Adware.Gexin.23200

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) pay.gy####.com:80
TCP(HTTP/1.1) gosspu####.al####.com:80
UDP(NTP) 2.and####.p####.####.org:123
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) xjp.wagbr####.alibaba####.com:443
TCP(TLS/1.2) 1####.250.27.94:443
UDP 1####.250.27.95:443

DNS requests:

2.and####.p####.####.org
gosspu####.al####.com
pay.gy####.com
res####.a####.com
we####.a####.com

HTTP GET requests:

gosspu####.al####.com/aliyun-oss-sdk-4.4.4.min.js
pay.gy####.com/h5/zhtc/index.html
pay.gy####.com/h5/zhtc/js/cos-js-sdk-v5.min.js
pay.gy####.com/h5/zhtc/js/esdk-obs-browserjs.min.js
pay.gy####.com/h5/zhtc/static/css/ActivityMgmt.09a19db3.css
pay.gy####.com/h5/zhtc/static/css/Address.99c9db6f.css
pay.gy####.com/h5/zhtc/static/css/Agreement.b00d1c09.css
pay.gy####.com/h5/zhtc/static/css/CarServe.7c3d1ab2.css
pay.gy####.com/h5/zhtc/static/css/CarServe~CarWashServe~ChangeFail~Charg...
pay.gy####.com/h5/zhtc/static/css/CarWashServe.b13a2236.css
pay.gy####.com/h5/zhtc/static/css/CarWashServe~ConfirmOrder.e8c356ee.css
pay.gy####.com/h5/zhtc/static/css/CarWashServe~ConfirmOrder~LeavePayment...
pay.gy####.com/h5/zhtc/static/css/ChangeFail.20a0b829.css
pay.gy####.com/h5/zhtc/static/css/ChangeMobile.922c9e92.css
pay.gy####.com/h5/zhtc/static/css/ChargeHelp.bdbc3bca.css
pay.gy####.com/h5/zhtc/static/css/ChargeInput.e2e5ff3a.css
pay.gy####.com/h5/zhtc/static/css/ChargePrePay.cdef20c3.css
pay.gy####.com/h5/zhtc/static/css/ChargeState.5e30cbd5.css
pay.gy####.com/h5/zhtc/static/css/ChargeTerminalDetail.96242331.css
pay.gy####.com/h5/zhtc/static/css/ChargingRecord.15667501.css
pay.gy####.com/h5/zhtc/static/css/Classify.25381fdf.css
pay.gy####.com/h5/zhtc/static/css/ConfirmOrder.a4ec408f.css
pay.gy####.com/h5/zhtc/static/css/CustomerService.e876494a.css
pay.gy####.com/h5/zhtc/static/css/CustomerService~Feedback~Goods~LeavePa...
pay.gy####.com/h5/zhtc/static/css/CustomerService~Goods~Shop.454a879e.css
pay.gy####.com/h5/zhtc/static/css/CustomerService~Mine~MonthCard~Order~O...
pay.gy####.com/h5/zhtc/static/css/ElecDriverLicenseMgmt.bf097e46.css
pay.gy####.com/h5/zhtc/static/css/Feedback.1fb53de3.css
pay.gy####.com/h5/zhtc/static/css/GetQm.fcd11a5c.css
pay.gy####.com/h5/zhtc/static/css/Goods.68e8081b.css
pay.gy####.com/h5/zhtc/static/css/Goods~MyCar~Personal~Public.8bd40152.css
pay.gy####.com/h5/zhtc/static/css/Goods~Shop.90f72a4d.css
pay.gy####.com/h5/zhtc/static/css/Integral.10833628.css
pay.gy####.com/h5/zhtc/static/css/InvoiceMgmt.74a670d0.css
pay.gy####.com/h5/zhtc/static/css/LeavePayment.c4af7870.css
pay.gy####.com/h5/zhtc/static/css/LeavePayment~OrderList.b19e992d.css
pay.gy####.com/h5/zhtc/static/css/MallHome.20f04db4.css
pay.gy####.com/h5/zhtc/static/css/MallHome~ParkingLot.eb530868.css
pay.gy####.com/h5/zhtc/static/css/MemberExplanation.ebfeb995.css
pay.gy####.com/h5/zhtc/static/css/Mine.074ca8dc.css
pay.gy####.com/h5/zhtc/static/css/MonthCard.ec355f33.css
pay.gy####.com/h5/zhtc/static/css/MoveCar.b082c7c0.css
pay.gy####.com/h5/zhtc/static/css/MyCar.61192d62.css
pay.gy####.com/h5/zhtc/static/css/MyMessage.ec6e2cb9.css
pay.gy####.com/h5/zhtc/static/css/News.d113fbaf.css
pay.gy####.com/h5/zhtc/static/css/Order.ab056758.css
pay.gy####.com/h5/zhtc/static/css/OrderComplaint.07c1dd1f.css
pay.gy####.com/h5/zhtc/static/css/OrderList.4dd340a2.css
pay.gy####.com/h5/zhtc/static/css/OrderScore.8339ed37.css
pay.gy####.com/h5/zhtc/static/css/ParkingLot.73203fd7.css
pay.gy####.com/h5/zhtc/static/css/ParkingSet.535a330d.css
pay.gy####.com/h5/zhtc/static/css/PayError.ea4c6fd8.css
pay.gy####.com/h5/zhtc/static/css/PayResult.87abba2e.css
pay.gy####.com/h5/zhtc/static/css/Personal.ec30e1f4.css
pay.gy####.com/h5/zhtc/static/css/ProductReview.4d979bf1.css
pay.gy####.com/h5/zhtc/static/css/Public.9d8e6ace.css
pay.gy####.com/h5/zhtc/static/css/RentParkingSpace.91a15510.css
pay.gy####.com/h5/zhtc/static/css/ReserveParking.62b91902.css
pay.gy####.com/h5/zhtc/static/css/ShareMgmt.81bbefcd.css
pay.gy####.com/h5/zhtc/static/css/Shop.cab9e6d5.css
pay.gy####.com/h5/zhtc/static/css/ShoppingCart.df4150fb.css
pay.gy####.com/h5/zhtc/static/css/UnlicensedCar.4948ec4b.css
pay.gy####.com/h5/zhtc/static/css/WechatChange.65c70877.css
pay.gy####.com/h5/zhtc/static/css/app.44b33986.css
pay.gy####.com/h5/zhtc/static/css/chunk-vendors.af4c0408.css
pay.gy####.com/h5/zhtc/static/js/ActivityMgmt.895b272f.js
pay.gy####.com/h5/zhtc/static/js/Address.ad924f3b.js
pay.gy####.com/h5/zhtc/static/js/Agreement.d2cbc47c.js
pay.gy####.com/h5/zhtc/static/js/CarServe.62112281.js
pay.gy####.com/h5/zhtc/static/js/CarServe~CarWashServe~ChangeFail~Chargi...
pay.gy####.com/h5/zhtc/static/js/CarWashServe.deb110bc.js
pay.gy####.com/h5/zhtc/static/js/CarWashServe~ConfirmOrder.58a2c8e1.js
pay.gy####.com/h5/zhtc/static/js/CarWashServe~ConfirmOrder~LeavePayment~...
pay.gy####.com/h5/zhtc/static/js/ChangeFail.4be40fca.js
pay.gy####.com/h5/zhtc/static/js/ChangeMobile.df6d3134.js
pay.gy####.com/h5/zhtc/static/js/ChargeHelp.06b9668f.js
pay.gy####.com/h5/zhtc/static/js/ChargeInput.23724818.js
pay.gy####.com/h5/zhtc/static/js/ChargePrePay.009bd07c.js
pay.gy####.com/h5/zhtc/static/js/ChargeState.a169c28d.js
pay.gy####.com/h5/zhtc/static/js/ChargeTerminalDetail.b6e9a223.js
pay.gy####.com/h5/zhtc/static/js/ChargingRecord.2f80bcec.js
pay.gy####.com/h5/zhtc/static/js/Classify.469ce437.js
pay.gy####.com/h5/zhtc/static/js/ConfirmOrder.74ff2171.js
pay.gy####.com/h5/zhtc/static/js/CustomerService.bde31f53.js
pay.gy####.com/h5/zhtc/static/js/CustomerService~Feedback~Goods~LeavePay...
pay.gy####.com/h5/zhtc/static/js/CustomerService~Goods~Shop.016a76cd.js
pay.gy####.com/h5/zhtc/static/js/CustomerService~Mine~MonthCard~Order~Or...
pay.gy####.com/h5/zhtc/static/js/ElecDriverLicenseMgmt.63780722.js
pay.gy####.com/h5/zhtc/static/js/Feedback.012cbfcc.js
pay.gy####.com/h5/zhtc/static/js/GetQm.613e7549.js
pay.gy####.com/h5/zhtc/static/js/Goods.f9682b1e.js
pay.gy####.com/h5/zhtc/static/js/Goods~MyCar~Personal~Public.bee64082.js
pay.gy####.com/h5/zhtc/static/js/Goods~Shop.43966e5f.js
pay.gy####.com/h5/zhtc/static/js/Integral.ef8a035f.js
pay.gy####.com/h5/zhtc/static/js/InvoiceMgmt.d9115ea4.js
pay.gy####.com/h5/zhtc/static/js/InvoiceMgmt~Personal.36675ac1.js
pay.gy####.com/h5/zhtc/static/js/LeavePayment.11f1b100.js
pay.gy####.com/h5/zhtc/static/js/LeavePayment~OrderList.6040260e.js
pay.gy####.com/h5/zhtc/static/js/MallHome.602eb285.js
pay.gy####.com/h5/zhtc/static/js/MallHome~ParkingLot.fb9e9bbf.js
pay.gy####.com/h5/zhtc/static/js/MemberExplanation.30113b8f.js
pay.gy####.com/h5/zhtc/static/js/Mine.318e88d1.js
pay.gy####.com/h5/zhtc/static/js/MonthCard.dffb3ad2.js
pay.gy####.com/h5/zhtc/static/js/MoveCar.f4fe79b9.js
pay.gy####.com/h5/zhtc/static/js/MyCar.2b60f668.js
pay.gy####.com/h5/zhtc/static/js/MyMessage.619fb6b9.js
pay.gy####.com/h5/zhtc/static/js/News.887f9159.js
pay.gy####.com/h5/zhtc/static/js/Order.24e52ba3.js
pay.gy####.com/h5/zhtc/static/js/OrderComplaint.bc5320d9.js
pay.gy####.com/h5/zhtc/static/js/OrderList.66d13fee.js
pay.gy####.com/h5/zhtc/static/js/OrderScore.495c014d.js
pay.gy####.com/h5/zhtc/static/js/ParkingLot.3a4f9052.js
pay.gy####.com/h5/zhtc/static/js/ParkingSet.60f97b39.js
pay.gy####.com/h5/zhtc/static/js/PayError.0122190b.js
pay.gy####.com/h5/zhtc/static/js/PayResult.38142362.js
pay.gy####.com/h5/zhtc/static/js/Personal.ea561fcc.js
pay.gy####.com/h5/zhtc/static/js/ProductReview.2c123fb7.js
pay.gy####.com/h5/zhtc/static/js/Public.482f4d92.js
pay.gy####.com/h5/zhtc/static/js/RentParkingSpace.9cfd089b.js
pay.gy####.com/h5/zhtc/static/js/ReserveParking.9b22c28b.js
pay.gy####.com/h5/zhtc/static/js/ShareMgmt.a2a39561.js
pay.gy####.com/h5/zhtc/static/js/Shop.6dc2981a.js
pay.gy####.com/h5/zhtc/static/js/ShoppingCart.4ae11976.js
pay.gy####.com/h5/zhtc/static/js/UnlicensedCar.2df4af4b.js
pay.gy####.com/h5/zhtc/static/js/WechatChange.d1566c4e.js
pay.gy####.com/h5/zhtc/static/js/app.fac20b62.js
pay.gy####.com/h5/zhtc/static/js/chunk-vendors.b5b89eef.js

File system changes:

Creates the following files:

/data/data/####/.fsgkea
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/001adf73a6235199_0
/data/data/####/03475e46cf7bccc6_0
/data/data/####/044eaeb7763eb470_0
/data/data/####/0619829ef68636ee_0
/data/data/####/069ae8cebffc847d_0
/data/data/####/069ae8cebffc847d_1
/data/data/####/06c421561b002840_0
/data/data/####/0859d6b9c01c0aed_0
/data/data/####/0d10326b68e5e572_0
/data/data/####/0ddc3e1c1e1f4362_0
/data/data/####/1953512e6eb01752_0
/data/data/####/197feb81c9a11a7d_0
/data/data/####/1cd77c4057af99b1_0
/data/data/####/1d13f48131428e86_0
/data/data/####/1d7a0bea41c67acb_0
/data/data/####/1dc983409b133553_0
/data/data/####/1f28fe7b3fae957e_0
/data/data/####/2197ad19f70ff36f_0
/data/data/####/226b369f6e99ec69_0
/data/data/####/226b369f6e99ec69_1
/data/data/####/267f06470541dbf1_0
/data/data/####/267f06470541dbf1_1
/data/data/####/26b19577d9c4b6bb_0
/data/data/####/2b2175dfaef892b1_0
/data/data/####/2b2175dfaef892b1_1
/data/data/####/2e23b3132f6bd903_0
/data/data/####/3471c134d9b0a9d1_0
/data/data/####/34e37b7a18ea9f26_0
/data/data/####/3537c1004ad1af64_0
/data/data/####/3537c1004ad1af64_1
/data/data/####/38238a722876f8d7_0
/data/data/####/38a7c080c7016bd2_0
/data/data/####/3cfe0233a8e144c7_0
/data/data/####/3d57fd6e7e1c19c5_0
/data/data/####/3d8d534e4fcf024e_0
/data/data/####/3d9c49d1ac209532_0
/data/data/####/3fc93bd017212d4b_0
/data/data/####/44629ff5ca314faf_0
/data/data/####/4c4e90aa830e109b_0
/data/data/####/4f9b6c8900a719f5_0
/data/data/####/536312cdc3078baf_0
/data/data/####/54dda1964fcab4af_0
/data/data/####/555cd73a93759890_0
/data/data/####/5592d5398e4bdefc_0
/data/data/####/57349fdc222149ee_0
/data/data/####/57bc03694a3a9b36_0
/data/data/####/5946b4ca5b81c8fe_0
/data/data/####/597b409467ea6dd0_0
/data/data/####/5afa640a9ed41f1d_0
/data/data/####/5bef36ac983710a3_0
/data/data/####/5e3ee2c79e0d0753_0
/data/data/####/5e3ee2c79e0d0753_1
/data/data/####/605089b014137b33_0
/data/data/####/6295b84a01f5b4bc_0
/data/data/####/62c095172d3f9376_0
/data/data/####/64467ccb47d87f1c_0
/data/data/####/65d4d4d040ecb732_0
/data/data/####/6b1f2a0f34fad859_0
/data/data/####/704564585f6b2a6d_0
/data/data/####/704a23915141fcce_0
/data/data/####/73fbe69db6928e0f_0
/data/data/####/7628b682fef7f64f_0
/data/data/####/7628b682fef7f64f_1
/data/data/####/7697cced11021624_0
/data/data/####/78b332e1ee06dde0_0
/data/data/####/78e6f265c7767ed8_0
/data/data/####/7a57b8571ab9dac7_0
/data/data/####/7ae7003b4d0355ad_0
/data/data/####/7b0aade675a27bf2_0
/data/data/####/80cb09748ee8f527_0
/data/data/####/82cd5f4c1a4f5d9f_0
/data/data/####/8435cafbf4939e8a_0
/data/data/####/84ad23226ecba9f6_0
/data/data/####/8620a23ae9310418_0
/data/data/####/869f5670c915ebdc_0
/data/data/####/869f5670c915ebdc_1
/data/data/####/8717583eabcf8538_0
/data/data/####/917fc654bdbb8ac8_0
/data/data/####/92fbecccb4650a82_0
/data/data/####/93c01569f171198e_0
/data/data/####/9482457829d0e5a3_0
/data/data/####/95263158a2bee561_0
/data/data/####/964496787396b9af_0
/data/data/####/96685ffab01f55db_0
/data/data/####/9867f474db101096_0
/data/data/####/993253fcab2810d5_0
/data/data/####/993253fcab2810d5_1
/data/data/####/9b4dc404d765aafc_0
/data/data/####/9bc7cbdeaeb9fc91_0
/data/data/####/9c2fc8c9d34227bf_0
/data/data/####/9fdb609b10526bad_0
/data/data/####/Cookies-journal
/data/data/####/TB_APP_CONFIG.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a0907dcf592990ef_0
/data/data/####/a1a41ae7f544b15d_0
/data/data/####/a2a2203da7e1ba78_0
/data/data/####/a2b81d1799d8bec2_0
/data/data/####/a2c6d1e36f0c1ffa_0 (deleted)
/data/data/####/a2d2a27b5c7b37e1_0
/data/data/####/a4be8d44e8906a69_0
/data/data/####/a81fde75fe9d83c5_0
/data/data/####/a81fde75fe9d83c5_1
/data/data/####/a941d562359652b5_0
/data/data/####/ac432ba9eaced3bb_0
/data/data/####/b14893d3fb9b34df_0
/data/data/####/b21ad104060e7ba1_0
/data/data/####/b3a026171f815456_0
/data/data/####/b3a6e09dd6c7ce4d_0
/data/data/####/b3b1a564d21e3d5e_0
/data/data/####/b6586ed3f0de097d_0
/data/data/####/b8c1e452be674f2f_0
/data/data/####/ba148a7c11167339_0
/data/data/####/ba73c915eae7bc82_0
/data/data/####/baab2bc1d7e4232f_0
/data/data/####/bb85b9fdd2fb996d_0
/data/data/####/bf3ea1d913e8223c_0
/data/data/####/c9dd8668ba54802d_0
/data/data/####/c9e2dfaf5f9ed933_0
/data/data/####/ca9c51bde2538458_0
/data/data/####/cb3754f237ed1c21_0
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/com.reformer.cityparking.guiyang_preferences.xml
/data/data/####/d1737bd8979d913b_0
/data/data/####/d2050f1cce90256c_0
/data/data/####/d2904619e3875d25_0
/data/data/####/d2fc50a9f8a479e0_0
/data/data/####/d2fc50a9f8a479e0_1
/data/data/####/d3f1e6dbe80fedc8_0
/data/data/####/d85b9ef3e2cd2c25_0
/data/data/####/db5f6655939b1936_0
/data/data/####/e0d3fbf622a8b931_0
/data/data/####/e24fd6f69e5cdd30_0
/data/data/####/ea309b3326f7a67b_0
/data/data/####/edeca8584c106b09_0 (deleted)
/data/data/####/ee2460ecacece438_0
/data/data/####/ee38c9be9001f861_0
/data/data/####/f28a9ba111bb0911_0
/data/data/####/f51e30ecafe5fdc9_0
/data/data/####/f5d9f202b6e5dce1_0
/data/data/####/f6846567390e6f72_0
/data/data/####/f7b591521f3bf3bc_0
/data/data/####/f7d91d64e29222cb_0
/data/data/####/f7d9dcb98ca8423b_0
/data/data/####/f7d9dcb98ca8423b_1
/data/data/####/f8711380264c2d98_0
/data/data/####/fa55be2e5cd5fc5a_0
/data/data/####/fbbb1d373e0d3e89_0
/data/data/####/http_pay.gyzhtc.com_0.localstorage-journal
/data/data/####/index
/data/data/####/metrics_guid
/data/data/####/temp-index
/data/data/####/the-real-index
/data/misc/####/primary.prof

Miscellaneous:

Loads the following dynamic libraries:

libjiagu_x86

Uses special library to hide executable bytecode.

Gets information about network.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial