Adware.Gexin.14630

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) i####.h####.com.cn:80
TCP(HTTP/1.1) v.h####.com.cn:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) publis####.h####.com.cn:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) bshdqsq####.h####.y####.net:80
TCP(HTTP/1.1) oss.newairc####.com:80
TCP(HTTP/1.1) h5.newairc####.com:80
TCP(TLS/1.0) wxjs####.h####.cn:443
TCP(TLS/1.0) oss.newairc####.com:443
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) s####.tc.qq.com:443
TCP(TLS/1.0) statcol####.c####.h####.cn:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

DNS requests:

7j####.c####.z0.####.com
a.appj####.com
c####.g####.ig####.com
c####.g####.ig####.com
c-h####.g####.com
h5.newairc####.com
hdr####.newairc####.com
i####.h####.com.cn
img.newairc####.com
mt####.go####.com
oss.newairc####.com
publis####.h####.com.cn
r####.wx.qq.com
s####.c####.h####.cn
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.i####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
statcol####.c####.h####.cn
v.h####.com.cn
wxjs####.h####.cn

HTTP GET requests:

bshdqsq####.h####.y####.net/js/webpv/?site_id=####
h5.newairc####.com/api/getArticles?sid=####&cid=####&lastFileID=####&row...
h5.newairc####.com/api/getColumns?sid=####&cid=####
h5.newairc####.com/api/getConfig?sid=####
h5.newairc####.com/link_detail?aid=####&sid=####
i####.h####.com.cn/201811080393d7d523cc25fcde009263c788d79a_origin.jpg
i####.h####.com.cn/201905231d56ab939ef2260f00ad1027e0216af8.png
i####.h####.com.cn/201905231f15411c1be968bbc80dff2a385d00dd_origin.gif
i####.h####.com.cn/201905231fa0f913dd14f1df81256712dd1beea8_origin.gif
i####.h####.com.cn/2019052324c530e7f24f30363fd536bd71d6bce3.gif
i####.h####.com.cn/20190523c3a9e1d19b9c6d1a1a84eb9650126475_origin.jpg
i####.h####.com.cn/20190523e6633008bf1807dc93f5419ca1416080.jpg
i####.h####.com.cn/20190524ab6c58ada2e886d98a9fc2f34671387f.jpg
i####.h####.com.cn/20190524c6098fdab717dbd9460a8a6c41b0fc44.jpg
i####.h####.com.cn/20190524f2a219f4793cb6f246e5040b7293ca8e_origin.jpg
i####.h####.com.cn/201905291e2ba71cdaa4dec2f6ef06395cd6e966.jpg
i####.h####.com.cn/2019052935e630ffec7e7d359ab78611aa9dcbfc.jpg
i####.h####.com.cn/201905294dea2ce73a0aa75e13819d86e1575892.jpg
i####.h####.com.cn/201905294fbb9ee34d56b37fca08c71e5372d3ef.jpg
i####.h####.com.cn/20190529a541834a12bd134695b3edbd20fd4287.jpg
i####.h####.com.cn/20190529d14f28de5965b7f72a726d9bf8760efd.jpg
i####.h####.com.cn/20190529eb7b2ac112127d0bdb499189c04b0685.jpg
i####.h####.com.cn/93x60/2019060106b5ab9df91749dc3d61a5105a37bd04_origin...
i####.h####.com.cn/93x60/201906011fa0ff4d745652058f88900aefefbeb8_origin...
i####.h####.com.cn/93x60/20190601d17f5c88ee4727a17f286c1cdb0f2e49_origin...
oss.newairc####.com/global/user/hdrb/mobile/config/handanV4.1.6.apk
oss.newairc####.com/hdrb/pic/201609/30/12f0907b-813a-4a8a-a26b-cb4748501...
oss.newairc####.com/hdrb/pic/201609/30/2869f215-e244-4df0-acc2-03fd01193...
oss.newairc####.com/hdrb/pic/201609/30/62132b4d-16b8-4108-af1f-67c73180b...
oss.newairc####.com/hdrb/pic/201609/30/80d6d44f-67a8-475e-aa32-753c7602a...
oss.newairc####.com/hdrb/pic/201609/30/f2671920-c50e-458e-8223-652dfab48...
publis####.h####.com.cn/icon/201902/20190225202000LB8.png
t####.c####.q####.####.com/config/hz-hzv6.conf
t####.c####.q####.####.com/tdata_SzD730
t####.c####.q####.####.com/tdata_ZCi456
t####.c####.q####.####.com/tdata_aBz764
v.h####.com.cn/ccw/detail/news.php?rid=####&from=####
v.h####.com.cn/m2o/click.php?rec=####
v.h####.com.cn/t/1/9/css/base.css?v=####
v.h####.com.cn/t/1/9/css/style.css?v=####
v.h####.com.cn/t/1/9/css/swiper.min.css?v=####
v.h####.com.cn/t/1/9/css/viewer.min.css?v=####
v.h####.com.cn/t/1/9/js/TouchSlide.1.1.js?v=####
v.h####.com.cn/t/1/9/js/base.js?v=####
v.h####.com.cn/t/1/9/js/clipboard.min.js?v=####
v.h####.com.cn/t/1/9/js/jquery.js?v=####
v.h####.com.cn/t/1/9/js/pinchzoom.js?v=####
v.h####.com.cn/t/1/9/js/responsive.js?v=####
v.h####.com.cn/t/1/9/js/swfobject.js?v=####
v.h####.com.cn/t/1/9/js/swiper.min.js?v=####
v.h####.com.cn/t/1/9/js/timeJudge.js?v=####
v.h####.com.cn/t/1/9/js/viewer.min.js?v=####
v.h####.com.cn/t/icon/201809/20180921151958its.png
v.h####.com.cn/t/icon/201810/20181016144150FvS.png
v.h####.com.cn/t/icon/201810/20181017231318YrmZ.png
v.h####.com.cn/t/icon/201810/20181019094345SqXr.gif
v.h####.com.cn/t/icon/201810/2018102010311694pK.png
v.h####.com.cn/t/icon/201810/201810201056550Hzq.png
v.h####.com.cn/t/icon/201810/20181020210620gAmg.png
v.h####.com.cn/t/icon/201810/20181022143615ioJT.png
v.h####.com.cn/t/icon/201812/20181211115333TOag.png
v.h####.com.cn/t/icon/201902/201902232300072AaO.png

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/-1051618219
/data/data/####/-1082638026
/data/data/####/-1206717254
/data/data/####/-1312716470
/data/data/####/-1382148932
/data/data/####/-1382180544
/data/data/####/-1382180545
/data/data/####/-1382210528
/data/data/####/-1382925293
/data/data/####/-1383018481
/data/data/####/-1383819086
/data/data/####/-1383944917
/data/data/####/-1383945007
/data/data/####/-1383996964
/data/data/####/-1384001801
/data/data/####/-1384001856
/data/data/####/-1384026786
/data/data/####/-1384056388
/data/data/####/-1384056389
/data/data/####/-1384056393
/data/data/####/-1384056415
/data/data/####/-1563322849
/data/data/####/-1696617519
/data/data/####/-1889153008
/data/data/####/-1926292749
/data/data/####/-271577035
/data/data/####/-290860578
/data/data/####/-451645086
/data/data/####/-691385402
/data/data/####/-949702319
/data/data/####/-980722126
/data/data/####/.jg.ic
/data/data/####/1389023919
/data/data/####/1695857311
/data/data/####/2014120719
/data/data/####/386967948
/data/data/####/395893077
/data/data/####/492058981
/data/data/####/722466508
/data/data/####/811799264
/data/data/####/9471866
/data/data/####/960307825
/data/data/####/FZLTXHK-GBK_YS.ttf
/data/data/####/QQ_3x.png
/data/data/####/amazeui.min.css
/data/data/####/amazeui.min.js
/data/data/####/angular1.4.6.min.js
/data/data/####/base.css
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/columnId.xml
/data/data/####/core_info
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_founder0-journal
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000e (deleted)
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000010 (deleted)
/data/data/####/f_000011
/data/data/####/fontawesome-webfont.ttf
/data/data/####/gdaemon_20161017
/data/data/####/gkt-journal
/data/data/####/great_button.png
/data/data/####/great_cancel_button.png
/data/data/####/gx_sp.xml
/data/data/####/helpMsg.xml
/data/data/####/icon-images.png
/data/data/####/icon_audio_play.png
/data/data/####/icon_file.png
/data/data/####/icon_file_down.png
/data/data/####/icon_meta_voice.png
/data/data/####/icon_praise.png
/data/data/####/icon_praiseStar.png
/data/data/####/icon_selector_normal.png
/data/data/####/icon_selector_press.png
/data/data/####/increment.db-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/jquery.min2.2.0.js
/data/data/####/js.combine.min.js
/data/data/####/libjiagu.so
/data/data/####/loading.png
/data/data/####/mobclick_agent_cached_com.founder.handanribao12
/data/data/####/news_detail.html
/data/data/####/play.png
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/reader.db-journal
/data/data/####/run.pid
/data/data/####/sanjiaoxing.png
/data/data/####/shareTimeline_3x.png
/data/data/####/sina_3x.png
/data/data/####/tbs_download_config.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_SzD730
/data/data/####/tdata_SzD730.jar
/data/data/####/tdata_ZCi456
/data/data/####/tdata_ZCi456.jar
/data/data/####/tdata_aBz764
/data/data/####/tdata_aBz764.jar
/data/data/####/umeng_general_config.xml
/data/data/####/video.png
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wx_3x.png
/data/media/####/013c800c83c4a5fa395107bdb9961423aa4cd2ebef8fcc....0.tmp
/data/media/####/029c552cc4037b30581ad64c12881887481cd4e1724d90....0.tmp
/data/media/####/064d338b8d65119cd8d4f7735b76960a4e866ac5924971....0.tmp
/data/media/####/0d51f51a3d68dd21f2740b06fa686c1ad0583bf8b2fadd....0.tmp
/data/media/####/0fc0af313fa9923a0b14c4d17ab1ed897c9540c16135cc....0.tmp
/data/media/####/129750f4f782e6a45b5da33e328476481100cab722bb89....0.tmp
/data/media/####/1517211c5b4b0c3b65ca5470608852757b789cb03abe45....0.tmp
/data/media/####/152ab4c5f795f6cd11f5b5ae1f2e7ca5b8b0cbf0e21b77....0.tmp
/data/media/####/1e6892c10c751384290a51a28acb217c124f3ebce29576....0.tmp
/data/media/####/263ceaf5b615d6e6300e01e9ca78a0005673c0e4141ea0....0.tmp
/data/media/####/2a05fc2bf1622152532bc4ec6d440590cc9948986ff5e9....0.tmp
/data/media/####/40182ef9caca9c3d2000263e3a8e0d9da031d654aa2134....0.tmp
/data/media/####/438c209520e546ac06a3115f41031f243469bfbb82701a....0.tmp
/data/media/####/545cceef5f670498edf99ca4892a68ef1f0164255cd688....0.tmp
/data/media/####/5804c322ee0950c248f96aba82a81211ef72faa0cbb943....0.tmp
/data/media/####/61c80b5292f1b4b55a2bc9aabd3e7abe7e12bbc9359220....0.tmp
/data/media/####/6a01d85f5dd2d692831977f60d9c4febd0e3c80eeef765....0.tmp
/data/media/####/7a07a328fbaf44cfc980b192936e9f42f2b3ed00ca9da9....0.tmp
/data/media/####/84fcdf0a40221fdee9bba5ea50af267b626535a64642e4....0.tmp
/data/media/####/8c72c73894990791c5b368bbc4251ecec27266934c9a5d....0.tmp
/data/media/####/8fdfa4ecec00d9498b9c9ade8ba521eceed32195db4b85....0.tmp
/data/media/####/92942bbd51cf6d5361c65c38a95b80298906bf5e7eca88....0.tmp
/data/media/####/944a8dc6357913aa8bdca8a9cb3f718fa0f326a4ef76d1....0.tmp
/data/media/####/9a3bbc5ece7399eb67cb8c6571525f18466869fe094e0f....0.tmp
/data/media/####/HD NEWSPAPER MEDIA_4.1.6.apk
/data/media/####/a3f1174508e30f2f72a08973b0d40adf01d7814edb738c....0.tmp
/data/media/####/aa305844e8706d56aa8aa7509aff190868415d257de57b....0.tmp
/data/media/####/ad96c3de62aec4e41ec6ea4cd768b0308d4f97acef6aaf....0.tmp
/data/media/####/app.db
/data/media/####/b0541af588cb518fce99b6805a6ba69bba89c3e588ec59....0.tmp
/data/media/####/b273c2e0ac108ecb57f62a077f5fae36094adf9231be37....0.tmp
/data/media/####/bc126f383714ab19402c2bdc45ad0919a3a6f15ed5ce61....0.tmp
/data/media/####/c019302fb273332f16938fb5e96810fcfc8b78837856ef....0.tmp
/data/media/####/c4341ca355a89d9b6a962d5ffbd4054b316ab382482cb0....0.tmp
/data/media/####/c4c77a0712402c526ec21ef9cd7ef1ff63a9e95b334a11....0.tmp
/data/media/####/c8eb63f5707c4e884e43f30370e3c292165ca7904aed6d....0.tmp
/data/media/####/c950d0c9993f20f7b428332cea96294e44993531d2bf26....0.tmp
/data/media/####/cc52714717878aaee65e66cf7584e1fff2cc8eeaddec71....0.tmp
/data/media/####/com.founder.handanribao.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/dba80ac2087166d02bd3382062daffd55bb246b22f5bd4....0.tmp
/data/media/####/dd3ca272606a3492e03ada0e3e66c3a17455db216a75a1....0.tmp
/data/media/####/dd8c6f53838f858578bd8cadd94485f08dc87d96d4ae76....0.tmp
/data/media/####/de790f1a0048f08c161ed3b04bea34cb4449063a87882f....0.tmp
/data/media/####/e34ed572ffd3de70c87d237435837ff57d0482f78f8566....0.tmp
/data/media/####/e8a4275ec19f263a1aa3f4dd91e7686fb6ebb847022193....0.tmp
/data/media/####/e8c4dbf95dd24032824a4c25ee9c7001948beb8b324dec....0.tmp
/data/media/####/f3788477b0da21a69577d19ef241966b9b9141c98bafe4....0.tmp
/data/media/####/f435bd76d20dd87b1a7ab54c90280bf35b1496e1bbbeca....0.tmp
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/journal.tmp
/data/media/####/localTemplate.zip
/data/media/####/tdata_SzD730
/data/media/####/tdata_ZCi456
/data/media/####/tdata_aBz764
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25309 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop ro.product.cpu.abi

Loads the following dynamic libraries:

getuiext2
libjiagu

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial