Adware.Gexin.11480

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) qa.sno####.com:80
TCP(HTTP/1.1) s11.mog####.com.####.com:80
TCP(HTTP/1.1) www.mog####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) api.mog####.com:80
TCP(TLS/1.0) s11.mog####.com.####.com:443
TCP(TLS/1.0) api.mog####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5225

DNS requests:

a####.u####.com
api.mog####.com
c####.g####.ig####.com
c-h####.g####.com
log.jua####.com
qa.sno####.com
s11.mog####.com
s3.mog####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

qa.sno####.com/answer/detail?sign=####&cur_version=####&did_new=####&dev...
qa.sno####.com/comment/answer/listWithAt?sign=####&cur_version=####&did_...
qa.sno####.com/discover/answer/listChannelTop?sign=####&cur_version=####...
qa.sno####.com/discover/banner?sign=####&cur_version=####&did_new=####&d...
qa.sno####.com/feed/v2/homeFeed?sign=####&cur_version=####&did_new=####&...
qa.sno####.com/php/mission/recommend?sign=####&cur_version=####&did_new=...
qa.sno####.com/public/homepage/banner?sign=####&cur_version=####&did_new...
qa.sno####.com/public/profile/v2/state?sign=####&cur_version=####&did_ne...
qa.sno####.com/public/userNotice/v1/tip?sign=####&cur_version=####&did_n...
qa.sno####.com/publicPhoneToken/save?sign=####&cur_version=####&phoneTok...
qa.sno####.com/question/detail?sign=####&cur_version=####&did_new=####&q...
qa.sno####.com/system/info?sign=####&cur_version=####&did_new=####&devic...
qa.sno####.com/system/sourceInit?sign=####&cur_version=####&did_new=####...
s11.mog####.com.####.com/mlcdn/33449f/180117_3li4647kcfl3e12gdld97390090...
s11.mog####.com.####.com/mlcdn/33449f/180117_60bgiik4cl732b235fki2deg41i...
s11.mog####.com.####.com/mlcdn/33449f/180315_4hc1i3hf31kjjb3cia1bif6475i...
s11.mog####.com.####.com/mlcdn/33449f/180316_0gld1h1a3ki0h3ecl3ce1i4cjj9...
s11.mog####.com.####.com/mlcdn/33449f/180425_8cgc32g7k302la4j4ji0491h43g...
s11.mog####.com.####.com/mlcdn/33449f/180613_86401c12a58kli23k9ib3447870...
s11.mog####.com.####.com/mlcdn/33449f/180614_2b5ijha51bjedd8e6e4flkdd48j...
s11.mog####.com.####.com/mlcdn/33449f/180615_8a1ea5jff965fbf7he1j79dl67l...
s11.mog####.com.####.com/mlcdn/33449f/180801_3869cb45c111i5134kg7jb5i0ke...
s11.mog####.com.####.com/mlcdn/33449f/180801_4keb2d8alcb2dl7ka70a0bf11f6...
s11.mog####.com.####.com/mlcdn/33449f/180801_5gd7bkj4k9f0fg53ebj6e1f9l51...
s11.mog####.com.####.com/mlcdn/33449f/180801_6efh99675lff673cibdjc5l8lb2...
s11.mog####.com.####.com/mlcdn/33449f/180801_7l8hh93jg49l875aa3g0dbbdah9...
s11.mog####.com.####.com/mlcdn/33449f/181023_280k2d3a7j33c6kk9c9c98efjeb...
s11.mog####.com.####.com/mlcdn/33449f/181028_50fdk5j5kh87l38353dl0g963l6...
s11.mog####.com.####.com/mlcdn/33449f/190306_2l9jdcfddfgla0gbflkb8afbd0h...
s11.mog####.com.####.com/mlcdn/33449f/190306_3f379lb0eak5b0kg5h6g07bii0k...
s11.mog####.com.####.com/mlcdn/33449f/190315_2c176kj705212bk2ke6ii01djj9...
s11.mog####.com.####.com/mlcdn/33449f/190317_1gd0id97k3c3416755ehhl8f611...
s11.mog####.com.####.com/mlcdn/33449f/190327_70kk2ajlach1edhahlli6dc49le...
s11.mog####.com.####.com/mlcdn/33449f/190401_6c5l9f5def0jjb5f9cdibf09ja8...
s11.mog####.com.####.com/mlcdn/33449f/190402_4ddca07djc5g6c8j47ce8l9e433...
s11.mog####.com.####.com/mlcdn/61d7e1/image_20190116152253_48491.jpeg_75...
s11.mog####.com.####.com/mlcdn/61d7e1/image_20190116152449_60335.jpeg_75...
s11.mog####.com.####.com/mlcdn/61d7e1/image_20190116152544_92619.jpeg_75...
s11.mog####.com.####.com/mlcdn/61d7e1/image_20190116152637_19231.jpeg_75...
s11.mog####.com.####.com/mlcdn/61d7e1/image_20190116152917_92831.jpeg_75...
s11.mog####.com.####.com/mlcdn/c45406/170823_19a68110i05aj473i5eck4ae0d1...
s11.mog####.com.####.com/p1/160525/upload_ie4ggzjrgu2gkzlchazdambqgiyde_...
s11.mog####.com.####.com/p1/160714/upload_ifrgemdbga2tozlchezdambqmeyde_...
s11.mog####.com.####.com/p2/161030/upload_38cb388k00i9f17a8e69847ib8f8a_...
s11.mog####.com.####.com/p2/161115/upload_2gb46a17jh45b9add9i99e82k0i4f_...
s11.mog####.com.####.com/p2/161230/upload_666k31d725ab8k281e9e55hi6i9ll_...
s11.mog####.com.####.com/p2/170607/upload_4f81da6365iga9eej9i7cd4bed71c_...
s11.mog####.com.####.com/p2/170623/upload_46igj34f884003l4bkh7080j0171h_...
s11.mog####.com.####.com/p2/170626/upload_1ekd14akk880d8adeckgkhh738c1j_...
s11.mog####.com.####.com/p2/170702/upload_5g4di06hkfich1c788h00jbje8143_...
s11.mog####.com.####.com/p2/171108/upload_5d83ekidg78e6abbcb25i91ckk1c6_...
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

a####.u####.com/app_logs
api.mog####.com/gw/mwp.HoustonCore.getConfig/1/?rnd=####
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
www.mog####.com/log.php

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0b06fbffbf236b0f9a517092d1ed9da1.0.tmp
/data/data/####/0b06fbffbf236b0f9a517092d1ed9da1.1.tmp
/data/data/####/0c120b061043fc285210614fe42f155c.0.tmp
/data/data/####/0c120b061043fc285210614fe42f155c.1.tmp
/data/data/####/0cdf38d74abac28e248b5571ecb2ee40.0.tmp
/data/data/####/0cdf38d74abac28e248b5571ecb2ee40.1.tmp
/data/data/####/0dfaffa227b1a2478f7d7f457cbc1da2.0.tmp
/data/data/####/0dfaffa227b1a2478f7d7f457cbc1da2.1.tmp
/data/data/####/0fef0dad61372288fbd0d4878dbf74f6.0.tmp
/data/data/####/0fef0dad61372288fbd0d4878dbf74f6.1.tmp
/data/data/####/12ab887ecac82b87e8dc4aea098f0699.0.tmp
/data/data/####/12ab887ecac82b87e8dc4aea098f0699.1.tmp
/data/data/####/133ece4dc0371513b0a9203a9a1fca01.0.tmp
/data/data/####/133ece4dc0371513b0a9203a9a1fca01.1.tmp
/data/data/####/21172b3ceb1ddd762ba332ed1457b955.0.tmp
/data/data/####/21172b3ceb1ddd762ba332ed1457b955.1.tmp
/data/data/####/25474fabd02faacd4a53fb1f84385376.0.tmp
/data/data/####/25474fabd02faacd4a53fb1f84385376.1.tmp
/data/data/####/33bf1eccde4c72da5e78ddd35a10e478.0.tmp
/data/data/####/33bf1eccde4c72da5e78ddd35a10e478.1.tmp
/data/data/####/348087b08cc44e28e404553b81b31274.0.tmp
/data/data/####/348087b08cc44e28e404553b81b31274.1.tmp
/data/data/####/366ecd1aed869183c11eb075a70cd9b2.0.tmp
/data/data/####/366ecd1aed869183c11eb075a70cd9b2.1.tmp
/data/data/####/3988fcabe9406e79d23021a727e073e6.0.tmp
/data/data/####/3988fcabe9406e79d23021a727e073e6.1.tmp
/data/data/####/441d78249f829da68360a21fb81546bf.0.tmp
/data/data/####/441d78249f829da68360a21fb81546bf.1.tmp
/data/data/####/44a3a5486be1e1227833bb7c08837fb7.0.tmp
/data/data/####/44a3a5486be1e1227833bb7c08837fb7.1.tmp
/data/data/####/47e2576a888be14799173f9f7793e520.0.tmp
/data/data/####/47e2576a888be14799173f9f7793e520.1.tmp
/data/data/####/51b91798c83c7e3682bf1136faf9cddb.0.tmp
/data/data/####/51b91798c83c7e3682bf1136faf9cddb.1.tmp
/data/data/####/52d42d141ecb06dd1c1fd7a362f93980.0.tmp
/data/data/####/52d42d141ecb06dd1c1fd7a362f93980.1.tmp
/data/data/####/56c7f1bbb62519b8dfa2847c73ee6d5e.0.tmp
/data/data/####/56c7f1bbb62519b8dfa2847c73ee6d5e.1.tmp
/data/data/####/5844609a07f8228f1b0ce2f2cf091a22.0.tmp
/data/data/####/5844609a07f8228f1b0ce2f2cf091a22.1.tmp
/data/data/####/5f5f90d18dd9cf1038628a0e490949bc.0.tmp
/data/data/####/5f5f90d18dd9cf1038628a0e490949bc.1.tmp
/data/data/####/6c96d95228cfa125106877dd44714256.0.tmp
/data/data/####/6c96d95228cfa125106877dd44714256.1.tmp
/data/data/####/6ffc5a9f8922b86e157d1bb552fa1a0b.0.tmp
/data/data/####/6ffc5a9f8922b86e157d1bb552fa1a0b.1.tmp
/data/data/####/766e6cb85866e0b6fbcabd33672e1d42.0.tmp
/data/data/####/766e6cb85866e0b6fbcabd33672e1d42.1.tmp
/data/data/####/77c929bc7320225848dd6bc15056789f.0.tmp
/data/data/####/77c929bc7320225848dd6bc15056789f.1.tmp
/data/data/####/781be77986f3c20b304c63a4b5d4c368.0.tmp
/data/data/####/781be77986f3c20b304c63a4b5d4c368.1.tmp
/data/data/####/7ef73395151579010717f025da7871d3.0.tmp
/data/data/####/7ef73395151579010717f025da7871d3.1.tmp
/data/data/####/82c20576af5de3dbe8bfcfee5fb23ea0.0.tmp
/data/data/####/82c20576af5de3dbe8bfcfee5fb23ea0.1.tmp
/data/data/####/843d3cae26a7560579046dd8e21a9dae.0.tmp
/data/data/####/843d3cae26a7560579046dd8e21a9dae.1.tmp
/data/data/####/87ea609708e852af5edc4b338394ac10.0.tmp
/data/data/####/87ea609708e852af5edc4b338394ac10.1.tmp
/data/data/####/8931378399337b810f5657a39b3443d1.0.tmp
/data/data/####/8931378399337b810f5657a39b3443d1.1.tmp
/data/data/####/8df2efda568d3e09bf8dcaa6c37a01e6.0.tmp
/data/data/####/8df2efda568d3e09bf8dcaa6c37a01e6.1.tmp
/data/data/####/9268d814467c07526ac66e7497f5f4c7.0.tmp
/data/data/####/9268d814467c07526ac66e7497f5f4c7.1.tmp
/data/data/####/9e76d98b7961877e7e1ad149450a2358.0.tmp
/data/data/####/9e76d98b7961877e7e1ad149450a2358.1.tmp
/data/data/####/9f2a7441cbccafa08c103ea277219a44.0.tmp
/data/data/####/9f2a7441cbccafa08c103ea277219a44.1.tmp
/data/data/####/AllConfigPreference.xml
/data/data/####/OtherPreference.xml
/data/data/####/a2276d8a39be6399b2b27805f246e402.0.tmp
/data/data/####/a2276d8a39be6399b2b27805f246e402.1.tmp
/data/data/####/aa700ff87769a6478a177cc34352b6c7.0.tmp
/data/data/####/aa700ff87769a6478a177cc34352b6c7.1.tmp
/data/data/####/ae01c61341429aa22114226554a48f55.0.tmp
/data/data/####/ae01c61341429aa22114226554a48f55.1.tmp
/data/data/####/am_apk_check.xml
/data/data/####/app_preference.xml
/data/data/####/app_preference.xml (deleted)
/data/data/####/app_safe_mode.xml
/data/data/####/bcefbc4e9821511f7a064465fb782363.0.tmp
/data/data/####/bcefbc4e9821511f7a064465fb782363.1.tmp
/data/data/####/bf866972a8fbc4b9f0715f8403043a82.0.tmp
/data/data/####/bf866972a8fbc4b9f0715f8403043a82.1.tmp
/data/data/####/break.dex
/data/data/####/c308b875f1b5d2c13a55b44b21e158fa.0.tmp
/data/data/####/c308b875f1b5d2c13a55b44b21e158fa.1.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.exdaxce.snobmass.xml
/data/data/####/com.exdaxce.snobmass_preferences.xml
/data/data/####/d09c61c3ae76caca37c4b09a2717b263.0.tmp
/data/data/####/d09c61c3ae76caca37c4b09a2717b263.1.tmp
/data/data/####/d34ac124a5d96e8d6abd4543e738832c.0.tmp
/data/data/####/d34ac124a5d96e8d6abd4543e738832c.1.tmp
/data/data/####/device_file
/data/data/####/dfdb2cd194df3efd4e6d21ead5ef47e4.0.tmp
/data/data/####/dfdb2cd194df3efd4e6d21ead5ef47e4.1.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f92c8edca1e19f3584284a7eb0758772.0.tmp
/data/data/####/f92c8edca1e19f3584284a7eb0758772.1.tmp
/data/data/####/fd3510c6e9fa1b82fe87f216f0585dfe.0.tmp
/data/data/####/fd3510c6e9fa1b82fe87f216f0585dfe.1.tmp
/data/data/####/ffce0344ae6c586efe2df04906a43ed5.0.tmp
/data/data/####/ffce0344ae6c586efe2df04906a43ed5.1.tmp
/data/data/####/getui_sp.xml
/data/data/####/hotpatch_sp.xml
/data/data/####/ids_browse.db
/data/data/####/ids_browse.db-journal
/data/data/####/ids_enhanced_storage.xml
/data/data/####/ids_user.db
/data/data/####/ids_user.db-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu.so
/data/data/####/multidex.version.xml
/data/data/####/mwp_preferences.xml
/data/data/####/net_mg_track_log_1554220530407
/data/data/####/net_mg_track_log_1554220531968
/data/data/####/net_mg_track_log_1554220532592
/data/data/####/net_mg_track_log_1554220536062
/data/data/####/net_mg_track_log_1554220550662
/data/data/####/net_mg_track_log_1554220553443
/data/data/####/net_mg_track_log_1554220555272
/data/data/####/net_mg_track_log_1554220564589
/data/data/####/net_mg_track_log_1554220586412
/data/data/####/normal_mg_track_log_1554220528992
/data/data/####/normal_mg_track_log_1554220529032
/data/data/####/normal_mg_track_log_1554220531889
/data/data/####/normal_mg_track_log_1554220532579
/data/data/####/normal_mg_track_log_1554220534363
/data/data/####/normal_mg_track_log_1554220549883
/data/data/####/normal_mg_track_log_1554220563825
/data/data/####/normal_mg_track_log_1554220568467
/data/data/####/normal_mg_track_log_1554220585148
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/testPluginDexCate_1.0.0.dex
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/media/####/app.db
/data/media/####/com.exdaxce.snobmass.bin
/data/media/####/com.exdaxce.snobmass.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/ids_did2
/data/media/####/old_611_did

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
ls -l /system/bin/su

Loads the following dynamic libraries:

bitmaps
checksum
common_security
dctd
getuiext2
gifimage
libjiagu
memchunk
params
token

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial