Android.Gexin.300

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Gexin.1

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) tinychi####.q####.com.####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.g####.com:5226

DNS requests:

7j####.c####.z0.####.com
a.appj####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.g####.com
mt####.go####.com
sdk-ope####.g####.com
sdk.c####.g####.com
sdk.o####.i####.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com

HTTP GET requests:

cdn-sdk####.g####.com.####.com/tdata_EvJ733
sdk.o####.p####.####.com/api/addr.htm
ti####.c####.l####.####.com/tdata_eoG063
tinychi####.q####.com.####.com/config/hzv9.conf

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/H5AF06CC3.xml
/data/data/####/H5AF06CC3_storages.xml
/data/data/####/clientid_igexin.xml
/data/data/####/increment.db-journal
/data/data/####/init.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/pdr.xml
/data/data/####/push.pid
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/tdata_EvJ733.jar
/data/data/####/tdata_EvJ733.tmp
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/240x180.gif
/data/media/####/UEC_Add_accounts.html
/data/media/####/UEC_Edit_accounts.html
/data/media/####/UEC_add_server_buy.html
/data/media/####/UEC_add_server_buy.js
/data/media/####/UEC_add_server_detail.html
/data/media/####/UEC_add_server_detail.js
/data/media/####/UEC_add_server_support.html
/data/media/####/UEC_add_server_support.js
/data/media/####/UEC_add_server_type.html
/data/media/####/UEC_add_server_type.js
/data/media/####/UEC_add_service_pro.html
/data/media/####/UEC_barcode_scan.html
/data/media/####/UEC_beauty_parlour_img.html
/data/media/####/UEC_beauty_parlour_img.js
/data/media/####/UEC_beauty_parlour_location.html
/data/media/####/UEC_beauty_parlour_location.js
/data/media/####/UEC_beauty_parlour_location_item.html
/data/media/####/UEC_beauty_parlour_location_item.js
/data/media/####/UEC_beauty_parlour_location_num.html
/data/media/####/UEC_beauty_parlour_location_num.js
/data/media/####/UEC_beauty_parlour_management.html
/data/media/####/UEC_bed_img.html
/data/media/####/UEC_bed_img.js
/data/media/####/UEC_bed_info.html
/data/media/####/UEC_bed_management.html
/data/media/####/UEC_bind_alipay.html
/data/media/####/UEC_bind_tel.html
/data/media/####/UEC_bind_telphone.html
/data/media/####/UEC_change_tel.html
/data/media/####/UEC_change_telcommit.html
/data/media/####/UEC_change_telphone.html
/data/media/####/UEC_data_statics.html
/data/media/####/UEC_data_statics2.html
/data/media/####/UEC_data_statics3.html
/data/media/####/UEC_edit_service_pro.html
/data/media/####/UEC_home.html
/data/media/####/UEC_idea.html
/data/media/####/UEC_idea.js
/data/media/####/UEC_income_flow.html
/data/media/####/UEC_message_notification.html
/data/media/####/UEC_my_income.html
/data/media/####/UEC_others_Center.html
/data/media/####/UEC_preview_info.html
/data/media/####/UEC_pro_Management.html
/data/media/####/UEC_pro_details.html
/data/media/####/UEC_reserve_view_comment.html
/data/media/####/UEC_safety.html
/data/media/####/UEC_setting.html
/data/media/####/UEC_user_Management.html
/data/media/####/UEC_user_message.html
/data/media/####/UEC_withdraw.html
/data/media/####/UEC_withdraw_finish.html
/data/media/####/UEC_withdraw_verify.html
/data/media/####/about.html
/data/media/####/about.js
/data/media/####/add.png
/data/media/####/add_accounts.js
/data/media/####/add_service_pro.js
/data/media/####/agreement.html
/data/media/####/agreement.js
/data/media/####/app.db
/data/media/####/arttmpl.js
/data/media/####/attach.png
/data/media/####/barcode_scan.html
/data/media/####/barcode_scan.js
/data/media/####/beauty.png
/data/media/####/beauty_parlour_management.js
/data/media/####/bed.png
/data/media/####/bed_info.js
/data/media/####/bed_management.js
/data/media/####/bg-xy.jpg
/data/media/####/binaryajax.js
/data/media/####/bind_alipay.js
/data/media/####/bind_tel.js
/data/media/####/bind_telphone.js
/data/media/####/camera.png
/data/media/####/canvasResize.js
/data/media/####/change_telphone.js
/data/media/####/cityData.js
/data/media/####/code.png
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.meiliwang.businessescloud.db
/data/media/####/commission.png
/data/media/####/common.css
/data/media/####/common.js
/data/media/####/data_statics.js
/data/media/####/data_statics2.js
/data/media/####/data_statics3.js
/data/media/####/del.png
/data/media/####/delete.png
/data/media/####/down.png
/data/media/####/down2.png
/data/media/####/e100.png
/data/media/####/e101.png
/data/media/####/e102.png
/data/media/####/e103.png
/data/media/####/e104.png
/data/media/####/e105.png
/data/media/####/e106.png
/data/media/####/e107.png
/data/media/####/e108.png
/data/media/####/e109.png
/data/media/####/e110.png
/data/media/####/e111.png
/data/media/####/e112.png
/data/media/####/e113.png
/data/media/####/e114.png
/data/media/####/e115.png
/data/media/####/e116.png
/data/media/####/e117.png
/data/media/####/e118.png
/data/media/####/e119.png
/data/media/####/e120.png
/data/media/####/e121.png
/data/media/####/e122.png
/data/media/####/e123.png
/data/media/####/e124.png
/data/media/####/e125.png
/data/media/####/e126.png
/data/media/####/e127.png
/data/media/####/e128.png
/data/media/####/e129.png
/data/media/####/e130.png
/data/media/####/e131.png
/data/media/####/e132.png
/data/media/####/e133.png
/data/media/####/e134.png
/data/media/####/e135.png
/data/media/####/e136.png
/data/media/####/e137.png
/data/media/####/e138.png
/data/media/####/e139.png
/data/media/####/e140.png
/data/media/####/e141.png
/data/media/####/e142.png
/data/media/####/e143.png
/data/media/####/e144.png
/data/media/####/e145.png
/data/media/####/e146.png
/data/media/####/e147.png
/data/media/####/e148.png
/data/media/####/e149.png
/data/media/####/e150.png
/data/media/####/e151.png
/data/media/####/e152.png
/data/media/####/e153.png
/data/media/####/e154.png
/data/media/####/e155.png
/data/media/####/e156.png
/data/media/####/e157.png
/data/media/####/e158.png
/data/media/####/e159.png
/data/media/####/edit-password.html
/data/media/####/edit.png
/data/media/####/edit_accounts.js
/data/media/####/edit_service_pro.js
/data/media/####/email.png
/data/media/####/emot.js
/data/media/####/empty.png
/data/media/####/exif.js
/data/media/####/eye2.png
/data/media/####/face.png
/data/media/####/fav.png
/data/media/####/finish.png
/data/media/####/head.png
/data/media/####/home.png
/data/media/####/home2.png
/data/media/####/ico-1.png
/data/media/####/ico-2.png
/data/media/####/ico-3.png
/data/media/####/iconfont.css
/data/media/####/iconfont.ttf
/data/media/####/images.png
/data/media/####/imageviewer.css
/data/media/####/img-9.png
/data/media/####/imgbg.gif
/data/media/####/income_flow.js
/data/media/####/increase.png
/data/media/####/index.html
/data/media/####/listpicker.js
/data/media/####/loading.gif
/data/media/####/lock.png
/data/media/####/login.css
/data/media/####/login.html
/data/media/####/login.js
/data/media/####/login_bg.jpg
/data/media/####/main.js
/data/media/####/manifest.json
/data/media/####/message.png
/data/media/####/message_notification.js
/data/media/####/message_notification_pullrefresh.html
/data/media/####/message_notification_pullrefresh.js
/data/media/####/mly.png
/data/media/####/more.png
/data/media/####/mui.js
/data/media/####/mui.listpicker.css
/data/media/####/mui.min.css
/data/media/####/mui.poppicker.css
/data/media/####/mui.ttf
/data/media/####/my_income.js
/data/media/####/nosigned.html
/data/media/####/nosigned.js
/data/media/####/notice.png
/data/media/####/notices.png
/data/media/####/others_Center.js
/data/media/####/password.js
/data/media/####/pic-01.jpg
/data/media/####/pic-02.jpg
/data/media/####/pic-03.jpg
/data/media/####/pic81.png
/data/media/####/pic88.png
/data/media/####/poppicker.js
/data/media/####/preview_info.js
/data/media/####/previewimage.js
/data/media/####/pro_Management.js
/data/media/####/pro_detail.js
/data/media/####/project.png
/data/media/####/pullToRefresh.js
/data/media/####/pullToRefreshMaterial.js
/data/media/####/reduce.png
/data/media/####/remind_Comment.js
/data/media/####/require.js
/data/media/####/reserve_view_comment.js
/data/media/####/safety.js
/data/media/####/sbed.png
/data/media/####/scan.png
/data/media/####/select.png
/data/media/####/set.png
/data/media/####/setting.js
/data/media/####/setting.png
/data/media/####/shopping.png
/data/media/####/star-red.png
/data/media/####/star.png
/data/media/####/star2.png
/data/media/####/style.css
/data/media/####/success.png
/data/media/####/tdata_EvJ733
/data/media/####/telphone.png
/data/media/####/time.png
/data/media/####/time2.png
/data/media/####/update.js
/data/media/####/user_Management.js
/data/media/####/user_message.js
/data/media/####/userbg.jpg
/data/media/####/video.png
/data/media/####/withdraw.js
/data/media/####/withdraw_finish.js
/data/media/####/withdraw_verify.js
/data/media/####/write.png
/data/media/####/zoom.js

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/files/libjiagu.so

Loads the following dynamic libraries:

libjiagu

Uses the following algorithms to encrypt data:

AES-CFB-NoPadding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CFB-NoPadding

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial