Adware.Gexin.9699

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) v2.g####.qq.com:80
TCP(HTTP/1.1) c.g####.qq.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) v.g####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) cx.ika####.cn:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) j####.ika####.cn:80
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(HTTP/1.1) z####.ika####.cn:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) 1####.134.99.111:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) sh####.me####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5224

DNS requests:

7j####.c####.z0.####.com
a####.u####.com
c####.g####.ig####.com
c####.ika####.cn
c-h####.g####.com
c.g####.qq.com
cdn.ika####.cn
cx.ika####.cn
hm.b####.com
i####.ika####.cn
imgc####.qq.com
j####.ika####.cn
log.u####.com
mi.g####.qq.com
mo####.b####.com
p####.ugd####.com
pub-####.qin####.com
qzones####.g####.cn
s####.e.qq.com
s####.u####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sh####.me####.com
v.g####.qq.com
v2.g####.qq.com
z####.ika####.cn
z####.ika####.cn

HTTP GET requests:

c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
cx.ika####.cn//cx/bookdetail?cnid=####&uid=####&bookid=####&ufrom=####&c...
cx.ika####.cn/cx/getAdv?width=####&height=####&cnid=####&umeng=####&vers...
cx.ika####.cn/cx/index?cnid=####&umeng=####&version=####&vercode=####&im...
cx.ika####.cn/cx/itf/bookshelflist?updatetime=####&cnid=####
cx.ika####.cn/cx/itf/checkVersion?cnid=####&umeng=####&version=####&verc...
cx.ika####.cn/cx/itf/getvolume?bookId=####
cx.ika####.cn/cx/itf/gtInfo?cid=####&cnid=####&umeng=####&version=####&v...
cx.ika####.cn/cx/itf/taskInfo
cx.ika####.cn/pages/flindex.jsp?cnid=####&umeng=####&version=####&vercod...
cx.ika####.cn/static/css/animate.css?d86e540####&version=####
cx.ika####.cn/static/css/style.css?3b19f4f####&version=####
cx.ika####.cn/static/css/toast.css?b176d97####&version=####
cx.ika####.cn/static/images/author@2x.png
cx.ika####.cn/static/images/cate-down1-ff9f37.png
cx.ika####.cn/static/images/change_icon.png
cx.ika####.cn/static/images/change_mulu.png
cx.ika####.cn/static/images/change_nav.png
cx.ika####.cn/static/images/classify_b1.png
cx.ika####.cn/static/images/classify_b2.png
cx.ika####.cn/static/images/classify_b3.png
cx.ika####.cn/static/js/base.js?1bfcf56####
cx.ika####.cn/static/js/book.js?70e7f6a####
cx.ika####.cn/static/js/jquery-1.7.min.js?25721ce####
cx.ika####.cn/static/js/myself.js?392b358####
cx.ika####.cn/static/js/swipeSlide.js?c89247d####
cx.ika####.cn/static/js/swiper-3.3.1.jquery.min.js?5bbd6ca####
cx.ika####.cn/static/js/touch.js?cb8099c####
cx.ika####.cn/static/js/zepto.min.js?1abd55c####
d####.c####.l####.####.com/book_covers/3001818442.jpg
d####.c####.l####.####.com/book_covers/320891.jpg
d####.c####.l####.####.com/book_covers/359087.jpg
d####.c####.l####.####.com/book_covers/50003627.jpg
d####.c####.l####.####.com/book_covers/60002299.jpg
d####.c####.l####.####.com/book_covers/60033230.jpg
d####.c####.l####.####.com/book_covers/60450278.jpg
d####.c####.l####.####.com/book_covers/60560865.jpg
d####.c####.l####.####.com/book_covers/60683478.jpg
d####.c####.l####.####.com/book_covers/60733674.jpg
d####.c####.l####.####.com/book_covers/60799440.jpg
d####.c####.l####.####.com/book_covers/60809432.jpg
d####.c####.l####.####.com/book_covers/60813250.jpg
d####.c####.l####.####.com/book_covers/60884139.jpg
d####.c####.l####.####.com/book_covers/80001431.jpg
d####.c####.l####.####.com/book_covers/80001459.jpg
d####.c####.l####.####.com/book_covers/80001460.jpg
d####.c####.l####.####.com/book_covers/80001544.jpg
d####.c####.l####.####.com/book_covers/80002074.jpg
d####.c####.l####.####.com/book_covers/80002315.jpg
d####.c####.l####.####.com/book_covers/80002319.jpg
d####.c####.l####.####.com/book_covers/80002406.jpg
d####.c####.l####.####.com/book_covers/80002410.jpg
d####.c####.l####.####.com/book_covers/80002628.jpg
d####.c####.l####.####.com/book_covers/80010976.jpg
d####.c####.l####.####.com/book_covers/802000173.jpg
d####.c####.l####.####.com/book_covers/803201598.jpg
d####.c####.l####.####.com/book_covers/803201706.jpg
d####.c####.l####.####.com/book_covers/803201752.jpg
d####.c####.l####.####.com/book_covers/803202701.jpg
d####.c####.l####.####.com/book_covers/803202911.jpg
d####.c####.l####.####.com/book_covers/805200062.jpg
d####.c####.l####.####.com/book_covers/805900053.jpg
d####.c####.l####.####.com/book_covers/807000060.jpg
d####.c####.l####.####.com/book_covers/808500172.jpg
d####.c####.l####.####.com/book_covers/808500508.jpg
d####.c####.l####.####.com/book_covers/808800165.jpg
d####.c####.l####.####.com/book_covers/810300044.jpg
d####.c####.l####.####.com/book_covers/810300063.jpg
d####.c####.l####.####.com/book_covers/810300267.jpg
d####.c####.l####.####.com/book_covers/810300685.jpg
d####.c####.l####.####.com/book_covers/812100012.jpg
d####.c####.l####.####.com/book_covers/812300041.jpg
d####.c####.l####.####.com/book_covers/813600107.jpg
d####.c####.l####.####.com/book_covers/814800001.jpg
d####.c####.l####.####.com/book_covers/814800002.jpg
d####.c####.l####.####.com/book_covers/814800003.jpg
d####.c####.l####.####.com/book_covers/814800005.jpg
d####.c####.l####.####.com/book_covers/814800006.jpg
d####.c####.l####.####.com/book_covers/814800011.jpg
d####.c####.l####.####.com/book_covers/816400016.jpg
d####.c####.l####.####.com/book_covers/817000004.jpg
d####.c####.l####.####.com/book_covers/817000005.jpg
d####.c####.l####.####.com/book_covers/817000010.jpg
d####.c####.l####.####.com/book_covers/817000012.jpg
d####.c####.l####.####.com/book_covers/817400445.jpg
d####.c####.l####.####.com/book_covers/817400452.jpg
d####.c####.l####.####.com/book_covers/817400694.jpg
d####.c####.l####.####.com/book_covers/817400749.jpg
d####.c####.l####.####.com/cx/endimgs/0538a40d6b754849965046b7249c5e6a.jpg
d####.c####.l####.####.com/cx/endimgs/258a047fbcd14d2ebc33aa6bbee56774.jpg
d####.c####.l####.####.com/cx/endimgs/2b8c9442294c4488ad9e988f421ca218.jpg
d####.c####.l####.####.com/cx/endimgs/33e2280d13fb4cb8bfd4e31e72c3e8e7.jpg
d####.c####.l####.####.com/cx/endimgs/7d2d5e46286144408eda3535b2d6ca52.jpg
d####.c####.l####.####.com/cx/endimgs/86513d8c51904218ad4e91a72c64f203.jpg
d####.c####.l####.####.com/cx/endimgs/91758051f1db4b5f8adbe592fa8602d2.jpg
d####.c####.l####.####.com/cx/endimgs/cb769f1a401440c19486e836c93611a9.jpg
d####.c####.l####.####.com/cx/endimgs/f59663d723ce4e9b9e9692aa568ab8e8.jpg
hm.b####.com/hm.gif?hca=####&cc=####&ck=####&cl=####&ds=####&vl=####&ep=...
hm.b####.com/hm.gif?hca=####&cc=####&ck=####&cl=####&ds=####&vl=####&et=...
hm.b####.com/hm.js?a1e24e5####
j####.ika####.cn/log.js?cnid=####&uid=####&bookid=####&cnid=####&imsi=##...
j####.ika####.cn/log.js?cnid=####&uid=####&cnid=####&imsi=####&imei=####...
mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
qin####.com.www.####.com/tdata_EDT369
s####.tc.qq.com/gdt/0/DAAESbhAQ4AeAABiBcCkMoDxOwjPgv.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAe36hAMgASwABaBcIz9iDG3bKDnA.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAeZLeAMgASwABgBbWBL-DLhJ-6I5.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAiN6qAEsAEsAAbBb6PlpDrQrNYmj.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAiou3AEsAEsAASBb5AA6BacLCnTv.png/0?ck=####
t####.c####.q####.####.com/tdata_Rnl693
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_siA393
ti####.c####.l####.####.com/config/hz-hzv3.conf
v2.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####
z####.ika####.cn/log.js?cnid=####&uid=####&cnid=####&imsi=####&imei=####...

HTTP POST requests:

1####.134.99.111/api.php?format=####&t=####
a####.u####.com/app_logs
c-h####.g####.com/api.php?format=####&t=####
cx.ika####.cn/cx/itf/clickAdLog
cx.ika####.cn/cx/itf/loadingChapter
cx.ika####.cn/cx/itf/mySidebar
j####.ika####.cn/proto/parseLog
s####.e.qq.com/activate
s####.e.qq.com/click
s####.e.qq.com/msg
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
v.g####.qq.com/gdt_stats.fcg
z####.ika####.cn/book/chapterUpdate?ids=####&cnid=####&umeng=####&versio...
z####.ika####.cn/validate!validateData.xhtml

File system changes:

Creates the following files:

/data/data/####/-1670433904
/data/data/####/-18840332331462689164
/data/data/####/-19618087431776070699
/data/data/####/-2012115410
/data/data/####/-908322109
/data/data/####/-998889220659548291
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1551890098048.log
/data/data/####/17kAppPrefs.xml
/data/data/####/1825113284-1779931011
/data/data/####/1825113284933825702
/data/data/####/28f9cb25a7c6
/data/data/####/339204258
/data/data/####/5ead7c1916e321af3ee0d7d6aa595238.temp
/data/data/####/7631f3ce1066c876bee5583477893c70.temp
/data/data/####/ApplicationCache.db-journal
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__running__.jar
/data/data/####/baidu_mobads_shoubailp.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/config.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/finalcore.jar
/data/data/####/finalcore.jar.tmp
/data/data/####/freebook_comm.db-journal
/data/data/####/gdaemon_20161017
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/http_cx.ikanshu.cn_0.localstorage-journal
/data/data/####/http_cx.ikanshu.cn_0.localstorage-journal (deleted)
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu.so
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sdk_config.xml
/data/data/####/tdata_Rnl693
/data/data/####/tdata_Rnl693.jar
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_siA393
/data/data/####/tdata_siA393.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/-1006829624.tmp
/data/media/####/-1901295708.tmp
/data/media/####/-2053317259.tmp
/data/media/####/-576146247.tmp
/data/media/####/-67183002.tmp
/data/media/####/-832410140.tmp
/data/media/####/-932851909.tmp
/data/media/####/.cer
/data/media/####/.fb
/data/media/####/.sfp
/data/media/####/.testf
/data/media/####/.ygzhang
/data/media/####/1096257968.tmp
/data/media/####/1920440290.tmp
/data/media/####/320891_-1
/data/media/####/457558
/data/media/####/457559
/data/media/####/457560
/data/media/####/457561
/data/media/####/457562
/data/media/####/457563
/data/media/####/457564
/data/media/####/457565
/data/media/####/457566
/data/media/####/457567
/data/media/####/457568
/data/media/####/457569
/data/media/####/457570
/data/media/####/457571
/data/media/####/457572
/data/media/####/457573
/data/media/####/457574
/data/media/####/457575
/data/media/####/457576
/data/media/####/457577
/data/media/####/457578
/data/media/####/457579
/data/media/####/457580
/data/media/####/457581
/data/media/####/457582
/data/media/####/457583
/data/media/####/457584
/data/media/####/457585
/data/media/####/457586
/data/media/####/457587
/data/media/####/457588
/data/media/####/457589
/data/media/####/457590
/data/media/####/457591
/data/media/####/457592
/data/media/####/457593
/data/media/####/457594
/data/media/####/796777571.tmp
/data/media/####/884699791.tmp
/data/media/####/91086930.tmp
/data/media/####/921061191.tmp
/data/media/####/989596579.tmp
/data/media/####/V310_com.mianfeizs.book_dir.ski
/data/media/####/V310_com.mianfeizs.book_dir.ski.tmp
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.mianfeizs.book.bin
/data/media/####/com.mianfeizs.book.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tdata_Rnl693
/data/media/####/tdata_Soq141
/data/media/####/tdata_siA393
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.chineseall.reader.util.IGeTuiService 24804 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount

Loads the following dynamic libraries:

getuiext2
libjiagu

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial