Adware.Gexin.17794

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) o####.sn####.com:80
TCP(HTTP/1.1) cdnuser####.shoujid####.com.####.com:80
TCP(HTTP/1.1) 1####.242.48.56:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) 1####.96.178.35:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) r####.shoujid####.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) log.shoujid####.com:80
TCP(TLS/1.0) s####.we####.com:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5225

DNS requests:

7j####.c####.z0.####.com
a####.u####.com
c-h####.g####.com
cdnri####.shoujid####.com
cdnuser####.shoujid####.com
cm-1####.ig####.com
log.djdu####.com
log.shoujid####.com
log.u####.com
o####.sn####.com
oc.u####.com
r####.shoujid####.com
s####.u####.com
s####.we####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
thi####.q####.cn

HTTP GET requests:

1####.96.178.35/ringres/userv1/m96/264/84103264.mp3
1####.96.178.35/ringres/userv1/m96/710/85609710.mp3
1####.96.178.35/ringres/verify.dat
cdnuser####.shoujid####.com.####.com/head_pic/11/user_head_45424236_2019...
cdnuser####.shoujid####.com.####.com/head_pic/13/user_head_20761695_2019...
cdnuser####.shoujid####.com.####.com/head_pic/17/user_head_7869194_20181...
cdnuser####.shoujid####.com.####.com/head_pic/23/user_head_48197574_2019...
cdnuser####.shoujid####.com.####.com/head_pic/28/user_head_34450921_2019...
cdnuser####.shoujid####.com.####.com/head_pic/30/user_head_31648237_2019...
cdnuser####.shoujid####.com.####.com/head_pic/32/user_head_34961401_2019...
cdnuser####.shoujid####.com.####.com/head_pic/49/user_head_13479992_2019...
cdnuser####.shoujid####.com.####.com/head_pic/49/user_head_14080623_2019...
cdnuser####.shoujid####.com.####.com/head_pic/51/user_head_39733382_2019...
cdnuser####.shoujid####.com.####.com/head_pic/59/user_head_25911053_2019...
cdnuser####.shoujid####.com.####.com/ringres/userv1/m96/087/85604087.mp3
cdnuser####.shoujid####.com.####.com/ringres/userv1/m96/179/85614179.mp3
cdnuser####.shoujid####.com.####.com/ringres/userv1/m96/188/85623188.mp3
cdnuser####.shoujid####.com.####.com/ringres/userv1/m96/590/85610590.mp3
cdnuser####.shoujid####.com.####.com/ringres/userv1/m96/710/85609710.mp3
cdnuser####.shoujid####.com.####.com/ringres/userv1/m96/782/84111782.mp3
cdnuser####.shoujid####.com.####.com/ringres/userv1/video/thumbv1/307/85...
et2-na6####.wagbr####.ali####.####.com/bar/get/4fa4d53e5270157de9000014/...
log.shoujid####.com/log.php?user=####&prod=####&isrc=####&mac=####&dev=#...
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_imh016
q####.c####.l####.####.com/tdata_uPH680
r####.shoujid####.com/ring_enc.php?cmd=####&q=cTCi0####
r####.shoujid####.com/ring_enc.php?type=####&q=####
r####.shoujid####.com/ringv1/verify.dat
r####.shoujid####.com/ringv1/xmldata/searchad.xml
thi####.q####.cn/g?b=####&k=####&s=####&t=####

HTTP POST requests:

a####.u####.com/app_logs
c-h####.g####.com/api.php?format=####&t=####
o####.sn####.com/access_token/register/device/v2/?
oc.u####.com/v2/get_update_time
sdk-ope####.g####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1568381694126.log
/data/data/####/MultiDex.lock
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/_dexmob.xml
/data/data/####/_duoduonews.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/duoduo.ringtone.database
/data/data/####/duoduo.ringtone.database-journal
/data/data/####/duoduom_baidu_1.jpg.jar
/data/data/####/duoduom_gdt_1.jpg.jar
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu178973751.so
/data/data/####/lna.nq
/data/data/####/lock_dm
/data/data/####/lock_gt
/data/data/####/multidex.version.xml
/data/data/####/onlineconfig_agent_online_setting_com.shoujiduo...ne.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qos.xml
/data/data/####/ring.shoujiduoduo.com.xml
/data/data/####/run.pid
/data/data/####/tdata_imh016
/data/data/####/tdata_imh016.jar
/data/data/####/tdata_uPH680
/data/data/####/tdata_uPH680.jar
/data/data/####/tmpd8.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/update_lc
/data/media/####/-1024035333
/data/media/####/-1965391950
/data/media/####/-1984034472
/data/media/####/-298226654
/data/media/####/-518448381
/data/media/####/-553350923
/data/media/####/-809181465
/data/media/####/-836799447
/data/media/####/-851394372
/data/media/####/.nomedia
/data/media/####/1059179883
/data/media/####/1808937995
/data/media/####/283726653
/data/media/####/app.db
/data/media/####/category.tmp
/data/media/####/cdnringbd.shoujiduoduo.com-ringres-userv1-vide...p4.mp4
/data/media/####/cdnringbd.shoujiduoduo.com-ringres-userv1-vide...p4.pdl
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.shoujiduoduo.ringtone.bin
/data/media/####/com.shoujiduoduo.ringtone.db
/data/media/####/config.tmp
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/hotkey.tmp
/data/media/####/list_0.tmp
/data/media/####/list_1.tmp
/data/media/####/make_ring.xml
/data/media/####/search_ad.tmp
/data/media/####/tdata_imh016
/data/media/####/tdata_uPH680
/data/media/####/toplist.tmp
/data/media/####/verify_cdn.dat
/data/media/####/verify_duoduo1.dat
/data/media/####/铃声多多_♡ 湘怡【8000】✨曾经那亿万星辰我一眼钟情.I used to love h...28.mp3
/data/media/####/铃声多多_晴芳.——「抖音火曲」全网都在找！你找多久啦_♡晴芳.mp3
/data/media/####/铃声多多_百酷哪吒❗ - 以热爱的态度对待生活就是对自己温柔_百酷哪吒❗.mp3
/data/media/####/铃声多多_精彩9叔❗-【好听翻唱】所以……所以到那里都像快乐被燃起._精彩锦弟❗.mp3
/data/media/####/铃声多多_苏妹妹鸭——突如其来的委屈，连笑都带着僵硬。_爱丧女孩.mp3
/data/media/####/铃声多多_苏苏. 左边跟我一起画个龙，在你右边画一道彩虹_苏苏..mp3

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.shoujiduoduo.service.GTPushService 25595 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.shoujiduoduo.service.GTPushService 25595 300 0

Loads the following dynamic libraries:

QPlayer
getuiext2
libjiagu178973751
mad
opencore_aac
url_encode

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial