Adware.Gexin.19192

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) 1####.199.113.167:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5225

DNS requests:

c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.ig####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

cdn-sdk####.g####.com.####.com/tdata_CoH340
cdn-sdk####.g####.com.####.com/tdata_EDB102
cdn-sdk####.g####.com.####.com/tdata_JmH262
cdn-sdk####.g####.com.####.com/tdata_pKX830
q####.c####.l####.####.com/config/hz-hzv6.conf
sdk.o####.p####.####.com/api/addr.htm

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/H5CD14349.xml
/data/data/####/clientid_igexin.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/e9d136871a07
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/pdr.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/tdata_CoH340
/data/data/####/tdata_CoH340.jar
/data/data/####/tdata_JmH262
/data/data/####/tdata_JmH262.jar
/data/data/####/tdata_pKX830
/data/data/####/tdata_pKX830.jar
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/20170412140308.png
/data/media/####/78-EUC-H.bcmap
/data/media/####/78-EUC-V.bcmap
/data/media/####/78-H.bcmap
/data/media/####/78-RKSJ-H.bcmap
/data/media/####/78-RKSJ-V.bcmap
/data/media/####/78-V.bcmap
/data/media/####/78ms-RKSJ-H.bcmap
/data/media/####/78ms-RKSJ-V.bcmap
/data/media/####/83pv-RKSJ-H.bcmap
/data/media/####/90ms-RKSJ-H.bcmap
/data/media/####/90ms-RKSJ-V.bcmap
/data/media/####/90msp-RKSJ-H.bcmap
/data/media/####/90msp-RKSJ-V.bcmap
/data/media/####/90pv-RKSJ-H.bcmap
/data/media/####/90pv-RKSJ-V.bcmap
/data/media/####/Add-H.bcmap
/data/media/####/Add-RKSJ-H.bcmap
/data/media/####/Add-RKSJ-V.bcmap
/data/media/####/Add-V.bcmap
/data/media/####/Adobe-CNS1-0.bcmap
/data/media/####/Adobe-CNS1-1.bcmap
/data/media/####/Adobe-CNS1-2.bcmap
/data/media/####/Adobe-CNS1-3.bcmap
/data/media/####/Adobe-CNS1-4.bcmap
/data/media/####/Adobe-CNS1-5.bcmap
/data/media/####/Adobe-CNS1-6.bcmap
/data/media/####/Adobe-CNS1-UCS2.bcmap
/data/media/####/Adobe-GB1-0.bcmap
/data/media/####/Adobe-GB1-1.bcmap
/data/media/####/Adobe-GB1-2.bcmap
/data/media/####/Adobe-GB1-3.bcmap
/data/media/####/Adobe-GB1-4.bcmap
/data/media/####/Adobe-GB1-5.bcmap
/data/media/####/Adobe-GB1-UCS2.bcmap
/data/media/####/Adobe-Japan1-0.bcmap
/data/media/####/Adobe-Japan1-1.bcmap
/data/media/####/Adobe-Japan1-2.bcmap
/data/media/####/Adobe-Japan1-3.bcmap
/data/media/####/Adobe-Japan1-4.bcmap
/data/media/####/Adobe-Japan1-5.bcmap
/data/media/####/Adobe-Japan1-6.bcmap
/data/media/####/Adobe-Japan1-UCS2.bcmap
/data/media/####/Adobe-Korea1-0.bcmap
/data/media/####/Adobe-Korea1-1.bcmap
/data/media/####/Adobe-Korea1-2.bcmap
/data/media/####/Adobe-Korea1-UCS2.bcmap
/data/media/####/Approval.html
/data/media/####/B5-H.bcmap
/data/media/####/B5-V.bcmap
/data/media/####/B5pc-H.bcmap
/data/media/####/B5pc-V.bcmap
/data/media/####/CNS-EUC-H.bcmap
/data/media/####/CNS-EUC-V.bcmap
/data/media/####/CNS1-H.bcmap
/data/media/####/CNS1-V.bcmap
/data/media/####/CNS2-H.bcmap
/data/media/####/CNS2-V.bcmap
/data/media/####/ETHK-B5-H.bcmap
/data/media/####/ETHK-B5-V.bcmap
/data/media/####/ETen-B5-H.bcmap
/data/media/####/ETen-B5-V.bcmap
/data/media/####/ETenms-B5-H.bcmap
/data/media/####/ETenms-B5-V.bcmap
/data/media/####/EUC-H.bcmap
/data/media/####/EUC-V.bcmap
/data/media/####/Ext-H.bcmap
/data/media/####/Ext-RKSJ-H.bcmap
/data/media/####/Ext-RKSJ-V.bcmap
/data/media/####/Ext-V.bcmap
/data/media/####/GB-EUC-H.bcmap
/data/media/####/GB-EUC-V.bcmap
/data/media/####/GB-H.bcmap
/data/media/####/GB-V.bcmap
/data/media/####/GBK-EUC-H.bcmap
/data/media/####/GBK-EUC-V.bcmap
/data/media/####/GBK2K-H.bcmap
/data/media/####/GBK2K-V.bcmap
/data/media/####/GBKp-EUC-H.bcmap
/data/media/####/GBKp-EUC-V.bcmap
/data/media/####/GBT-EUC-H.bcmap
/data/media/####/GBT-EUC-V.bcmap
/data/media/####/GBT-H.bcmap
/data/media/####/GBT-V.bcmap
/data/media/####/GBTpc-EUC-H.bcmap
/data/media/####/GBTpc-EUC-V.bcmap
/data/media/####/GBpc-EUC-H.bcmap
/data/media/####/GBpc-EUC-V.bcmap
/data/media/####/H.bcmap
/data/media/####/HKdla-B5-H.bcmap
/data/media/####/HKdla-B5-V.bcmap
/data/media/####/HKdlb-B5-H.bcmap
/data/media/####/HKdlb-B5-V.bcmap
/data/media/####/HKgccs-B5-H.bcmap
/data/media/####/HKgccs-B5-V.bcmap
/data/media/####/HKm314-B5-H.bcmap
/data/media/####/HKm314-B5-V.bcmap
/data/media/####/HKm471-B5-H.bcmap
/data/media/####/HKm471-B5-V.bcmap
/data/media/####/HKscs-B5-H.bcmap
/data/media/####/HKscs-B5-V.bcmap
/data/media/####/Hankaku.bcmap
/data/media/####/Hiragana.bcmap
/data/media/####/KSC-EUC-H.bcmap
/data/media/####/KSC-EUC-V.bcmap
/data/media/####/KSC-H.bcmap
/data/media/####/KSC-Johab-H.bcmap
/data/media/####/KSC-Johab-V.bcmap
/data/media/####/KSC-V.bcmap
/data/media/####/KSCms-UHC-H.bcmap
/data/media/####/KSCms-UHC-HW-H.bcmap
/data/media/####/KSCms-UHC-HW-V.bcmap
/data/media/####/KSCms-UHC-V.bcmap
/data/media/####/KSCpc-EUC-H.bcmap
/data/media/####/KSCpc-EUC-V.bcmap
/data/media/####/Katakana.bcmap
/data/media/####/LICENSE
/data/media/####/LISTpdf.html
/data/media/####/Login_Password_Icon@3x.png
/data/media/####/Login_Username_Icon@3x.png
/data/media/####/NWP-H.bcmap
/data/media/####/NWP-V.bcmap
/data/media/####/Number@2x.png
/data/media/####/PURAMTpdf.html
/data/media/####/PersonalCenter_Logout_icon@3x.png
/data/media/####/PersonalCenter_Username_icon@3x.png
/data/media/####/PersonalCenter_approval_icon_pre@3x.png
/data/media/####/PurPreRecAmt.html
/data/media/####/RKSJ-H.bcmap
/data/media/####/RKSJ-V.bcmap
/data/media/####/Roman.bcmap
/data/media/####/SalesARAmt.html
/data/media/####/SalesPrePayAmt.html
/data/media/####/SalesReceivableAmt.html
/data/media/####/TBS.html
/data/media/####/TPLA.html
/data/media/####/TPLApdf.html
/data/media/####/ThreeFinancialStatements_Liabilities@3x.png
/data/media/####/ThreeFinancialStatements_carsh@3x.png
/data/media/####/ThreeFinancialStatements_gains@3x.png
/data/media/####/UniCNS-UCS2-H.bcmap
/data/media/####/UniCNS-UCS2-V.bcmap
/data/media/####/UniCNS-UTF16-H.bcmap
/data/media/####/UniCNS-UTF16-V.bcmap
/data/media/####/UniCNS-UTF32-H.bcmap
/data/media/####/UniCNS-UTF32-V.bcmap
/data/media/####/UniCNS-UTF8-H.bcmap
/data/media/####/UniCNS-UTF8-V.bcmap
/data/media/####/UniGB-UCS2-H.bcmap
/data/media/####/UniGB-UCS2-V.bcmap
/data/media/####/UniGB-UTF16-H.bcmap
/data/media/####/UniGB-UTF16-V.bcmap
/data/media/####/UniGB-UTF32-H.bcmap
/data/media/####/UniGB-UTF32-V.bcmap
/data/media/####/UniGB-UTF8-H.bcmap
/data/media/####/UniGB-UTF8-V.bcmap
/data/media/####/UniJIS-UCS2-H.bcmap
/data/media/####/UniJIS-UCS2-HW-H.bcmap
/data/media/####/UniJIS-UCS2-HW-V.bcmap
/data/media/####/UniJIS-UCS2-V.bcmap
/data/media/####/UniJIS-UTF16-H.bcmap
/data/media/####/UniJIS-UTF16-V.bcmap
/data/media/####/UniJIS-UTF32-H.bcmap
/data/media/####/UniJIS-UTF32-V.bcmap
/data/media/####/UniJIS-UTF8-H.bcmap
/data/media/####/UniJIS-UTF8-V.bcmap
/data/media/####/UniJIS2004-UTF16-H.bcmap
/data/media/####/UniJIS2004-UTF16-V.bcmap
/data/media/####/UniJIS2004-UTF32-H.bcmap
/data/media/####/UniJIS2004-UTF32-V.bcmap
/data/media/####/UniJIS2004-UTF8-H.bcmap
/data/media/####/UniJIS2004-UTF8-V.bcmap
/data/media/####/UniJISPro-UCS2-HW-V.bcmap
/data/media/####/UniJISPro-UCS2-V.bcmap
/data/media/####/UniJISPro-UTF8-V.bcmap
/data/media/####/UniJISX0213-UTF32-H.bcmap
/data/media/####/UniJISX0213-UTF32-V.bcmap
/data/media/####/UniJISX02132004-UTF32-H.bcmap
/data/media/####/UniJISX02132004-UTF32-V.bcmap
/data/media/####/UniKS-UCS2-H.bcmap
/data/media/####/UniKS-UCS2-V.bcmap
/data/media/####/UniKS-UTF16-H.bcmap
/data/media/####/UniKS-UTF16-V.bcmap
/data/media/####/UniKS-UTF32-H.bcmap
/data/media/####/UniKS-UTF32-V.bcmap
/data/media/####/UniKS-UTF8-H.bcmap
/data/media/####/UniKS-UTF8-V.bcmap
/data/media/####/V.bcmap
/data/media/####/WP-Symbol.bcmap
/data/media/####/ability_BronzeMedal@2x.png
/data/media/####/ability_BronzeMedal@3x.png
/data/media/####/ability_EnergyBar@2x.png
/data/media/####/ability_EnergyBar@3x.png
/data/media/####/ability_GoldMedals@2x.png
/data/media/####/ability_GoldMedals@3x.png
/data/media/####/ability_Personal_bj@2x.png
/data/media/####/ability_SilverMedal@2x.png
/data/media/####/ability_SilverMedal@3x.png
/data/media/####/ability_sign@2x.png
/data/media/####/ability_sign@3x.png
/data/media/####/ability_sign_blue@2x.png
/data/media/####/ability_sign_blue@3x.png
/data/media/####/ability_sign_red@2x.png
/data/media/####/ability_sign_red@3x.png
/data/media/####/ability_sign_yellow@2x.png
/data/media/####/alipay.html
/data/media/####/annotation-check.svg
/data/media/####/annotation-comment.svg
/data/media/####/annotation-help.svg
/data/media/####/annotation-insert.svg
/data/media/####/annotation-key.svg
/data/media/####/annotation-newparagraph.svg
/data/media/####/annotation-noicon.svg
/data/media/####/annotation-note.svg
/data/media/####/annotation-paragraph.svg
/data/media/####/app.db
/data/media/####/approvalParticulars.html
/data/media/####/approve_no.html
/data/media/####/bootstrap.min.css
/data/media/####/boss_logo@2x.png
/data/media/####/boss_logo@3x.png
/data/media/####/cGpassword.html
/data/media/####/city.data-2.js
/data/media/####/city.data-3.js
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/common.js
/data/media/####/compatibility.js
/data/media/####/compressed.tracemonkey-pldi-09.pdf
/data/media/####/debugger.js
/data/media/####/easemob.im-1.0.5.js
/data/media/####/echarts.simple.min (3).js
/data/media/####/file__0.localstorage-journal
/data/media/####/findbarButton-next-rtl.png
/data/media/####/findbarButton-next-rtl@2x.png
/data/media/####/findbarButton-next.png
/data/media/####/findbarButton-next@2x.png
/data/media/####/findbarButton-previous-rtl.png
/data/media/####/findbarButton-previous-rtl@2x.png
/data/media/####/findbarButton-previous.png
/data/media/####/findbarButton-previous@2x.png
/data/media/####/grab.cur
/data/media/####/grabbing.cur
/data/media/####/grid.html
/data/media/####/huakuai.css
/data/media/####/huakuai.js
/data/media/####/huakuai2.css
/data/media/####/iconfont.ttf
/data/media/####/iconfonting.ttf
/data/media/####/immersed.js
/data/media/####/index.html
/data/media/####/io.dcloud.H5CD14349.bin
/data/media/####/io.dcloud.H5CD14349.db
/data/media/####/jquery-1.11.0.js
/data/media/####/jquery-1.11.1.js
/data/media/####/jquery-2.1.0.js
/data/media/####/jquery.range.js
/data/media/####/json2.js
/data/media/####/l10n.js
/data/media/####/list.html
/data/media/####/loading-icon.gif
/data/media/####/loading-small.png
/data/media/####/loading-small@2x.png
/data/media/####/locale.properties
/data/media/####/login.html
/data/media/####/login_2.html
/data/media/####/login_bj@3x.png
/data/media/####/login_tip_content.png
/data/media/####/main_menu.html
/data/media/####/manifest.json
/data/media/####/menu_BattleIndex@2x.png
/data/media/####/menu_ThreeFinancialStatements@2x.png
/data/media/####/menu_bj@3x.png
/data/media/####/menu_sales@2x.png
/data/media/####/mui.css
/data/media/####/mui.js
/data/media/####/mui.min.css
/data/media/####/mui.min.js
/data/media/####/mui.picker.all.js
/data/media/####/mui.picker.css
/data/media/####/mui.poppicker.css
/data/media/####/mui.ttf
/data/media/####/my-id.jpg
/data/media/####/nav_screen@3x.png
/data/media/####/nav_screen_pre@2x.png
/data/media/####/nav_search@3x.png
/data/media/####/next_btn@2x.png
/data/media/####/password.html
/data/media/####/passwordjs.js
/data/media/####/pdf.js
/data/media/####/pdf.worker.js
/data/media/####/person.html
/data/media/####/puramt.html
/data/media/####/quickstart.md
/data/media/####/register_AddressBook_Icon@2x@3x.png
/data/media/####/register_Camera_icon@3x.png
/data/media/####/register_ID_icon@3x.png
/data/media/####/register_Verification_icon@3x.png
/data/media/####/register_close_icon@3x.png
/data/media/####/register_fail_Icon@3x.png
/data/media/####/register_iphone_icon@3x.png
/data/media/####/register_post_icon@3x.png
/data/media/####/register_store_icon@3x.png
/data/media/####/sale.html
/data/media/####/sales_money_more_icon@2x.png
/data/media/####/sales_money_small_more_icon@2x.png
/data/media/####/secondaryToolbarButton-documentProperties.png
/data/media/####/secondaryToolbarButton-documentProperties@2x.png
/data/media/####/secondaryToolbarButton-firstPage.png
/data/media/####/secondaryToolbarButton-firstPage@2x.png
/data/media/####/secondaryToolbarButton-handTool.png
/data/media/####/secondaryToolbarButton-handTool@2x.png
/data/media/####/secondaryToolbarButton-lastPage.png
/data/media/####/secondaryToolbarButton-lastPage@2x.png
/data/media/####/secondaryToolbarButton-rotateCcw.png
/data/media/####/secondaryToolbarButton-rotateCcw@2x.png
/data/media/####/secondaryToolbarButton-rotateCw.png
/data/media/####/secondaryToolbarButton-rotateCw@2x.png
/data/media/####/shadow.png
/data/media/####/sort_down_icons@3x.png
/data/media/####/sort_up_icons@3x.png
/data/media/####/strophe-custom-2.0.0.js
/data/media/####/subclass.html
/data/media/####/switch_left@3x.png
/data/media/####/switch_right@2x.png
/data/media/####/tdata_CoH340
/data/media/####/tdata_JmH262
/data/media/####/tdata_pKX830
/data/media/####/test.log
/data/media/####/texture.png
/data/media/####/toolbarButton-bookmark.png
/data/media/####/toolbarButton-bookmark@2x.png
/data/media/####/toolbarButton-download.png
/data/media/####/toolbarButton-download@2x.png
/data/media/####/toolbarButton-menuArrows.png
/data/media/####/toolbarButton-menuArrows@2x.png
/data/media/####/toolbarButton-openFile.png
/data/media/####/toolbarButton-openFile@2x.png
/data/media/####/toolbarButton-pageDown-rtl.png
/data/media/####/toolbarButton-pageDown-rtl@2x.png
/data/media/####/toolbarButton-pageDown.png
/data/media/####/toolbarButton-pageDown@2x.png
/data/media/####/toolbarButton-pageUp-rtl.png
/data/media/####/toolbarButton-pageUp-rtl@2x.png
/data/media/####/toolbarButton-pageUp.png
/data/media/####/toolbarButton-pageUp@2x.png
/data/media/####/toolbarButton-presentationMode.png
/data/media/####/toolbarButton-presentationMode@2x.png
/data/media/####/toolbarButton-print.png
/data/media/####/toolbarButton-print@2x.png
/data/media/####/toolbarButton-search.png
/data/media/####/toolbarButton-search@2x.png
/data/media/####/toolbarButton-secondaryToolbarToggle-rtl.png
/data/media/####/toolbarButton-secondaryToolbarToggle-rtl@2x.png
/data/media/####/toolbarButton-secondaryToolbarToggle.png
/data/media/####/toolbarButton-secondaryToolbarToggle@2x.png
/data/media/####/toolbarButton-sidebarToggle-rtl.png
/data/media/####/toolbarButton-sidebarToggle-rtl@2x.png
/data/media/####/toolbarButton-sidebarToggle.png
/data/media/####/toolbarButton-sidebarToggle@2x.png
/data/media/####/toolbarButton-viewAttachments.png
/data/media/####/toolbarButton-viewAttachments@2x.png
/data/media/####/toolbarButton-viewOutline-rtl.png
/data/media/####/toolbarButton-viewOutline-rtl@2x.png
/data/media/####/toolbarButton-viewOutline.png
/data/media/####/toolbarButton-viewOutline@2x.png
/data/media/####/toolbarButton-viewThumbnail.png
/data/media/####/toolbarButton-viewThumbnail@2x.png
/data/media/####/toolbarButton-zoomIn.png
/data/media/####/toolbarButton-zoomIn@2x.png
/data/media/####/toolbarButton-zoomOut.png
/data/media/####/toolbarButton-zoomOut@2x.png
/data/media/####/total.html
/data/media/####/total_bj@2x.png
/data/media/####/total_calendar_icon@3x.png
/data/media/####/total_choseTime_bj@2x.png
/data/media/####/total_monthly@3x.png
/data/media/####/total_pay@2x.png
/data/media/####/total_salesMoney_bj@2x.png
/data/media/####/total_time@3x.png
/data/media/####/total_trend_bj@3x.png
/data/media/####/total_trend_blue@2x.png
/data/media/####/total_trend_green@2x.png
/data/media/####/total_trend_head_bj@3x.png
/data/media/####/total_trend_yellow@2x.png
/data/media/####/total_white_bj@2x.png
/data/media/####/total_year@3x.png
/data/media/####/totallist.html
/data/media/####/viewer.css
/data/media/####/viewer.js
/data/media/####/viewer.properties

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
<Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24464 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24464 300 0

Loads the following dynamic libraries:

getuiext2
libjiagu

Uses the following algorithms to encrypt data:

AES-CFB-NoPadding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial