Adware.Gexin.9000

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) n####.ai####.com:80
TCP(TLS/1.0) c1.sk####.com:443
TCP(TLS/1.0) westla####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) 1####.217.19.206:443
TCP(TLS/1.0) b####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) i####.cailian####.com:443

DNS requests:

b####.oss-cn-####.aliy####.com
c1.sk####.com
i####.cailian####.com
log.u####.com
n####.ai####.com
s####.u####.com
westla####.oss-cn-####.aliy####.com

HTTP GET requests:

n####.ai####.com/api/news-info/discuss/opinion/1098966564849745921
n####.ai####.com/api/news-info/info/information.do?status=####&time=####
n####.ai####.com/api/news-info/news/channel/推荐/1098966564849745921
n####.ai####.com/api/news-info/news/channels
n####.ai####.com/api/news-info/news/detail/1098966564849745921
n####.ai####.com/api/news-info/news/推荐/list?page=####&size=####
n####.ai####.com/api/news-quota/quota/list?exchangeCode=####
n####.ai####.com/api/news-quota/variety/list?page=####&exchangeCode=####...
n####.ai####.com/api/news-user/author/list/concern.do
n####.ai####.com/api/news-user/author/list/concern/bitcoin.do?page=####&...
n####.ai####.com/api/news-user/author/list/recommend.do
n####.ai####.com/api/news-user/banner/findBannerList.do
n####.ai####.com/api/news-user/dictionary/json.do?type=####
n####.ai####.com/api/news-user/sweet/page.do?page=####&size=####
n####.ai####.com/api/news-user/user/show.do

HTTP POST requests:

n####.ai####.com/api/news-user/redPacket/status.do

File system changes:

Creates the following files:

/data/data/####/-1032697235-1171399606
/data/data/####/-1291164273483802150
/data/data/####/-1657399838399257465
/data/data/####/-1833422317-193078765
/data/data/####/-1833422572307972509
/data/data/####/-1873962642931245287
/data/data/####/-65442107318612046
/data/data/####/-9824970592044352608
/data/data/####/-982497059323164826
/data/data/####/.jg.ic
/data/data/####/030d2c0673f7bb67e66498d3e5221080c41ea8236702bb0....0.tmp
/data/data/####/06e8868c7b52761ba13f2c9823e47010a9da07063424402....0.tmp
/data/data/####/1056229189492633471
/data/data/####/1089755895-62565654
/data/data/####/11442121251916828710
/data/data/####/1187783334411286093
/data/data/####/1193461475-2035264519
/data/data/####/1419545227-1802264840
/data/data/####/1511378590-1233644487
/data/data/####/1511378590-805432672
/data/data/####/15113785901736175565
/data/data/####/15113785902066605637
/data/data/####/1511378590829527105
/data/data/####/1550859811033.log
/data/data/####/1602126931212885812
/data/data/####/160212693733580189
/data/data/####/1765939320-2146379237
/data/data/####/2101657043-1159710293
/data/data/####/2101657043-1256378688
/data/data/####/2101657043-1261116355
/data/data/####/2101657043-1447511119
/data/data/####/2101657043-581240218
/data/data/####/2101657043-59638127
/data/data/####/2101657043-800839807
/data/data/####/2101657043-932768711
/data/data/####/21016570431113472610
/data/data/####/21016570431255670719
/data/data/####/2101657043133469362
/data/data/####/21016570431342853931
/data/data/####/21016570431821982180
/data/data/####/21016570432099289061
/data/data/####/21016570437824735
/data/data/####/244a4d2be39887d917fdeb01c926288f68d9112148861af....0.tmp
/data/data/####/274cce1f3d58b6759c1129e86aede17e6cd24565a7b4a6c....0.tmp
/data/data/####/28baf3a07dea0a6c127b3fdfae31e8d6a68cf02cb6f005d....0.tmp
/data/data/####/29aacf68757da7373cda6211da4025f6ad79ceebe0a8a53....0.tmp
/data/data/####/337393135-1023361120
/data/data/####/453c2371aaa530f03a998aa60c1c2cc3fef0e106a900e2e....0.tmp
/data/data/####/5154f22a7d6d03abb337b566e946a633ff64a5b7e01a85a....0.tmp
/data/data/####/6bae568b7201e6725f67cf2b70c392fd595c6a0ec22936d....0.tmp
/data/data/####/6ee76b28337e0f02f599d6de241cc7f9203d1c05da3e1e0....0.tmp
/data/data/####/75ffd6319b7b3dc2f90dfead6f2c6abcd91cf45a7ef82b2....0.tmp
/data/data/####/92bc244abe38cfee553e96a5b71c8853e16b06b552b688b....0.tmp
/data/data/####/93b248d8be5c0982de3a92248493e604bc74ba1fd9c9f7e....0.tmp
/data/data/####/a6de5ad535bd03dfef059a49ad0ff48435bd37bc8bba41b....0.tmp
/data/data/####/ae070a4e8920e340000266b852ca44d7d011971874c900b....0.tmp
/data/data/####/b22cdd9b7a35ed8c66e427bc0ba17ae2d468a56dd153251....0.tmp
/data/data/####/b61abf584ff8e08f3d47499591f744f7668fa869050300b....0.tmp
/data/data/####/b751741c3cf9a6562be4237a462c2311e91223325825753....0.tmp
/data/data/####/b9f548e789a5258f0b92a9d3f3ac27f73ae17f2bece12b8....0.tmp
/data/data/####/bccd539dc068737bbcf563553f8fedfd4622705901922b2....0.tmp
/data/data/####/c1983af6d0d4596450ed757c5303fba77866780f37ac908....0.tmp
/data/data/####/c635fe743e9205e5531a8ce05955b3a4838fba31e299536....0.tmp
/data/data/####/cea6211d896627ed04ecce37294283c943c57fda072e15f....0.tmp
/data/data/####/coinsearchQ360_prefs.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dc6801d073c6af0861f3661a13beed1b9430b1178fbe12a....0.tmp
/data/data/####/efcefc2d4a8d2e36735899b467a5ce0bbcbd15279c9af58....0.tmp
/data/data/####/f559d2b872fdc6dfba0ed6ca1019e55ebee4928f705f5fe....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/getui_sp.xml
/data/data/####/index
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu-2111366467.so
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_socialize.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu-2111366467.so

Loads the following dynamic libraries:

getuiext2
libjiagu-2111366467

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial