Adware.Gexin.21163

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) large####.c####.l####.####.com:80
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) d####.c####.l####.####.com:443
TCP(TLS/1.0) 1####.217.17.74:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) cgi.con####.qq.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) dmm.lo####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 1####.194.220.101:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.217.17.74:443
TCP dispatc####.dui####.cn:9225

DNS requests:

android####.go####.com
api.map.b####.com
api.w####.com
c6eecd6####.bug####.com
cgi.con####.qq.com
d####.dui####.cn
d####.lo####.com
d####.lo####.com
dispatc####.dui####.cn
dispatc####.dui####.cn
dmm.lo####.com
instant####.google####.com
md####.google####.com
p####.google####.com
pi####.qq.com
www.google####.com

HTTP GET requests:

cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?status_os=####&stat...
large####.c####.l####.####.com/wawaji-wawaji-release1512962048.apk

HTTP POST requests:

pi####.qq.com/mstat/report

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/Signature_0.key
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/authStatus_com.blackbean.paopao.xml
/data/data/####/base-1.apk
/data/data/####/base-1.dex
/data/data/####/base-1.dex.flock (deleted)
/data/data/####/channel.xml
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/classes3.dex
/data/data/####/com.blackbean.paopao_preferences.xml
/data/data/####/com.blackbean.paopao_preferences.xml.bak
/data/data/####/com.tencent.open.config.json.100314375
/data/data/####/journal.tmp
/data/data/####/libBugtags.so
/data/data/####/libQPlayer.so
/data/data/####/libcuid.so
/data/data/####/libgetuiext2.so
/data/data/####/libijkplayer.so
/data/data/####/libjiagu.so
/data/data/####/libqcCodec.so
/data/data/####/libqcOpenSSL.so
/data/data/####/librealm-jni.so
/data/data/####/libshare.so
/data/data/####/libweibosdkcore.so
/data/data/####/loovee_push.xml
/data/data/####/loovee_push.xml.bak
/data/data/####/mac.xml
/data/data/####/molove.db-journal
/data/data/####/molove_account.db-journal
/data/data/####/plugin.xml
/data/data/####/proc_auxv
/data/data/####/tencent_analysis.db-journal
/data/data/####/tmp.D0Kjgy
/data/data/####/tmp.gXYKqk
/data/data/####/tmp.w43Si0
/data/data/####/weibo_sdk_aid1
/data/media/####/.DS_Store
/data/media/####/._.DS_Store
/data/media/####/._che_guangchang_sr_1.png
/data/media/####/._che_guangchang_sr_2.png
/data/media/####/._che_guangchang_sr_chepai_1.png
/data/media/####/._che_guangchang_sr_chepai_2.png
/data/media/####/._che_guangchang_sr_chuang_1.png
/data/media/####/._che_guangchang_sr_chuang_2.png
/data/media/####/._che_guangchang_sr_xin_1.png
/data/media/####/._che_guangchang_sr_xin_2.png
/data/media/####/._che_guangchang_tuhao_1.png
/data/media/####/._che_guangchang_tuhao_2.png
/data/media/####/._che_guangchang_tuhao_chepai_1.png
/data/media/####/._che_guangchang_tuhao_chepai_2.png
/data/media/####/._che_guangchang_tuhao_chuang_1.png
/data/media/####/._che_guangchang_tuhao_chuang_2.png
/data/media/####/._che_guangchang_tuhao_xin_1.png
/data/media/####/._che_guangchang_tuhao_xin_2.png
/data/media/####/._che_zhuye_sr_1.png
/data/media/####/._che_zhuye_sr_2.png
/data/media/####/._che_zhuye_sr_chepai_1.png
/data/media/####/._che_zhuye_sr_chepai_2.png
/data/media/####/._che_zhuye_sr_chuang_1.png
/data/media/####/._che_zhuye_sr_chuang_2.png
/data/media/####/._che_zhuye_sr_xin_1.png
/data/media/####/._che_zhuye_sr_xin_2.png
/data/media/####/._dw_guangchang_ftsz_da@2x.png
/data/media/####/._dw_guangchang_ftsz_xiao@2x.png
/data/media/####/._dw_guangchang_moto_da@2x.png
/data/media/####/._dw_guangchang_moto_xiao@2x.png
/data/media/####/._dw_zhuye_ftsz_da@2x.png
/data/media/####/._dw_zhuye_moto_da@2x.png
/data/media/####/._find_icon_duim@2x.png
/data/media/####/._find_icon_duim_press@2x.png
/data/media/####/._find_icon_faxian@2x.png
/data/media/####/._find_icon_faxian_press@2x.png
/data/media/####/._find_icon_gengduo@2x.png
/data/media/####/._find_icon_gengduo_press@2x.png
/data/media/####/._find_icon_guangchang@2x.png
/data/media/####/._find_icon_guangchang_press@2x.png
/data/media/####/._find_icon_news@2x.png
/data/media/####/._find_icon_news_press@2x.png
/data/media/####/._navibar_icon_edit@2x.png
/data/media/####/._navibar_icon_screen@2x.png
/data/media/####/._paoche.mp3
/data/media/####/._paoche3001.mp3
/data/media/####/._paoche3003.mp3
/data/media/####/._square_button_down@2x.png
/data/media/####/._square_button_down_new@2x.png
/data/media/####/._square_icon_fabiao@2x.png
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/1.app.log
/data/media/####/461
/data/media/####/cartoon_car_pig01_140905@2x.png
/data/media/####/cartoon_car_pig02_140905@2x.png
/data/media/####/che_guangchang_jisu_1.png
/data/media/####/che_guangchang_jisu_2.png
/data/media/####/che_guangchang_jisu_chepai_1.png
/data/media/####/che_guangchang_jisu_chepai_2.png
/data/media/####/che_guangchang_jisu_chuang_1.png
/data/media/####/che_guangchang_jisu_chuang_2.png
/data/media/####/che_guangchang_jisu_xin_1.png
/data/media/####/che_guangchang_jisu_xin_2.png
/data/media/####/che_guangchang_shuangren_1.png
/data/media/####/che_guangchang_shuangren_2.png
/data/media/####/che_guangchang_shuangren_chepai_1.png
/data/media/####/che_guangchang_shuangren_chepai_2.png
/data/media/####/che_guangchang_shuangren_chuang_1.png
/data/media/####/che_guangchang_shuangren_chuang_2.png
/data/media/####/che_guangchang_shuangren_xin_1.png
/data/media/####/che_guangchang_shuangren_xin_2.png
/data/media/####/che_guangchang_shuangren_xin_3.png
/data/media/####/che_guangchang_shuangren_xin_4.png
/data/media/####/che_guangchang_shuangren_xin_5.png
/data/media/####/che_guangchang_shuangren_xin_6.png
/data/media/####/che_guangchang_shuangren_xin_7.png
/data/media/####/che_guangchang_sr_1.png
/data/media/####/che_guangchang_sr_2.png
/data/media/####/che_guangchang_sr_chepai_1.png
/data/media/####/che_guangchang_sr_chepai_2.png
/data/media/####/che_guangchang_sr_chuang_1.png
/data/media/####/che_guangchang_sr_chuang_2.png
/data/media/####/che_guangchang_sr_xin_1.png
/data/media/####/che_guangchang_sr_xin_2.png
/data/media/####/che_guangchang_tuhao_1.png
/data/media/####/che_guangchang_tuhao_2.png
/data/media/####/che_guangchang_tuhao_chepai_1.png
/data/media/####/che_guangchang_tuhao_chepai_2.png
/data/media/####/che_guangchang_tuhao_chuang_1.png
/data/media/####/che_guangchang_tuhao_chuang_2.png
/data/media/####/che_guangchang_tuhao_xin_1.png
/data/media/####/che_guangchang_tuhao_xin_2.png
/data/media/####/che_guangchang_xk_1.png
/data/media/####/che_guangchang_xk_2.png
/data/media/####/che_guangchang_xk_chepai_1.png
/data/media/####/che_guangchang_xk_chepai_2.png
/data/media/####/che_guangchang_xk_chuang_1.png
/data/media/####/che_guangchang_xk_chuang_2.png
/data/media/####/che_guangchang_xk_shan_1.png
/data/media/####/che_guangchang_xk_shan_3.png
/data/media/####/che_guangchang_xk_shan_4.png
/data/media/####/che_guangchang_xk_shan_5.png
/data/media/####/che_guangchang_xk_shan_6.png
/data/media/####/che_guangchang_xk_xin_2.png
/data/media/####/che_zhuye_jisu_1.png
/data/media/####/che_zhuye_jisu_2.png
/data/media/####/che_zhuye_jisu_chepai_1.png
/data/media/####/che_zhuye_jisu_chepai_2.png
/data/media/####/che_zhuye_jisu_chuang_1.png
/data/media/####/che_zhuye_jisu_chuang_2.png
/data/media/####/che_zhuye_jisu_xin_1.png
/data/media/####/che_zhuye_jisu_xin_2.png
/data/media/####/che_zhuye_shuangren_1.png
/data/media/####/che_zhuye_shuangren_2.png
/data/media/####/che_zhuye_shuangren_chepai_1.png
/data/media/####/che_zhuye_shuangren_chepai_2.png
/data/media/####/che_zhuye_shuangren_chuang_1.png
/data/media/####/che_zhuye_shuangren_chuang_2.png
/data/media/####/che_zhuye_shuangren_xin_1.png
/data/media/####/che_zhuye_shuangren_xin_2.png
/data/media/####/che_zhuye_shuangren_xin_3.png
/data/media/####/che_zhuye_shuangren_xin_4.png
/data/media/####/che_zhuye_shuangren_xin_5.png
/data/media/####/che_zhuye_shuangren_xin_6.png
/data/media/####/che_zhuye_shuangren_xin_7.png
/data/media/####/che_zhuye_sr_1.png
/data/media/####/che_zhuye_sr_2.png
/data/media/####/che_zhuye_sr_chepai_1.png
/data/media/####/che_zhuye_sr_chepai_2.png
/data/media/####/che_zhuye_sr_chuang_1.png
/data/media/####/che_zhuye_sr_chuang_2.png
/data/media/####/che_zhuye_sr_xin_1.png
/data/media/####/che_zhuye_sr_xin_2.png
/data/media/####/che_zhuye_xk_1.png
/data/media/####/che_zhuye_xk_2.png
/data/media/####/che_zhuye_xk_chepai_1.png
/data/media/####/che_zhuye_xk_chepai_2.png
/data/media/####/che_zhuye_xk_chuang_1.png
/data/media/####/che_zhuye_xk_chuang_2.png
/data/media/####/che_zhuye_xk_shan_1.png
/data/media/####/che_zhuye_xk_shan_3.png
/data/media/####/che_zhuye_xk_shan_4.png
/data/media/####/che_zhuye_xk_shan_5.png
/data/media/####/che_zhuye_xk_shan_6.png
/data/media/####/che_zhuye_xk_xin_2.png
/data/media/####/config.json
/data/media/####/config.json.nohttp
/data/media/####/dw_guangchang_ftsz_da@2x.png
/data/media/####/dw_guangchang_ftsz_xiao@2x.png
/data/media/####/dw_guangchang_gou_da@2x.png
/data/media/####/dw_guangchang_gou_xiao@2x.png
/data/media/####/dw_guangchang_hehua_da@2x.png
/data/media/####/dw_guangchang_hehua_xiao@2x.png
/data/media/####/dw_guangchang_jinji_da@2x.png
/data/media/####/dw_guangchang_jinji_xiao@2x.png
/data/media/####/dw_guangchang_kongq_da@2x.png
/data/media/####/dw_guangchang_kongq_xiao@2x.png
/data/media/####/dw_guangchang_lang_da@2x.png
/data/media/####/dw_guangchang_lang_xiao@2x.png
/data/media/####/dw_guangchang_long_da@2x.png
/data/media/####/dw_guangchang_long_xiao@2x.png
/data/media/####/dw_guangchang_ma_da@2x.png
/data/media/####/dw_guangchang_ma_xiao@2x.png
/data/media/####/dw_guangchang_moto_da@2x.png
/data/media/####/dw_guangchang_moto_xiao@2x.png
/data/media/####/dw_guangchang_qiao_da@2x.png
/data/media/####/dw_guangchang_qiao_xiao@2x.png
/data/media/####/dw_guangchang_shizi_da@2x.png
/data/media/####/dw_guangchang_shizi_xiao@2x.png
/data/media/####/dw_guangchang_tiane_da@2x.png
/data/media/####/dw_guangchang_tiane_da@2x.zip
/data/media/####/dw_guangchang_tiane_da@2x.zip.nohttp
/data/media/####/dw_guangchang_tiane_xiao@2x.png
/data/media/####/dw_zhuye_ftsz_da@2x.png
/data/media/####/dw_zhuye_gou_da@2x.png
/data/media/####/dw_zhuye_gou_da@2x.zip
/data/media/####/dw_zhuye_gou_da@2x.zip.nohttp
/data/media/####/dw_zhuye_hehua_da@2x.png
/data/media/####/dw_zhuye_hehua_da@2x.zip
/data/media/####/dw_zhuye_hehua_da@2x.zip.nohttp
/data/media/####/dw_zhuye_jinji_da@2x.png
/data/media/####/dw_zhuye_jinji_da@2x.zip
/data/media/####/dw_zhuye_jinji_da@2x.zip.nohttp
/data/media/####/dw_zhuye_kongq_da@2x.png
/data/media/####/dw_zhuye_kongq_da@2x.zip
/data/media/####/dw_zhuye_kongq_da@2x.zip.nohttp
/data/media/####/dw_zhuye_lang_da@2x.png
/data/media/####/dw_zhuye_lang_da@2x.zip
/data/media/####/dw_zhuye_lang_da@2x.zip.nohttp
/data/media/####/dw_zhuye_long_da@2x.png
/data/media/####/dw_zhuye_long_da@2x.zip
/data/media/####/dw_zhuye_long_da@2x.zip.nohttp
/data/media/####/dw_zhuye_ma_da@2x.png
/data/media/####/dw_zhuye_ma_da@2x.zip
/data/media/####/dw_zhuye_ma_da@2x.zip.nohttp
/data/media/####/dw_zhuye_moto_da@2x.png
/data/media/####/dw_zhuye_moto_da@2x.png.zip
/data/media/####/dw_zhuye_moto_da@2x.png.zip.nohttp
/data/media/####/dw_zhuye_qiao_da@2x.png
/data/media/####/dw_zhuye_qiao_da@2x.zip
/data/media/####/dw_zhuye_qiao_da@2x.zip.nohttp
/data/media/####/dw_zhuye_shizi_da@2x.png
/data/media/####/dw_zhuye_shizi_da@2x.zip
/data/media/####/dw_zhuye_shizi_da@2x.zip.nohttp
/data/media/####/find_icon_duim@2x.png
/data/media/####/find_icon_duim_press@2x.png
/data/media/####/find_icon_faxian@2x.png
/data/media/####/find_icon_faxian_press@2x.png
/data/media/####/find_icon_gengduo@2x.png
/data/media/####/find_icon_gengduo_press@2x.png
/data/media/####/find_icon_guangchang@2x.png
/data/media/####/find_icon_guangchang_press@2x.png
/data/media/####/find_icon_news@2x.png
/data/media/####/find_icon_news_press@2x.png
/data/media/####/flyPig.zip
/data/media/####/flyPig.zip.nohttp
/data/media/####/gerenzhuye1.zip
/data/media/####/gerenzhuye1.zip.nohttp
/data/media/####/guangchang1.zip
/data/media/####/guangchang1.zip.nohttp
/data/media/####/haochekuangbiao.mp3
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/letianshenzhu.zip
/data/media/####/letianshenzhu.zip.nohttp
/data/media/####/letianshenzhuzuo.zip
/data/media/####/letianshenzhuzuo.zip.nohttp
/data/media/####/motuoche1031.zip
/data/media/####/motuoche1031.zip.nohttp
/data/media/####/navibar_icon_edit@2x.png
/data/media/####/navibar_icon_screen@2x.png
/data/media/####/paoche.mp3
/data/media/####/paoche3001.mp3
/data/media/####/paoche3003.mp3
/data/media/####/square_button_down@2x.png
/data/media/####/square_button_down_new@2x.png
/data/media/####/square_icon_fabiao@2x.png
/data/media/####/wawaji-wawaji-release1512962048.apk
/data/media/####/wawaji-wawaji-release1512962048.apk.nohttp
/data/media/####/个人主页1.zip
/data/media/####/个人主页1.zip.nohttp
/data/media/####/二人右（1）.zip
/data/media/####/二人右（1）.zip.nohttp
/data/media/####/二人左（1）.zip
/data/media/####/二人左（1）.zip.nohttp
/data/media/####/天鹅广场(右).zip
/data/media/####/天鹅广场(右).zip.nohttp
/data/media/####/孔雀广场(右).zip
/data/media/####/孔雀广场(右).zip.nohttp
/data/media/####/小康右（1）.zip
/data/media/####/小康右（1）.zip.nohttp
/data/media/####/小康左（1）.zip
/data/media/####/小康左（1）.zip.nohttp
/data/media/####/广场碎片2.zip
/data/media/####/广场碎片2.zip.nohttp
/data/media/####/归档.zip
/data/media/####/归档.zip.nohttp
/data/media/####/极速右（1）.zip
/data/media/####/极速右（1）.zip.nohttp
/data/media/####/极速左（1）.zip
/data/media/####/极速左（1）.zip.nohttp
/data/media/####/桥广场(右).zip
/data/media/####/桥广场(右).zip.nohttp
/data/media/####/狮子广场(右).zip
/data/media/####/狮子广场(右).zip.nohttp
/data/media/####/狼广场(右1).zip
/data/media/####/狼广场(右1).zip.nohttp
/data/media/####/荷花广场(右).zip
/data/media/####/荷花广场(右).zip.nohttp
/data/media/####/萌犬广场(右).zip
/data/media/####/萌犬广场(右).zip.nohttp
/data/media/####/金鸡广场.zip
/data/media/####/金鸡广场.zip.nohttp
/data/media/####/马广场(右).zip
/data/media/####/马广场(右).zip.nohttp
/data/media/####/龙广场(右).zip
/data/media/####/龙广场(右).zip.nohttp
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --instruction-set=x86 --dex-file=/data/user/0/<Package>/.jiagu/classes.dex --dex-file=/data/user/0/<Package>/.jiagu/classes2.dex --dex-file=/data/user/0/<Package>/.jiagu/classes3.dex --oat-file=/data/user/0/<Package>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/Plugin/com.loovee.wawaji/apk/base-1.apk --oat-fd=92 --oat-location=/data/user/0/<Package>/Plugin/com.loovee.wawaji/dalvik-cache/base-1.dex --compiler-filter=speed
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial