Adware.Gexin.9815

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) c.appj####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

DNS requests:

7j####.c####.z0.####.com
c####.g####.ig####.com
c-h####.g####.com
c.appj####.com
mt####.go####.com
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
www.hush####.cn

HTTP GET requests:

qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/tdata_Rnl693
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_fEV688
t####.c####.q####.####.com/tdata_siA393
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
c.appj####.com/ad/splash/stats.html
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/1af321c706fb
/data/data/####/GHutils.js
/data/data/####/H5locks.js
/data/data/####/about-banner.png
/data/data/####/about_logo.png
/data/data/####/account-coupon.html
/data/data/####/account-coupon.js
/data/data/####/account-deal-parent.html
/data/data/####/account-deal-parent.js
/data/data/####/account-deal.html
/data/data/####/account-deal.js
/data/data/####/account-deposit-widthdraw-record-parent.html
/data/data/####/account-deposit-widthdraw-record-parent.js
/data/data/####/account-deposit-widthdraw-record.html
/data/data/####/account-deposit-widthdraw-record.js
/data/data/####/account-deposit.html
/data/data/####/account-deposit.js
/data/data/####/account-details.html
/data/data/####/account-details.js
/data/data/####/account-income.html
/data/data/####/account-income.js
/data/data/####/account-invitation.html
/data/data/####/account-invitation.js
/data/data/####/account-invite-charts.html
/data/data/####/account-invite-charts.js
/data/data/####/account-message.html
/data/data/####/account-message.js
/data/data/####/account-orderlist.html
/data/data/####/account-orderlist.js
/data/data/####/account-product-t0-deal.html
/data/data/####/account-product-t0-deal.js
/data/data/####/account-product-t0-holding-details.html
/data/data/####/account-product-t0-holding-details.js
/data/data/####/account-product-t0-orderlist.html
/data/data/####/account-product-t0-orderlist.js
/data/data/####/account-product-t0-redeem-record.html
/data/data/####/account-product-t0-redeem-record.js
/data/data/####/account-product-t0-redeem.html
/data/data/####/account-product-t0-redeem.js
/data/data/####/account-product-tn-deal.html
/data/data/####/account-product-tn-deal.js
/data/data/####/account-product-tn-detail.html
/data/data/####/account-product-tn-detail.js
/data/data/####/account-toinvite.html
/data/data/####/account-toinvite.js
/data/data/####/account-webview.html
/data/data/####/account-webview.js
/data/data/####/account-withdraw.html
/data/data/####/account-withdraw.js
/data/data/####/account-zxym-callbackpage.html
/data/data/####/account-zxym-jg.html
/data/data/####/account-zxym-jg.js
/data/data/####/account-zxym-webview.html
/data/data/####/account-zxym-webview.js
/data/data/####/account-zxym.html
/data/data/####/account-zxym.js
/data/data/####/account.html
/data/data/####/account.js
/data/data/####/activities-webview.html
/data/data/####/activities-webview.js
/data/data/####/activities.html
/data/data/####/activities.js
/data/data/####/activity_def.png
/data/data/####/ad_show_time.xml
/data/data/####/app-arrow-1.png
/data/data/####/app-arrow-2.png
/data/data/####/app-arrow-3.png
/data/data/####/app-cross.png
/data/data/####/app-invite-title.png
/data/data/####/app-invitereg.png
/data/data/####/app-line-bottom.png
/data/data/####/app-line-top.png
/data/data/####/app-mail.png
/data/data/####/app-nodata1.png
/data/data/####/app-nodata2.png
/data/data/####/app-number-1.png
/data/data/####/app-number-2.png
/data/data/####/app-number-3.png
/data/data/####/app-number-4.png
/data/data/####/app-number-5.png
/data/data/####/app-number-6.png
/data/data/####/app-people.png
/data/data/####/app-right-arrow.png
/data/data/####/app-shield.png
/data/data/####/app-tel.png
/data/data/####/app.css
/data/data/####/app_android.png
/data/data/####/app_apple.png
/data/data/####/app_arrow_4.png
/data/data/####/app_btn_enter.png
/data/data/####/app_crl_bg.png
/data/data/####/app_icon_title.png
/data/data/####/app_nodata.png
/data/data/####/app_nodata2.png
/data/data/####/bank.js
/data/data/####/banner_def.png
/data/data/####/bg-my.png
/data/data/####/bg_invite.png
/data/data/####/bg_t0.png
/data/data/####/bg_tn.png
/data/data/####/biaoqian_1.png
/data/data/####/biaoqian_2.png
/data/data/####/biaoqian_3.png
/data/data/####/biaoqian_4.png
/data/data/####/biaoqian_5.png
/data/data/####/bubble.png
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/chargelogo.jpg
/data/data/####/chargelogo2.jpg
/data/data/####/clientid_igexin.xml
/data/data/####/content_bg.png
/data/data/####/content_pages.html
/data/data/####/content_pages.js
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dot.png
/data/data/####/echarts.simple.min.js
/data/data/####/expgold.png
/data/data/####/expgold_box_close.png
/data/data/####/flow.png
/data/data/####/four.png
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/goldblur.png
/data/data/####/goldhover.png
/data/data/####/gray.css
/data/data/####/guozi@3x.png
/data/data/####/gx_sp.xml
/data/data/####/hongbaotankuang_1@2x.png
/data/data/####/hongbaotankuang_2@2x.png
/data/data/####/hushenkonggu.png
/data/data/####/icon_anquan.png
/data/data/####/icon_arrow_down.png
/data/data/####/icon_arrow_up.png
/data/data/####/icon_down.png
/data/data/####/icon_filter.png
/data/data/####/icon_filter_active.png
/data/data/####/icon_gonggao.png
/data/data/####/icon_gongju.png
/data/data/####/icon_guan@2x.png
/data/data/####/icon_guanyu.png
/data/data/####/icon_hint.png
/data/data/####/icon_hot.png
/data/data/####/icon_jiaoyi.png
/data/data/####/icon_jilu.png
/data/data/####/icon_licai.png
/data/data/####/icon_licai_active.png
/data/data/####/icon_mark.png
/data/data/####/icon_my.png
/data/data/####/icon_new.png
/data/data/####/icon_news.png
/data/data/####/icon_nor.png
/data/data/####/icon_qiandao.png
/data/data/####/icon_qiandao@3x.png
/data/data/####/icon_satr1.png
/data/data/####/icon_satr2.png
/data/data/####/icon_satr3.png
/data/data/####/icon_satr4.png
/data/data/####/icon_satr5.png
/data/data/####/icon_setting.png
/data/data/####/icon_shezhi.png
/data/data/####/icon_shouye.png
/data/data/####/icon_shouye_active.png
/data/data/####/icon_up.png
/data/data/####/icon_wode.png
/data/data/####/icon_wode_active.png
/data/data/####/icon_wodeyaoqing.png
/data/data/####/icon_xiaoxi.png
/data/data/####/icon_yanbi.png
/data/data/####/icon_yanzheng.png
/data/data/####/icon_yaoqing.png
/data/data/####/icon_youhuijuan.png
/data/data/####/icon_zhinan.png
/data/data/####/iconfont.ttf
/data/data/####/iconfont1.ttf
/data/data/####/idCardValid.js
/data/data/####/index
/data/data/####/index-about.html
/data/data/####/index-about.js
/data/data/####/index-accumulate.html
/data/data/####/index-accumulate.js
/data/data/####/index-activities.html
/data/data/####/index-activities.js
/data/data/####/index-banner.html
/data/data/####/index-banner.js
/data/data/####/index-cmspage.html
/data/data/####/index-cmspage.js
/data/data/####/index-dynamic-main.html
/data/data/####/index-dynamic-main.js
/data/data/####/index-dynamic.html
/data/data/####/index-dynamic.js
/data/data/####/index-gridnav.html
/data/data/####/index-gridnav.js
/data/data/####/index-guide.html
/data/data/####/index-guide.js
/data/data/####/index-homepage-webview.html
/data/data/####/index-homepage-webview.js
/data/data/####/index-homepage.html
/data/data/####/index-homepage.js
/data/data/####/index-information.html
/data/data/####/index-information.js
/data/data/####/index-insurance.html
/data/data/####/index-linkpage-agreement.html
/data/data/####/index-linkpage-agreement.js
/data/data/####/index-linkpage.html
/data/data/####/index-linkpage.js
/data/data/####/index-mask.html
/data/data/####/index-mask.js
/data/data/####/index-minbanner-single.html
/data/data/####/index-minbanner-single.js
/data/data/####/index-minbanner.html
/data/data/####/index-minbanner.js
/data/data/####/index-newlist.html
/data/data/####/index-newlist.js
/data/data/####/index-notice.html
/data/data/####/index-notice.js
/data/data/####/index-productlist.html
/data/data/####/index-productlist.js
/data/data/####/index-safe.html
/data/data/####/index-safe.js
/data/data/####/index-scan.html
/data/data/####/index-signin-end.html
/data/data/####/index-signin-success.html
/data/data/####/index-signin-success.js
/data/data/####/index-signin-yes.html
/data/data/####/index-signin-yes.js
/data/data/####/index-signin.html
/data/data/####/index-signin.js
/data/data/####/index-system.html
/data/data/####/index.html
/data/data/####/index.js
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/insurance-banner.png
/data/data/####/insurance-four.png
/data/data/####/insurance-one.png
/data/data/####/insurance-three.png
/data/data/####/insurance-two.png
/data/data/####/introduce_icon1.png
/data/data/####/introduce_icon2.png
/data/data/####/introduce_icon3.png
/data/data/####/introduce_icon4.png
/data/data/####/invite-img.png
/data/data/####/invite_bac.png
/data/data/####/invitebanner.png
/data/data/####/jedate.js
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/jingying@3x.png
/data/data/####/jinzhuapp.xml
/data/data/####/kuang.png
/data/data/####/libjiagu.so
/data/data/####/login_logo.png
/data/data/####/logo.png
/data/data/####/manifest.json
/data/data/####/md5.js
/data/data/####/measure-1.png
/data/data/####/measure-2.png
/data/data/####/measure.png
/data/data/####/mui-deposit.js
/data/data/####/mui.css
/data/data/####/mui.min.css
/data/data/####/mui.min.js
/data/data/####/mui.picker.css
/data/data/####/mui.picker.min.css
/data/data/####/mui.picker.min.js
/data/data/####/mui.poppicker.css
/data/data/####/mui.pullToRefresh.js
/data/data/####/mui.pullToRefresh.material.js
/data/data/####/mui.ttf
/data/data/####/news_def.png
/data/data/####/one.png
/data/data/####/pdr.xml
/data/data/####/product-t0-detail.html
/data/data/####/product-t0-detail.js
/data/data/####/product-t0-information.html
/data/data/####/product-t0-information.js
/data/data/####/product-t0-introduce.html
/data/data/####/product-t0-introduce.js
/data/data/####/product-t0-list.html
/data/data/####/product-t0-list.js
/data/data/####/product-t0-order.html
/data/data/####/product-t0-order.js
/data/data/####/product-t0-protocol.html
/data/data/####/product-t0-protocol.js
/data/data/####/product-t0.html
/data/data/####/product-t0.js
/data/data/####/product-tn-coupon.html
/data/data/####/product-tn-coupon.js
/data/data/####/product-tn-detail.html
/data/data/####/product-tn-detail.js
/data/data/####/product-tn-list.html
/data/data/####/product-tn-list.js
/data/data/####/product-tn-order.html
/data/data/####/product-tn-order.js
/data/data/####/product-tn-protocol.html
/data/data/####/product-tn-protocol.js
/data/data/####/product-tn.html
/data/data/####/product-tn.js
/data/data/####/product_bg.png
/data/data/####/public_bg.png
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/redbeg.png
/data/data/####/require.min.js
/data/data/####/run.pid
/data/data/####/safe_danka.png
/data/data/####/safe_duifu.png
/data/data/####/safe_shengtai.png
/data/data/####/safe_yinhang.png
/data/data/####/setting-about-us-wechat.html
/data/data/####/setting-about-us-wechat.js
/data/data/####/setting-about-us.html
/data/data/####/setting-about-us.js
/data/data/####/setting-accountsafty-spwdtouchid.html
/data/data/####/setting-accountsafty-spwdtouchid.js
/data/data/####/setting-accountsafty.html
/data/data/####/setting-accountsafty.js
/data/data/####/setting-developer.html
/data/data/####/setting-developer.js
/data/data/####/setting-feedback.html
/data/data/####/setting-feedback.js
/data/data/####/setting-locker.html
/data/data/####/setting-locker.js
/data/data/####/setting-problems-details.html
/data/data/####/setting-problems-details.js
/data/data/####/setting-problems.html
/data/data/####/setting-problems.js
/data/data/####/setting-spwd.html
/data/data/####/setting-spwd.js
/data/data/####/setting.html
/data/data/####/setting.js
/data/data/####/sha.js
/data/data/####/share.js
/data/data/####/shouqin.png
/data/data/####/sp_arrow.png
/data/data/####/start_pages.html
/data/data/####/start_pages1.png
/data/data/####/start_pages2.png
/data/data/####/start_pages3.png
/data/data/####/start_pages4.png
/data/data/####/step-1.png
/data/data/####/step-2.png
/data/data/####/step-3.png
/data/data/####/step-4.png
/data/data/####/step-5.png
/data/data/####/stream_permission.xml
/data/data/####/swiper-3.3.1.min.js
/data/data/####/swiper.min.css
/data/data/####/system.png
/data/data/####/tdata_Rnl693
/data/data/####/tdata_Rnl693.jar
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_fEV688
/data/data/####/tdata_fEV688.jar
/data/data/####/tdata_siA393
/data/data/####/tdata_siA393.jar
/data/data/####/template-cfg.js
/data/data/####/three.png
/data/data/####/two.png
/data/data/####/umeng_general_config.xml
/data/data/####/updata.js
/data/data/####/usermgmt-bankcard-add.html
/data/data/####/usermgmt-bankcard-add.js
/data/data/####/usermgmt-bankcard-edit.html
/data/data/####/usermgmt-bankcard-edit.js
/data/data/####/usermgmt-bankcard-list.html
/data/data/####/usermgmt-bankcard-list.js
/data/data/####/usermgmt-dealpwd.html
/data/data/####/usermgmt-dealpwd.js
/data/data/####/usermgmt-forgetpwd.html
/data/data/####/usermgmt-forgetpwd.js
/data/data/####/usermgmt-login.html
/data/data/####/usermgmt-login.js
/data/data/####/usermgmt-pwd.html
/data/data/####/usermgmt-pwd.js
/data/data/####/usermgmt-reg.html
/data/data/####/usermgmt-reg.js
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/data/####/weixin_1.png
/data/data/####/weixin_2.png
/data/data/####/weixin_3.png
/data/data/####/weixinlogo.png
/data/data/####/wufulogo.png
/data/data/####/xinshouhongbao.png
/data/data/####/xinshoutu.png
/data/data/####/zepto.min.js
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.yx.jinzhuapp.bin
/data/media/####/com.yx.jinzhuapp.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tdata_Rnl693
/data/media/####/tdata_Soq141
/data/media/####/tdata_fEV688
/data/media/####/tdata_siA393
/data/media/####/temp.arm
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24637 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount

Loads the following dynamic libraries:

getuiext2
libjiagu

Uses the following algorithms to encrypt data:

AES-CFB-NoPadding
AES-ECB-PKCS5Padding
RSA
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial