Adware.Gexin.14698

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.3.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) ml17####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) st####.dc####.net.cn:80
TCP(HTTP/1.1) 1####.62.229.1:8380
TCP(TLS/1.0) ml17####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) ser####.dc####.net.cn:443
TCP c####.g####.ig####.com:5227
TCP sdk.o####.t####.####.com:5224

DNS requests:

c####.g####.ig####.com
c-h####.g####.com
ml17####.oss-cn-####.aliy####.com
pub-####.qin####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
ser####.dc####.net.cn
st####.dc####.net.cn

HTTP GET requests:

ml17####.oss-cn-####.aliy####.com/img/banner/201903/155298297823015.png
ml17####.oss-cn-####.aliy####.com/img/banner/201904/155530088372515.jpg
ml17####.oss-cn-####.aliy####.com/img/banner/201905/155834185039715.jpg
ml17####.oss-cn-####.aliy####.com/img/banner/201905/155834186090215.jpg
ml17####.oss-cn-####.aliy####.com/img/banner/201905/155834186907915.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201807/153061542868215.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201807/153066741311015.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201807/153077021997215.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201809/153605522318915.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201809/153622204314215.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201810/153913785779515.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201903/155229808445215.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201903/155235477708515.jpg
ml17####.oss-cn-####.aliy####.com/img/pro/201903/155298521338715.png
ml17####.oss-cn-####.aliy####.com/img/pro/201905/155834354113115.jpg
qin####.com.www.####.com/tdata_EDT356
t####.c####.q####.####.com/config/hz-hzv6.conf

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
st####.dc####.net.cn/device/location

File system changes:

Creates the following files:

/data/data/####/.imei.txt
/data/data/####/.jg.ic
/data/data/####/0.png
/data/data/####/1.png
/data/data/####/144x144.png
/data/data/####/192x192.png
/data/data/####/48x48.png
/data/data/####/72x72.png
/data/data/####/96x96.png
/data/data/####/H53456FC2.xml
/data/data/####/HBuilder.keystore
/data/data/####/Layer.png
/data/data/####/Lock.png
/data/data/####/PersonalInformation.html
/data/data/####/ShoppingCart.png
/data/data/####/Timelimit.jpg
/data/data/####/Timelimit_tuangou.jpg
/data/data/####/Timelimit_xianshi.jpg
/data/data/####/User.png
/data/data/####/WechatIMG297.png
/data/data/####/WechatIMG448.jpeg
/data/data/####/_adio.dcloud.feature.ad.a.a.xml
/data/data/####/active_cup_38.jpg
/data/data/####/active_cup_58.jpg
/data/data/####/active_cup_88.jpg
/data/data/####/active_cup_head.jpg
/data/data/####/active_cup_more.jpg
/data/data/####/active_cup_rule.jpg
/data/data/####/active_gifts_38.jpg
/data/data/####/active_gifts_38_main.jpg
/data/data/####/active_gifts_58.jpg
/data/data/####/active_gifts_58_main.jpg
/data/data/####/active_gifts_58_main.png
/data/data/####/active_gifts_88.jpg
/data/data/####/active_gifts_88_main.jpg
/data/data/####/active_gifts_88_main.png
/data/data/####/active_rule.png
/data/data/####/active_temai.png
/data/data/####/active_vip_new.png
/data/data/####/active_yipinhui_comming.png
/data/data/####/addAddress.html
/data/data/####/addBankCard.html
/data/data/####/address-line.png
/data/data/####/addressManage.html
/data/data/####/album.png
/data/data/####/app.js
/data/data/####/app_icon1.png
/data/data/####/app_icon1_active.png
/data/data/####/app_icon2.png
/data/data/####/app_icon2_active.png
/data/data/####/app_icon3.png
/data/data/####/app_icon3_active.png
/data/data/####/app_icon4.png
/data/data/####/app_icon4_active.png
/data/data/####/app_icon5.png
/data/data/####/app_icon5_active.png
/data/data/####/attractDetail.html
/data/data/####/attractDetail.jpg
/data/data/####/backspace.svg
/data/data/####/bankCard.html
/data/data/####/bankcard-1.png
/data/data/####/bankcard-bg.png
/data/data/####/bankcard-jinse.png
/data/data/####/bankcard-sanjiao.png
/data/data/####/banner.png
/data/data/####/bannerUrl.html
/data/data/####/bindPhone.html
/data/data/####/browseRecords.html
/data/data/####/bz.png
/data/data/####/c566d683d74c
/data/data/####/camera.png
/data/data/####/cg_03.jpg
/data/data/####/change_pwd.png
/data/data/####/circle.svg
/data/data/####/classification.html
/data/data/####/classify.html
/data/data/####/clientid_igexin.xml
/data/data/####/close.svg
/data/data/####/closed.png
/data/data/####/code.png
/data/data/####/collectList.html
/data/data/####/collecting.html
/data/data/####/comment.html
/data/data/####/commentList.html
/data/data/####/comments.html
/data/data/####/commitidy_icon1.png
/data/data/####/commitidy_icon2.png
/data/data/####/commitidy_icon3.png
/data/data/####/commitidy_icon4.png
/data/data/####/commitidy_icon5.png
/data/data/####/commitidy_main.png
/data/data/####/commitidy_top.png
/data/data/####/commitidy_zuji.png
/data/data/####/confim.png
/data/data/####/countDown.js
/data/data/####/createShow.html
/data/data/####/data.city.js
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dc_ad_type_key.xml
/data/data/####/dd_03.jpg
/data/data/####/del.png
/data/data/####/demo.css
/data/data/####/demo_fontclass.html
/data/data/####/demo_symbol.html
/data/data/####/demo_unicode.html
/data/data/####/discover.html
/data/data/####/discover.png
/data/data/####/discover_active.png
/data/data/####/distribution.png
/data/data/####/doT.min.js
/data/data/####/easemob.im-1.0.5.js
/data/data/####/edit.png
/data/data/####/editAddress.html
/data/data/####/edit_email.html
/data/data/####/edit_password.html
/data/data/####/eje3cnc
/data/data/####/empty.jpg
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/feedback-page.css
/data/data/####/feedback-page.js
/data/data/####/feedback.js
/data/data/####/forget_password.html
/data/data/####/gantan.png
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gifts38.html
/data/data/####/gifts58.html
/data/data/####/gifts88.html
/data/data/####/goodsList.html
/data/data/####/guangao.png
/data/data/####/gx_sp.xml
/data/data/####/hd.jpg
/data/data/####/header.png
/data/data/####/helpCenter.html
/data/data/####/home-top-image.png
/data/data/####/home.html
/data/data/####/home_clock.png
/data/data/####/home_new_person.jpeg
/data/data/####/home_new_person.png
/data/data/####/home_rectangle.png
/data/data/####/home_top_mage.png
/data/data/####/html5Geo.xml
/data/data/####/iconfont-tianjia.png
/data/data/####/iconfont.css
/data/data/####/iconfont.eot
/data/data/####/iconfont.js
/data/data/####/iconfont.svg
/data/data/####/iconfont.ttf
/data/data/####/iconfont.woff
/data/data/####/ificationList.html
/data/data/####/immersed.js
/data/data/####/index
/data/data/####/index-counter.png
/data/data/####/index-icon1.png
/data/data/####/index-icon2.png
/data/data/####/index-icon3.png
/data/data/####/index-icon4.png
/data/data/####/index-list-img.png
/data/data/####/index-miaosha.jpg
/data/data/####/index-news.png
/data/data/####/index-number.png
/data/data/####/index-search.png
/data/data/####/index-taoxin.png
/data/data/####/index-team.png
/data/data/####/index.html
/data/data/####/indexTime.jpg
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/integialBg.png
/data/data/####/integral.html
/data/data/####/integral.png
/data/data/####/integralDetail.html
/data/data/####/integralRule.html
/data/data/####/integrationPay.html
/data/data/####/jftc_03.png
/data/data/####/jftc_09.jpg
/data/data/####/jftc_14.jpg
/data/data/####/jifen-light.png
/data/data/####/jifen.png
/data/data/####/jquery-1.11.1.js
/data/data/####/jquery-3.2.1.min.js
/data/data/####/jquery.min.js
/data/data/####/json2.js
/data/data/####/jt_03.jpg
/data/data/####/kikiWhite.html
/data/data/####/leavingMessage.html
/data/data/####/libjiagu1656434084.so
/data/data/####/loading_1080.png
/data/data/####/loading_480.png
/data/data/####/loading_720.png
/data/data/####/login.html
/data/data/####/logo.png
/data/data/####/main.html
/data/data/####/majorSuit.html
/data/data/####/manifest.json
/data/data/####/manifest.json.mine
/data/data/####/manifest.json.r698
/data/data/####/manifest.json.r700
/data/data/####/me-icon1.png
/data/data/####/me-icon2.png
/data/data/####/me-icon3.png
/data/data/####/me-icon4.png
/data/data/####/me-icon5.png
/data/data/####/me-icon6.png
/data/data/####/me-icon7.png
/data/data/####/member.html
/data/data/####/money.png
/data/data/####/moren.png
/data/data/####/msg.html
/data/data/####/mui.css
/data/data/####/mui.enterfocus.js
/data/data/####/mui.js
/data/data/####/mui.locker.js
/data/data/####/mui.min.css
/data/data/####/mui.min.js
/data/data/####/mui.picker.css
/data/data/####/mui.picker.min.js
/data/data/####/mui.promptpwd.css
/data/data/####/mui.promptpwd.js
/data/data/####/mui.pullToRefresh.js
/data/data/####/mui.pullToRefresh.material.js
/data/data/####/mui.ttf
/data/data/####/mui.view.js
/data/data/####/multidex.version.xml
/data/data/####/myCustomer.html
/data/data/####/myCustomerDetail.html
/data/data/####/myQRCode.html
/data/data/####/myShare.html
/data/data/####/myShare_sub.html
/data/data/####/my_QRCode.jpeg
/data/data/####/my_QRCode_share.png
/data/data/####/myshare_circle.png
/data/data/####/new_person.html
/data/data/####/new_person_btn.png
/data/data/####/order-icon1.png
/data/data/####/order-icon2.png
/data/data/####/order-icon3.png
/data/data/####/order-icon4.png
/data/data/####/order-icon5.png
/data/data/####/order.html
/data/data/####/order.png
/data/data/####/orderDetail.html
/data/data/####/orderMemberDetail.html
/data/data/####/orderStatus.html
/data/data/####/order_info_head.jpg
/data/data/####/organic-food.png
/data/data/####/over.html
/data/data/####/own.css
/data/data/####/passwordbox.min.js
/data/data/####/pay.html
/data/data/####/payBg.png
/data/data/####/payCenter.html
/data/data/####/payCode.html
/data/data/####/payPwd.html
/data/data/####/paySuccess.html
/data/data/####/payment.html
/data/data/####/pdr.xml
/data/data/####/pers-bg.jpeg
/data/data/####/pers-bg.png
/data/data/####/plusshare.js
/data/data/####/pointReward.html
/data/data/####/pointReward_main.html
/data/data/####/pointReward_sub.html
/data/data/####/presentRecord.html
/data/data/####/productin_share.png
/data/data/####/profitBg.png
/data/data/####/profitDetails.html
/data/data/####/push.pid
/data/data/####/push_db_name.xml
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/pwd_keyboard.png
/data/data/####/qianhaizhandi_icon.png
/data/data/####/qihoo.png
/data/data/####/qiqi.png
/data/data/####/qq.png
/data/data/####/quan-1.png
/data/data/####/quan.png
/data/data/####/realname.html
/data/data/####/recover_pwd.png
/data/data/####/red-heart.png
/data/data/####/reg.html
/data/data/####/regAgreement.html
/data/data/####/restaurantDetail.html
/data/data/####/restaurantList.html
/data/data/####/restaurantOver.html
/data/data/####/restaurantPayment.html
/data/data/####/restaurants.css
/data/data/####/returnDetail.html
/data/data/####/right-Arrow-light.png
/data/data/####/right-Arrow.png
/data/data/####/run.pid
/data/data/####/s_gw.png
/data/data/####/s_kf.png
/data/data/####/s_sc.png
/data/data/####/score.png
/data/data/####/search.html
/data/data/####/setting.html
/data/data/####/settings.png
/data/data/####/sh_service.html
/data/data/####/shiming.png
/data/data/####/shopCar.html
/data/data/####/shopCar.png
/data/data/####/shopping.html
/data/data/####/shoppingCar.html
/data/data/####/sinaweibo.png
/data/data/####/sreachList.html
/data/data/####/start.html
/data/data/####/start.png
/data/data/####/start01.png
/data/data/####/start02.png
/data/data/####/start03.png
/data/data/####/start_statistics_data.xml
/data/data/####/stream_permission.xml
/data/data/####/strophe-custom-2.0.0.js
/data/data/####/style.css
/data/data/####/sure.png
/data/data/####/swiper-3.4.2.min.css
/data/data/####/swiper-3.4.2.min.js
/data/data/####/systemClose.png
/data/data/####/systemInfo.png
/data/data/####/systemMessage.html
/data/data/####/test.html
/data/data/####/test_app
/data/data/####/transcationDetail.html
/data/data/####/trash.png
/data/data/####/tu.png
/data/data/####/tuihuo.html
/data/data/####/unlock.html
/data/data/####/userinfo.png
/data/data/####/utils.js
/data/data/####/validate.js
/data/data/####/validate.zip
/data/data/####/verified.png
/data/data/####/vue.js
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/data/####/weixin.png
/data/data/####/worldcup.html
/data/data/####/wuliu.html
/data/data/####/wuliu_che.png
/data/data/####/xx_03.jpg
/data/data/####/yixiajia.png
/data/data/####/zhifu.css
/data/data/####/ztl.css
/data/media/####/.imei.txt
/data/media/####/.nomedia
/data/media/####/AdEnable.dat
/data/media/####/app.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/io.dcloud.yph.bin
/data/media/####/io.dcloud.yph.db
/data/media/####/test.log
/data/media/####/yipinh_2019_05_30_1490.apk

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24280 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu1656434084.so
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24280 300 0

Loads the following dynamic libraries:

getuiext2
libjiagu1656434084

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial