Adware.Gexin.9069

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) scs.opensp####.cn:80
TCP(HTTP/1.1) 1####.241.32.224:80
TCP(HTTP/1.1) h####.opensp####.cn:80
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) cloud####.fengkon####.com:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(TLS/1.0) 2####.107.1.65:443
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) 1####.241.32.219:443
TCP(TLS/1.0) i####.ji####.com.####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) img####.ji####.com:443
TCP(TLS/1.0) redi####.network####.com:443
TCP(TLS/1.0) dc1.network####.com:443
TCP(TLS/1.0) 2####.107.1.1:443
TCP(TLS/1.0) a####.ji####.com:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443
TCP(TLS/1.0) jktt####.ji####.com:443
TCP(TLS/1.0) beacon####.aliy####.com:443
TCP(TLS/1.0) s####.ji####.com:443
TCP cloudco####.mta.qq.com:4002
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5224

DNS requests:

7j####.c####.z0.####.com
a####.ji####.com
a####.man.aliy####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
ap####.ji####.com
app-hy####.ji####.com
beacon####.aliy####.com
c####.g####.ig####.com
c-h####.g####.com
cloud####.fengkon####.com
cloudco####.mta.qq.com
d####.opensp####.cn
dc1.network####.com
f####.fengkon####.com
fe-####.ji####.com
h####.opensp####.cn
hotfix####.aliy####.com
i####.ji####.com
img####.ji####.com
img.ji####.com
jktt####.ji####.com
l####.tbs.qq.com
mbp.ji####.com
redi####.network####.com
s####.ji####.com
scs.opensp####.cn
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

h####.opensp####.cn/launchconfig?t=####&p=bWFsb####
t####.c####.q####.####.com/tdata_bca864
t####.c####.q####.####.com/tdata_ynp969

HTTP POST requests:

beacon####.aliy####.com/beacon/fetch/config/byappkey
c-h####.g####.com/api.php?format=####&t=####
cloud####.fengkon####.com/v2/device/conf
f####.fengkon####.com/v2/device/profile
l####.tbs.qq.com/ajax?c=####&k=####
scs.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
scs.opensp####.cn/scs?cmd=####&logver=####&size=####
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/039466f17efd31312baa2122a0f3d1f9f3aea36cb66cc8c....0.tmp
/data/data/####/069481a06679656483f08a4299c44d08d24661f341e3b56....0.tmp
/data/data/####/06bfee2bc4f8b4ef8950cd4f8513c0a8351ff8f56ca6a92....0.tmp
/data/data/####/0797d5ef0dcbded0a840610a98d461da5a9ad27dca7ec8b....0.tmp
/data/data/####/09185c6b7d74508930bff08a59dc98fe708bce3debd0c8d....0.tmp
/data/data/####/09d79e45601e2a1bf33f7e749b651d5f5572c1a851d9a37....0.tmp
/data/data/####/0d7aa38948e5e9833dc070d4b59178e68d148077a1ad922....0.tmp
/data/data/####/0fa5d500fbeb91abcd587fd484ec42c0f929bdf0840ea21....0.tmp
/data/data/####/0fb0c16250cfb478f0496dfb996f2e9dc0acf541dff6312....0.tmp
/data/data/####/155c2e97cd7a417aa83fde3d5026fcfb2d5b93d9d92cf9d....0.tmp
/data/data/####/17cf2bdf3ea3cdda755da3d9812b3589df0dfebde300cc6....0.tmp
/data/data/####/221b22ed78b9940d7a9877643a195fbbf63cb003381391c....0.tmp
/data/data/####/2563c6c7899491ee8ffb8f57b86263907850e4396f3441c....0.tmp
/data/data/####/267b63ce1d3ebc1c41579380a675ad0c22084b3661aa848....0.tmp
/data/data/####/283726d8a6bbdcdbf74b742319f23e292666fb92116cc50....0.tmp
/data/data/####/2bbbe7de726cacf3b58ac1759ca3746e431fca2c8edb595....0.tmp
/data/data/####/2f83c15641a9d855dbbf81be4a6be5da3f7f271b979723d....0.tmp
/data/data/####/355c4fa59ea92180b4dd8cdb103a525738bbb2de26fd6c1....0.tmp
/data/data/####/36d4aa7e42997b2514a6e69af82c63edff34ce426421a4e....0.tmp
/data/data/####/38c6805ceb7b6cf14511b78c55671ae056d9ee7ac0318c2....0.tmp
/data/data/####/3b07e50c2c35921ca394fc9796b21045d06b477c84231c2....0.tmp
/data/data/####/4062888c1612bd5f1a34d4f701e260435d14168cfd7775c....0.tmp
/data/data/####/41cb4655e94586ed730a56a4fdfe91a316b6de734cb969e....0.tmp
/data/data/####/446de147a8b5e97faf1aa20775a1b91500e8cf27ae78ab9....0.tmp
/data/data/####/57db6528cba5f2cc1eaaec842fd0d3cd6070366facf1154....0.tmp
/data/data/####/5c67d314a5b91df1464fcaadaa8cfb07b505513611df56f....0.tmp
/data/data/####/5e3f299a37679be49cf116d4048b2ebbe3be569d150c36b....0.tmp
/data/data/####/5f00d6e027d04254a83f1c6fac9ea8f1742d896258d185c....0.tmp
/data/data/####/6335d43fbf36320aec4ef1c1eb1798a816aff490e0b8a39....0.tmp
/data/data/####/690cc900636e336097af2c7069e0d50c0b2453746fcbabf....0.tmp
/data/data/####/6927a6c9f076eccdac4b35053ca10c2e9cf393b0d1a1062....0.tmp
/data/data/####/6fd2bd269c9565baf974287d817fcaba405a886901b5fc8....0.tmp
/data/data/####/701276dc1492dd86ddd0e2e473e40207609c306eebb780f....0.tmp
/data/data/####/703ee9f77723192fdafb0e9679abb7a732484abec77aa94....0.tmp
/data/data/####/7154935ff0d3fa22d40040775f850973597bca723d0005e....0.tmp
/data/data/####/72a179ef6b1a0a5fceeddad9e30025b18e70dccaad14822....0.tmp
/data/data/####/73ec1c94c51a8cab8e3e1d20e4ee7a214f1f09afa1d6bf9....0.tmp
/data/data/####/75ee53a7c66ecea370ffb2aefa7354b32f3557c34c94d76....0.tmp
/data/data/####/7613be9945014a668578b5fbd80b6e94c428382d50dbb63....0.tmp
/data/data/####/775bc654ac6dd95c9a620359476b6dc9c49f7b51c52559f....0.tmp
/data/data/####/78cd89a7eab765913d9c83a1b05c16fc00e94556e36cdf5....0.tmp
/data/data/####/7915530b775ee9bcc93f43a668653a8ee9f24db4343d840....0.tmp
/data/data/####/81854a2de66783a2e304029278db0b2032b8d9d5d24f7b2....0.tmp
/data/data/####/84e74ea0e2cb33ba343a9681155ec610ac97eb27a4742f1....0.tmp
/data/data/####/8d800a653a21c92cb6a66513807e2a279842f81afc3a123....0.tmp
/data/data/####/917c2fd4346b2faadb9fbf2ca1efc535c88a41dec1f927e....0.tmp
/data/data/####/917d93b6c16e8eaa4dedfdc05bef4cfc7cd8e44c9d83e94....0.tmp
/data/data/####/91bb6192302c3827f8996857088d87148fc17adce1a3bc0....0.tmp
/data/data/####/973a12ebf8431242fbb233c588041187659d53688b01b7a....0.tmp
/data/data/####/98008b763be814f65265d116bf9774e45d0113f11dc83ca....0.tmp
/data/data/####/9a1efb09c1371d8718e4974d3b3dc71989a4d3f63a4fd85....0.tmp
/data/data/####/9a62abf5502d026e452d2413337a42ea9717ef11ccdcd4a....0.tmp
/data/data/####/9cf0183d42637b4682321ea2ca5b7278fc0ae78822df6b3....0.tmp
/data/data/####/9d0e11aa23cbcde56378a3ae6b4cb44dd39922a7e4ce477....0.tmp
/data/data/####/9d21cc9df9bb7258247afc113baa74520e2b171fe297d34....0.tmp
/data/data/####/9df836a15eec0766344a7bf454c604b74485ef1b706d7d9....0.tmp
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/ContextData.xml
/data/data/####/JK_AreaRegion.xml
/data/data/####/NBSCrashStore.xml
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/StatisticsData.xml
/data/data/####/UTCommon.xml
/data/data/####/a41093dd24c0821f4d450fbde763f7750e4cc28e962fe4f....0.tmp
/data/data/####/a586d304e860e84dc459536e41c759d8648f3d71d10ad6f....0.tmp
/data/data/####/a5f45de7919b1bc9328684217a08d056500cfa5bd757f0c....0.tmp
/data/data/####/a66056b428e543a7bb990ef3b010e669b0f70ac1a69f3f1....0.tmp
/data/data/####/a7702153840a85523085984de4fcafc584e2c06fef62246....0.tmp
/data/data/####/a7def047ad0831f02bc2d6c4bddcebac7481a2a4d122f1d....0.tmp
/data/data/####/a8a9f5d727aa952a73489b3c3498f15c625767f0fc843be....0.tmp
/data/data/####/a8f0dada805bcd6e0d08fc85751cd65c8123bc68a49bb5c....0.tmp
/data/data/####/abe12a186efdeb7f9627cbce6c23e11f3cf2a7cc6419735....0.tmp
/data/data/####/ad524fc9d8dce36414a217267c00b71b48235bcbabe487a....0.tmp
/data/data/####/ap.Lock
/data/data/####/b9b54b67cf5978e7f75c8e1a064533300d7b9eeff9b2707....0.tmp
/data/data/####/c0f44c55f21ed0fa10cc49f5ded4dfb9e29087ab3f90199....0.tmp
/data/data/####/c330cbe0407960f0b04bbe6e07229c86d73c80dcaf20e3e....0.tmp
/data/data/####/c5338b351ab587f3afeb184d3d76a34d5b7e6af16d54619....0.tmp
/data/data/####/c54709fe432131a0fbe520c3e7cf344cd5217e2b24c9f92....0.tmp
/data/data/####/c7184bc3ddb571625f422ec3b4b80ac50cab589f059e96f....0.tmp
/data/data/####/c81f146652333eb0746fcb1938f84f482007b28da4db1a9....0.tmp
/data/data/####/ca25b0652433210222e5afde8d0567a76fda3fb859208f3....0.tmp
/data/data/####/cb9934cc536249cb9e74123ce368dcb83b69d1277789013....0.tmp
/data/data/####/cca480020b91c44bcfd7837c19fc2bb7c9d83c7e8225220....0.tmp
/data/data/####/cccd83da63eb5ca53735480b0db8818a776920134679ba2....0.tmp
/data/data/####/ccfcb01dcb8aa76ad5cbb12ebb52f71bc40eef8de812f71....0.tmp
/data/data/####/cf24ae2bc2731e338fa85de5a10b279c05a9222c6a97d21....0.tmp
/data/data/####/cloudms.conf.xml
/data/data/####/com.iflytek.id.xml
/data/data/####/com.iflytek.msc.xml
/data/data/####/com.jiankecom.jiankemall-journal
/data/data/####/com.jiankecom.jiankemall.cache.SplashCache.xml
/data/data/####/com.jiankecom.jiankemall_preferences.xml
/data/data/####/com.networkbench.agent.impl.v2_com.jiankecom.ji...ll.xml
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/com.shumei.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/core_info
/data/data/####/d17449ba3aa7242dd8fa2e53240b0aa68dd0683d9ebd981....0.tmp
/data/data/####/d18e08fd494a620e11c3f7da7753dcdcc5720dbc0c0054a....0.tmp
/data/data/####/d18e08fd494a620e11c3f7da7753dcdcc5720dbc0c0054a...a161.0
/data/data/####/d999096fa097b3fbbc8ebc8016a657a1157cbd6368d1445....0.tmp
/data/data/####/data.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/de30f01401270f92aa7c66bdb066a29e766d93c936b1300....0.tmp
/data/data/####/debug.conf
/data/data/####/e07184277814ab91af2cb748a4bb6bb362fb1a386049efa....0.tmp
/data/data/####/e128c91101e43a1dbaacbbe163792fa63c8428501ccd224....0.tmp
/data/data/####/e3bc2bfe95defb7b3dc5d379f902cb6c3fc80627bc13c5c....0.tmp
/data/data/####/ea0f1e5b1ba82bc1ccdb134e36e0cf5618ac19ea8d79629....0.tmp
/data/data/####/edb8d48151648e2c85af1ac4fd2cd817152e8cf943bfc25....0.tmp
/data/data/####/ef3c705bd0448c370d4dc9d911368b2c98dc01f11504eca....0.tmp
/data/data/####/efa29db80f8b670039f585c31540f6fe34be7d098880a9a....0.tmp
/data/data/####/f0dbf422269b8e02790c297c41546cdda56fa739b7dc13f....0.tmp
/data/data/####/f7013b3005741f1a02d6c5cda57c94a4a98362bc920affa....0.tmp
/data/data/####/fa47f7e30840fd18dbc41a06413107b492bff03bf811786....0.tmp
/data/data/####/faa785e3aa4595a0892dc3630534bbadee2cacce51c45cf....0.tmp
/data/data/####/fab3dd8282e8775f5b68a6bd08ca8b12b75a5090f0513a7....0.tmp
/data/data/####/feeab1cd69343b1de4807a983a32f58e1659836318774bb....0.tmp
/data/data/####/first_pref.xml
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/head_line.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_enable.xml
/data/data/####/ifly_launch_lib.xml
/data/data/####/iflytek_state_com.jiankecom.jiankemall.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/init_tables_pref.xml
/data/data/####/jk_appupdate_on.xml
/data/data/####/jk_chat_setting.xml
/data/data/####/jk_current_versioncode.xml
/data/data/####/jk_first_install.xml
/data/data/####/jk_mall.db-journal
/data/data/####/jk_myheadline_domain.xml
/data/data/####/jk_presentgift_setting.xml
/data/data/####/jk_rxsetting.xml
/data/data/####/jk_sp_member.xml
/data/data/####/jk_spcommon_data_healthCoinTip.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu535015368.so
/data/data/####/mail_settings.xml
/data/data/####/multidex.version.xml
/data/data/####/my_setting_pref.xml
/data/data/####/pri_tencent_analysis.db_com.jiankecom.jiankemal...ournal
/data/data/####/pri_tencent_analysis.db_com.jiankecom.jiankemall-journal
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sensorsdata.xml
/data/data/####/seq.xml
/data/data/####/sp_jk_component_setting.xml
/data/data/####/sp_jk_dynamicdns.xml
/data/data/####/sp_jk_is_openhttpdns.xml
/data/data/####/sp_search_keyword.xml
/data/data/####/sp_showphotoscan.xml
/data/data/####/sp_sophix.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.jar
/data/data/####/tdata_ynp969
/data/data/####/tdata_ynp969.jar
/data/data/####/tencent_analysis.db_com.jiankecom.jiankemall-journal
/data/data/####/tencent_analysis.db_com.jiankecom.jiankemall;pu...ournal
/data/data/####/tracker.db-journal
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/.thumbcache_idx0
/data/media/####/07c70eb6e5bdb75d47444784f5029561.0.tmp
/data/media/####/07c70eb6e5bdb75d47444784f5029561.1.tmp
/data/media/####/1c0fb2611b29f93e23b8ca5ee050e2bd.0.tmp
/data/media/####/1c0fb2611b29f93e23b8ca5ee050e2bd.1.tmp
/data/media/####/319dd1db1749c2458609df55ae83378f.0.tmp
/data/media/####/319dd1db1749c2458609df55ae83378f.1.tmp
/data/media/####/4d1ad6806e47f0a27feccc741ea5dd99.0.tmp
/data/media/####/4d1ad6806e47f0a27feccc741ea5dd99.1.tmp
/data/media/####/506e8ff9cbf5ecd838eb0e390cac1d44.0.tmp
/data/media/####/506e8ff9cbf5ecd838eb0e390cac1d44.1.tmp
/data/media/####/67612623a26c21c18795ca24f1463aaf.0.tmp
/data/media/####/67612623a26c21c18795ca24f1463aaf.1.tmp
/data/media/####/861a86bd9cbc98493c2e6809a8feb9f8.0.tmp
/data/media/####/861a86bd9cbc98493c2e6809a8feb9f8.1.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.db
/data/media/####/cf5c25954eac4f65abf1a3e8b3ecd5a2.0.tmp
/data/media/####/cf5c25954eac4f65abf1a3e8b3ecd5a2.1.tmp
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jiankecom.jiankemall.db
/data/media/####/dfe2e07847ae86a82f973fdea7c51c42.0.tmp
/data/media/####/dfe2e07847ae86a82f973fdea7c51c42.1.tmp
/data/media/####/f3e267c892520a5345070abd94707e73.0.tmp
/data/media/####/f3e267c892520a5345070abd94707e73.1.tmp
/data/media/####/helpYouProductList.json
/data/media/####/homepageListsNew.json
/data/media/####/iflyworkdir_test
/data/media/####/journal.tmp
/data/media/####/navigationBarAndSearchTitleResponse.json
/data/media/####/shumei.txt
/data/media/####/tdata_bca864
/data/media/####/tdata_ynp969
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25404 300 0
cat /proc/self/cgroup
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop ro.product.cpu.abi
ps
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25404 300 0

Loads the following dynamic libraries:

MtaNativeCrash_v2
getuiext3
libjiagu535015368
msc
smsdk
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES-ECB-NoPadding

Uses special library to hide executable bytecode.

Accesses camera interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial