbao/website/2018/05/17/14/97f17f5455054ec4a7895003c63...
img.la####.com/jianbao/website/2018/05/18/15/eb36d9d0980946a3bc2826ce921...
img.la####.com/jianbao/website/2018/05/29/10/fa8551f54c5a4876baa13e8bb46...
img.la####.com/jianbao/website/2018/05/29/16/c61f0c645d264c68b3854189a5d...
img.la####.com/jianbao/website/2018/05/29/17/89c4e933b8f24f9faf66afa50ef...
img.la####.com/jianbao/website/2018/05/30/14/0599dcf5ff9e422a940a0ccd55f...
img.la####.com/jianbao/website/2018/06/13/17/3d89574e04cb44c1861bf84e620...
img.la####.com/jianbao/website/2018/06/19/09/c93f75fdd98946e599e309567e3...
img.la####.com/jianbao/website/2018/07/03/11/9cf6313fd04b4be99a1c84fc76f...
img.la####.com/jianbao/website/2018/07/13/17/7839882e96c747998c9e7239180...
img.la####.com/jianbao/website/2018/07/25/15/bd4b9d2256574efbbb522d3a7b8...
img.la####.com/jianbao/website/2018/07/27/16/fee8c4011e6b4abba88d3c59edd...
img.la####.com/jianbao/website/2018/08/01/17/d1d13cb1e5e540698a8885c4328...
img.la####.com/jianbao/website/2018/08/09/17/41de852a2145404f8df34921cf4...
img.la####.com/jianbao/website/2018/08/10/10/740ad965a74b44418f893e998c4...
img.la####.com/jianbao/website/2018/08/14/10/80411d28e3a2473e9f8596f19da...
img.la####.com/jianbao/website/2018/08/14/15/d11a7d7e144a4b5790e904a92b3...
img.la####.com/jianbao/website/2018/08/17/09/5f125f5536d947dba522ff702dc...
img.la####.com/jianbao/website/2018/08/22/13/99ab2d2f87d34566b5b8407864b...
img.la####.com/jianbao/website/2018/08/22/17/edfafd39b38e46e7acfaa9e545a...
img.la####.com/jianbao/website/2018/08/23/22/bdb6d2066b7c466e9aff8a73f3b...
img.la####.com/jianbao/website/2018/08/24/14/f5b051323eb242d7914ae3bd4b9...
img.la####.com/jianbao/website/2018/08/27/09/8d9f8eb6fda645e3ac847b7fa53...
img.la####.com/jianbao/website/2018/08/29/10/03137f13d2794ba29c81df0deb9...
img.la####.com/jianbao/website/2018/08/29/15/91e09c42caab47c89453b6eb28f...
img.la####.com/jianbao/website/2018/08/30/09/73bbb4fb6f1b4df79c11c3b8b5f...
img.la####.com/jianbao/website/2018/09/03/22/1d3e309a83394ae98b1d8a43b2c...
img.la####.com/jianbao/website/2018/09/05/15/6bcf8392bb194f90a9d63661f75...
img.la####.com/jianbao/website/2018/09/11/17/621e6dbc19e545199fca24d5b3c...
img.la####.com/jianbao/website/2018/09/13/20/98a5683fccb2450ea6d7aaa90ef...
img.la####.com/jianbao/website/2018/09/14/16/894170f7675b4b93843065b0d84...
img.la####.com/jianbao/website/2018/09/17/17/3ddeef7d0db6400cacc85bbb109...
img.la####.com/jianbao/website/2018/09/18/09/42405f7acae44b0bb4faa1c4884...
img.la####.com/jianbao/website/2018/09/18/09/808127e2cb244b9a88c3b708349...
img.la####.com/jianbao/website/2018/09/18/15/d9eac410d4334639b75e77d8c04...
img.la####.com/jianbao/website/2018/09/20/13/42962b3f5b5a4df69a9e51d829c...
img.la####.com/jianbao/website/2018/09/20/20/f452cf5137934f95a3e447c76b4...
img.la####.com/jianbao/website/2018/09/21/15/7104e8bd55834253833cbc9db28...
img.la####.com/jianbao/website/2018/09/25/20/25926ba9c7254d5aac625af0878...
img.la####.com/jianbao/website/2018/09/25/20/7e4b0a143a5447ceb2eaa96e688...
img.la####.com/jianbao/website/2018/09/26/14/9dd16d27b3354048a06044d97c2...
img.la####.com/jianbao/website/2018/10/08/09/93585d80f8824211932a5a42357...
img.la####.com/jianbao/website/2018/10/12/14/d9fd7cd24ecd460f865ddd63ca1...
img.la####.com/jianbao/website/2018/10/12/16/073e837ba10c4f28a19e96de035...
img.la####.com/jianbao/website/2018/10/16/15/ec13b3b91a9c470d85b811ce25c...
img.la####.com/jianbao/website/2018/10/16/15/f29c3616374249689c7fd20e034...
img.la####.com/jianbao/website/2018/10/18/18/09defc05da8342d1b980247c01d...
img.la####.com/jianbao/website/2018/10/19/11/bc8054ca3bf8404a994956e3971...
img.la####.com/jianbao/website/2018/10/19/18/6adcdd75930b41a384a3cc3712d...
img.la####.com/jianbao/website/2018/10/22/15/739fe231713f493291d635b4627...
img.la####.com/jianbao/website/2018/10/30/09/69dc3c90d8f84ce3937385fbb1f...
img.la####.com/jianbao/website/2018/11/02/10/1f31bd6f49e142d89350900573d...
img.la####.com/jianbao/website/2018/11/06/21/34767548c114448db596d4fc774...
img.la####.com/jianbao/website/2018/11/07/10/19271899cf10411db3a1c86e854...
img.la####.com/jianbao/website/2018/11/08/14/c783ea58b957465ab910e27a75e...
img.la####.com/jianbao/website/2018/11/08/19/9ddbf63d98e344a8848a28efd10...
img.la####.com/jianbao/website/2018/11/16/08/f59d33bd8a604650aced9e7e0d7...
img.la####.com/jianbao/website/2018/11/28/15/afd57358ca8547b4b334a4c4005...
img.la####.com/jianbao/website/2018/12/05/14/0aaa2d8a40bc45c39968bd2ab1c...
img.la####.com/jianbao/website/2018/12/06/10/04deebd63725493a8bd278ab9a8...
img.la####.com/jianbao/website/2018/12/10/14/475539936d4d48df83ea9baf083...
img.la####.com/jianbao/website/2018/12/10/14/839f7463736742c992bc81531bd...
img.la####.com/jianbao/website/2018/12/13/10/6fe7073970de40609fe09c960e0...
img.la####.com/jianbao/website/2018/12/18/19/837e14a9a67c4482914e8bf0381...
img.la####.com/jianbao/website/2018/12/25/10/d8f783b4449c485198f8c960120...
img.la####.com/jianbao/website/2019/01/03/15/9443093dee074b8181a83519c56...
img.la####.com/jianbao/website/2019/01/07/09/281f1b10668049598f140f91fe0...
img.la####.com/jianbao/website/2019/01/07/09/3f5cfa1e64c14bc19764779761e...
img.la####.com/jianbao/website/2019/01/10/13/46b247631c26404abaaaaaee5bc...
img.la####.com/jianbao/website/2019/01/10/15/055868acdee74fbda38b50f34bf...
img.la####.com/jianbao/website/2019/01/10/15/3e608067ca9b4871973d8977136...
img.la####.com/jianbao/website/2019/01/10/15/5295189fe2dc4b17852483491fc...
img.la####.com/jianbao/website/2019/01/10/15/6f428fbaf4554d07bebffdfc909...
img.la####.com/jianbao/website/2019/01/10/15/82981100604f4068b49bd00945d...
img.la####.com/jianbao/website/2019/01/10/15/93d0ddb9bb414a5d8c6c5d03da5...
img.la####.com/jianbao/website/2019/01/10/15/bba1929592b94f599be96971e21...
img.la####.com/jianbao/website/2019/01/10/16/16030cbad2694a6da0842974029...
img.la####.com/jianbao/website/2019/01/10/16/99e65d39f8984af6bacda3cc9ff...
img.la####.com/jianbao/website/2019/01/10/16/ef11f59a1f6f4b7a944dfa49a54...
img.la####.com/jianbao/website/2019/01/10/16/eff165f9fa3f45cf8c15255fbfd...
img.la####.com/jianbao/website/2019/01/10/16/fc7646d850474cbab4426a4ce5e...
img.la####.com/jianbao/website/2019/01/10/20/d7712d4a5a4a4a2e8597f30c5d1...
img.la####.com/jianbao/website/2019/01/10/20/eb6047d317d645ce94756905949...
img.la####.com/jianbao/website/2019/01/11/15/325384872aea4fc18ef23c774a9...
img.la####.com/jianbao/website/2019/01/11/15/43807f0a3f424d01a40823495d4...
img.la####.com/jianbao/website/2019/01/11/15/ca50f7a80a954fecbb05287d29b...
img.la####.com/jianbao/website/2019/01/11/19/44779ff93d734eabb711f8bc92a...
m.la####.com/react/lbstatic/home.html
yan####.n####.127.net/342b46f8095c06d032408001e8302e53.png?x-oss-process...
yan####.n####.127.net/3ae2d2635a224332037ab112e628b51f.jpg?x-oss-process...
yan####.n####.127.net/444ef2f2557a304b98597510018719a8.png?x-oss-process...
yan####.n####.127.net/5493d10dd1698dbb5553a0c2ab1925fe.png?x-oss-process...
yan####.n####.127.net/679db9b60ecdbfbef9c783fd9072fa3f.png?x-oss-process...
yan####.n####.127.net/7008618a67e80396c233cf2f98787c42.png?x-oss-process...
yan####.n####.127.net/73a7bb47e466943cf6b883e23d7d7844.jpg?x-oss-process...
yan####.n####.127.net/96281fdc7a4b21b1aa59e87594b8a9de.jpg?x-oss-process...

HTTP POST requests:

a####.exc.mob.com/errconf

File system changes:

Creates the following files:

/data/data/####/.duid
/data/data/####/.jg.ic
/data/data/####/.lock
/data/data/####/.vpl_lock
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/16549974b3fb8660f728cc4fb1285b5ac7c9ff6b6f9f499....0.tmp
/data/data/####/21c22f492aba3de8.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/MultiDex.lock
/data/data/####/Q0VSVC5SU0EK.txt8f4
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/XNSDKStore1.0.xml
/data/data/####/XNclientid.xml
/data/data/####/XNmachineid.xml
/data/data/####/com.laobai_preferences.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/domain_1
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/f_00003e
/data/data/####/f_00003f
/data/data/####/f_000040
/data/data/####/f_000041
/data/data/####/f_000042
/data/data/####/f_000043
/data/data/####/f_000044
/data/data/####/f_000045
/data/data/####/f_000046
/data/data/####/f_000047
/data/data/####/f_000048
/data/data/####/f_000049
/data/data/####/f_00004a
/data/data/####/f_00004b
/data/data/####/f_00004c
/data/data/####/f_00004d
/data/data/####/f_00004e
/data/data/####/f_00004f
/data/data/####/f_000050
/data/data/####/f_000051
/data/data/####/f_000052
/data/data/####/f_000053
/data/data/####/f_000054
/data/data/####/f_000055
/data/data/####/f_000056
/data/data/####/f_000057
/data/data/####/f_000058
/data/data/####/f_000059
/data/data/####/f_00005a
/data/data/####/f_00005b
/data/data/####/f_00005c
/data/data/####/f_00005d
/data/data/####/f_00005e
/data/data/####/f_00005f
/data/data/####/f_000060
/data/data/####/f_000061
/data/data/####/f_000062
/data/data/####/f_000063
/data/data/####/f_000064
/data/data/####/f_000065
/data/data/####/f_000066
/data/data/####/f_000067
/data/data/####/f_000068
/data/data/####/f_000069
/data/data/####/f_00006a
/data/data/####/f_00006b
/data/data/####/f_00006c
/data/data/####/f_00006d
/data/data/####/f_00006e
/data/data/####/f_00006f
/data/data/####/f_000070
/data/data/####/f_000071
/data/data/####/f_000072
/data/data/####/f_000073
/data/data/####/f_000074
/data/data/####/f_000075
/data/data/####/f_000076
/data/data/####/f_000077
/data/data/####/f_000078
/data/data/####/f_000079
/data/data/####/f_00007a
/data/data/####/f_00007b
/data/data/####/f_00007c
/data/data/####/f_00007d
/data/data/####/f_00007e
/data/data/####/f_00007f
/data/data/####/f_000080
/data/data/####/f_000081
/data/data/####/f_000082
/data/data/####/f_000083
/data/data/####/f_000084
/data/data/####/f_000085
/data/data/####/f_000086
/data/data/####/f_000087
/data/data/####/f_000088
/data/data/####/f_000089
/data/data/####/f_00008a
/data/data/####/f_00008b
/data/data/####/f_00008c
/data/data/####/f_00008d
/data/data/####/f_00008e
/data/data/####/f_00008f
/data/data/####/f_000090
/data/data/####/f_000091
/data/data/####/f_000092
/data/data/####/f_000093
/data/data/####/f_000094
/data/data/####/f_000095
/data/data/####/f_000096
/data/data/####/f_000097
/data/data/####/f_000098
/data/data/####/f_000099
/data/data/####/f_00009a
/data/data/####/f_00009b
/data/data/####/f_00009c
/data/data/####/f_00009d
/data/data/####/f_00009e
/data/data/####/f_00009f
/data/data/####/f_0000a0
/data/data/####/f_0000a1
/data/data/####/f_0000a2
/data/data/####/f_0000a3
/data/data/####/f_0000a4
/data/data/####/f_0000a5
/data/data/####/f_0000a6
/data/data/####/f_0000a7
/data/data/####/f_0000a8
/data/data/####/f_0000a9
/data/data/####/f_0000aa
/data/data/####/f_0000ab
/data/data/####/f_0000ac
/data/data/####/f_0000ad
/data/data/####/f_0000ae
/data/data/####/f_0000af
/data/data/####/f_0000b0
/data/data/####/f_0000b1
/data/data/####/f_0000b2
/data/data/####/f_0000b3
/data/data/####/f_0000b4
/data/data/####/f_0000b5
/data/data/####/f_0000b6
/data/data/####/f_0000b7
/data/data/####/f_0000b8
/data/data/####/f_0000b9
/data/data/####/f_0000ba
/data/data/####/f_0000bb
/data/data/####/f_0000bc
/data/data/####/f_0000bd
/data/data/####/f_0000be
/data/data/####/f_0000bf
/data/data/####/f_0000c0
/data/data/####/f_0000c1
/data/data/####/f_0000c2
/data/data/####/f_0000c3
/data/data/####/f_0000c4
/data/data/####/f_0000c5
/data/data/####/f_0000c6
/data/data/####/f_0000c7
/data/data/####/f_0000c8
/data/data/####/f_0000c9
/data/data/####/f_0000ca
/data/data/####/f_0000cb
/data/data/####/f_0000cc
/data/data/####/f_0000cd
/data/data/####/f_0000ce
/data/data/####/f_0000cf
/data/data/####/f_0000d0
/data/data/####/f_0000d1
/data/data/####/f_0000d2
/data/data/####/f_0000d3
/data/data/####/f_0000d4
/data/data/####/f_0000d5
/data/data/####/f_0000d6
/data/data/####/f_0000d7
/data/data/####/f_0000d8
/data/data/####/f_0000d9
/data/data/####/f_0000da
/data/data/####/f_0000db
/data/data/####/f_0000dc
/data/data/####/f_0000dd
/data/data/####/f_0000de
/data/data/####/f_0000df
/data/data/####/f_0000e0
/data/data/####/f_0000e1
/data/data/####/f_0000e2
/data/data/####/f_0000e3
/data/data/####/f_0000e4
/data/data/####/f_0000e5
/data/data/####/f_0000e6
/data/data/####/f_0000e7
/data/data/####/f_0000e8
/data/data/####/f_0000e9
/data/data/####/f_0000ea
/data/data/####/f_0000eb
/data/data/####/f_0000ec
/data/data/####/f_0000ed
/data/data/####/f_0000ee
/data/data/####/f_0000ef
/data/data/####/f_0000f0
/data/data/####/f_0000f1
/data/data/####/f_0000f2
/data/data/####/f_0000f3
/data/data/####/f_0000f4
/data/data/####/f_0000f5
/data/data/####/f_0000f6
/data/data/####/f_0000f7
/data/data/####/f_0000f8
/data/data/####/f_0000f9
/data/data/####/index
/data/data/####/journal.tmp
/data/data/####/key_has_token_id_transfer.xml
/data/data/####/key_has_user_id_transfer.xml
/data/data/####/key_token_id.xml
/data/data/####/kf_9630_ISME9754_guest5052151964925078883427322...ournal
/data/data/####/libjiagu-469820315.so
/data/data/####/libsgmainso-5.3.38.so.tmp
/data/data/####/lock.lock
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/multidex.version.xml
/data/data/####/page_referrer.xml
/data/data/####/sp.lock
/data/data/####/stat_page.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/user_id_model.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/xnsdkconfig.xml
/data/media/####/.artc_lock
/data/media/####/.di
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.im_lock
/data/media/####/.lesd_lock
/data/media/####/.mn_-1464060969
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.rc_lock
/data/media/####/.slw
/data/media/####/.ss_lock
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/dd7893586a493dc3
/data/media/####/hid.dat

Miscellaneous:

Executes the following shell scripts:

cat /sys/class/net/wlan0/address

Loads the following dynamic libraries:

libjiagu-469820315
sgmainso-5.3

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-ECB-NoPadding
AES-ECB-PKCS5Padding
PBEWithSHAAnd3-KeyTripleDES-CBC

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial