Adware.Gexin.22061

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) log.sn####.com.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(HTTP/1.1) adash####.man.aliy####.com:80
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) activit####.qudu####.cn:443
TCP(TLS/1.0) phonede####.google####.com:443
TCP(TLS/1.0) c####.v####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) log.sn####.com.####.com:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 2####.58.208.99:443
UDP 1####.0.17.1:137
TCP cm-10####.g####.com:5226
TCP zb-cent####.m.ta####.com:443
TCP sdk.o####.t####.####.com:5224
TCP 2####.119.218.243:80

DNS requests:

7j####.c####.z0.####.com
a####.man.aliy####.com
activit####.qudu####.cn
amdc####.m.ta####.com
and####.b####.qq.com
and####.cli####.go####.com
api.qudu####.cn
c####.v####.com
c-h####.g####.com
cdn-sdk####.g####.com
cdn.a####.com
cm-10####.g####.com
instant####.google####.com
is.sn####.com
l####.tbs.qq.com
log.sn####.com
mo####.b####.com
pag####.googles####.com
phonede####.google####.com
push-re####.qudu####.cn
qfy.innot####.com
re####.qudu####.cn
safebro####.google####.com
sdk-ope####.g####.com
sdk.c####.g####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
upd####.a####.com
www.google####.com

HTTP GET requests:

c####.v####.com:443/public/api_dkf/get_chat_siteinfo?channel=####&os=###...
cdn-sdk####.g####.com.####.com/tdata_DNL558
cdn-sdk####.g####.com.####.com/tdata_RdS556
cdn-sdk####.g####.com.####.com/tdata_hqs030
d####.c####.l####.####.com/config/hzv9.conf
log.sn####.com.####.com:443/nsdk/3.590/aisdk_4993.jar
sdk-ope####.g####.com/api/addr.htm
ti####.c####.l####.####.com/tdata_FhD658

HTTP POST requests:

adash####.man.aliy####.com/man/api?ak=####&s=####
al####.u####.com:443/unify_logs
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async?aid=####
c####.v####.com:443/public/appauth/v2
c####.v####.com:443/public/appsdk/init
c-h####.g####.com/api.php?format=####&t=####
l####.tbs.qq.com/ajax?c=####&k=####
log.sn####.com.####.com/service/2/app_log_exception/?os_api=####&device_...
log.sn####.com.####.com:443/api/ad/union/sdk/settings/
log.sn####.com.####.com:443/api/ad/union/sdk/upload/app_info/
qfy.innot####.com:443/report/v1
sdk-ope####.g####.com/api.php?format=####&t=####
upd####.a####.com:443/nsdk/cgi/

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.old_file_converted
/data/data/####/1004
/data/data/####/1640949783333
/data/data/####/1640949796639
/data/data/####/ACCS_BINDumeng;58fea91dae1bf80b85001b11.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/SP_AROUTER_CACHE.xml.bak
/data/data/####/T-3biJeW66hNPCI0W5_nsUfHCje3PlAu
/data/data/####/T-3r8pyCK645O1Xzg4nTP0Oe3OZr1nP6
/data/data/####/T-5obVyB0q3kBopYRZTBg066xudHaY8j
/data/data/####/T1VSfRwbgd2znMYv0ZbNXU4vRXRdlRBS
/data/data/####/T1_zasGtKGkv3gCdgIuJ_0L7sC89777M
/data/data/####/T2u1it0OvKboEkNQ0L2OX0-eFLErI0yq
/data/data/####/T3LyvLfk5pibK5rLabKvW0j4kFj27kps
/data/data/####/T3xjmosqwih8oNsg8oDnjErk76IPxUvy
/data/data/####/T40smWoFigaap-vMzarZp0o4CnHczvbb
/data/data/####/T4xgKYMnsyBP5WA7gp3rzUb9bCgJM9PB
/data/data/####/T5siI8hEjhExqmJCEqImSkYdxn9HgX8T
/data/data/####/T6qKa8yHuH7IMTHuV5UzBU4Cz2UGnQtD
/data/data/####/T8KayjMQkv6wH08SpI_1t0N_ecFexCus
/data/data/####/T_-A8e2XS_Nf_QWVUasRWkNFB9AxeUHs
/data/data/####/Tw1AX-G5mDWUdY3R7ruWUEwNMPJ6SxDy
/data/data/####/TwKOW_fF-FhYXeeh8bGS7kfsy5Mr9DR2
/data/data/####/TwP3f_G_2zyGcWyW7rR5RUCRl5Tzs3wH
/data/data/####/Txt9wprGOwwgqrn58rBGJ0ZmhGWzHIKE
/data/data/####/Txy-vgZgPzU9uWS8yZG3DEjKGKWYSN03
/data/data/####/TyHm_40Zwp8D0WFF7a2vu0fNC7KYLXY5
/data/data/####/TyIi0_WeanEEc7PqIZPUWkl6Wzx9AoX5
/data/data/####/TyKJgvxlWSvqE2kfhbnVYEZzPjxwqEPu
/data/data/####/Ty_Q4NXzuYwLjgkTWoJibEISPnl0IY2v
/data/data/####/Tye1ca8kE9ICpMbdZJhwdEO37NTxmozU
/data/data/####/Tzk02_bPmxDUpk4nSK6IOk1fDu9WRJVW
/data/data/####/TzkxYC2YjKW7SQJKL4E9iEcYVirAxpVo
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/_aisdk_local.dex
/data/data/####/_aisdk_local.dex.flock (deleted)
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/com.xike.yipai.xml
/data/data/####/com.xike.yipai_preferences.xml
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/crashrecord.xml (deleted)
/data/data/####/dW1weF9pbnRlcm5hbF8xNjQwOTQ5Nzk3NTQw;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNjQwOTQ5ODA0ODY1;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE2NDA5NDk3OTc1MzU=;
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/filedownloader.db-journal
/data/data/####/finch.db-journal
/data/data/####/geofencing.db
/data/data/####/geofencing.db-journal
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&5.0.1.0_1640949797561_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/metrics_guid
/data/data/####/mipush.xml
/data/data/####/mipush_extra.xml
/data/data/####/native_record_lock
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak (deleted)
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_DNL558
/data/data/####/tdata_DNL558.dex
/data/data/####/tdata_DNL558.dex.flock (deleted)
/data/data/####/tdata_DNL558.jar
/data/data/####/tdata_RdS556
/data/data/####/tdata_RdS556.dex
/data/data/####/tdata_RdS556.dex.flock (deleted)
/data/data/####/tdata_RdS556.jar
/data/data/####/tdata_hqs030
/data/data/####/tdata_hqs030.dex
/data/data/####/tdata_hqs030.dex.flock (deleted)
/data/data/####/tdata_hqs030.jar
/data/data/####/tiny_data.data
/data/data/####/tiny_data.lock
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/v5_client.db
/data/data/####/v5_client.db-journal
/data/data/####/v5kf_client.xml
/data/data/####/v5kf_emoticons.db
/data/data/####/v5kf_emoticons.db-journal
/data/data/####/yp_app.xml
/data/data/####/yp_app.xml.bak (deleted)
/data/media/####/.301d5.acid
/data/media/####/.DS_Store
/data/media/####/._.DS_Store
/data/media/####/._qingxin-qdp.p
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.c3418.cuid
/data/media/####/.cca.dat
/data/media/####/.com.jifen.ac.ReportCount
/data/media/####/.com.jifen.ac.acid
/data/media/####/.com.jifen.ac.cuid
/data/media/####/.com.jifen.ac.cuid2
/data/media/####/.e84e3.cuid2
/data/media/####/.umm.dat
/data/media/####/0c61135c2fdcd71f15ad7297245abe44
/data/media/####/3dd0e3d14c50443a992ee402395e9a6e
/data/media/####/49c6a36aaea8ee1549c1cd3e07070c79
/data/media/####/4cc427e8495943b5b5111514909bb30e
/data/media/####/5604e4d04d7f4f689be5c1fd7d600e26
/data/media/####/5cbc8a6fb0c34ab49e1070815705385c
/data/media/####/6635f1624bc4432ea6378c91394712cb
/data/media/####/8f787a0d46f742b09de6d9d8e0fd2bc5
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.tencent.mobileqq_connectSdk.21.12.31.14.log
/data/media/####/com.xike.yipai.bin
/data/media/####/com.xike.yipai.db
/data/media/####/deviceToken
/data/media/####/gkt-journal
/data/media/####/gktper (deleted)
/data/media/####/newfilters-v1.3.zip
/data/media/####/newfilters.json
/data/media/####/qingxin-qdp.p
/data/media/####/shaonv-qdp.p
/data/media/####/tbslog.txt
/data/media/####/tdata_DNL558
/data/media/####/tdata_RdS556
/data/media/####/tdata_hqs030
/data/media/####/test.log (deleted)
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat /sys/class/net/wlan0/address
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
getprop ro.vivo.os.build.display.id
id
logcat -d -v threadtime
ls -i
ls -l
ls /
ls /sys/class/thermal
mount
ps
sh
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/devices
sh -c cat /proc/mounts
sh -c cat /proc/partitions
sh -c cat /proc/self/maps
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh /data/user/0/<Package>/files/T-3biJeW66hNPCI0W5_nsUfHCje3PlAu
sh /data/user/0/<Package>/files/T-3r8pyCK645O1Xzg4nTP0Oe3OZr1nP6
sh /data/user/0/<Package>/files/T-5obVyB0q3kBopYRZTBg066xudHaY8j
sh /data/user/0/<Package>/files/T1VSfRwbgd2znMYv0ZbNXU4vRXRdlRBS
sh /data/user/0/<Package>/files/T1_zasGtKGkv3gCdgIuJ_0L7sC89777M
sh /data/user/0/<Package>/files/T2u1it0OvKboEkNQ0L2OX0-eFLErI0yq
sh /data/user/0/<Package>/files/T3LyvLfk5pibK5rLabKvW0j4kFj27kps
sh /data/user/0/<Package>/files/T3xjmosqwih8oNsg8oDnjErk76IPxUvy
sh /data/user/0/<Package>/files/T40smWoFigaap-vMzarZp0o4CnHczvbb
sh /data/user/0/<Package>/files/T4xgKYMnsyBP5WA7gp3rzUb9bCgJM9PB
sh /data/user/0/<Package>/files/T5siI8hEjhExqmJCEqImSkYdxn9HgX8T
sh /data/user/0/<Package>/files/T6qKa8yHuH7IMTHuV5UzBU4Cz2UGnQtD
sh /data/user/0/<Package>/files/T8KayjMQkv6wH08SpI_1t0N_ecFexCus
sh /data/user/0/<Package>/files/T_-A8e2XS_Nf_QWVUasRWkNFB9AxeUHs
sh /data/user/0/<Package>/files/Tw1AX-G5mDWUdY3R7ruWUEwNMPJ6SxDy
sh /data/user/0/<Package>/files/TwKOW_fF-FhYXeeh8bGS7kfsy5Mr9DR2
sh /data/user/0/<Package>/files/TwP3f_G_2zyGcWyW7rR5RUCRl5Tzs3wH
sh /data/user/0/<Package>/files/Txt9wprGOwwgqrn58rBGJ0ZmhGWzHIKE
sh /data/user/0/<Package>/files/Txy-vgZgPzU9uWS8yZG3DEjKGKWYSN03
sh /data/user/0/<Package>/files/TyHm_40Zwp8D0WFF7a2vu0fNC7KYLXY5
sh /data/user/0/<Package>/files/TyIi0_WeanEEc7PqIZPUWkl6Wzx9AoX5
sh /data/user/0/<Package>/files/TyKJgvxlWSvqE2kfhbnVYEZzPjxwqEPu
sh /data/user/0/<Package>/files/Ty_Q4NXzuYwLjgkTWoJibEISPnl0IY2v
sh /data/user/0/<Package>/files/Tye1ca8kE9ICpMbdZJhwdEO37NTxmozU
sh /data/user/0/<Package>/files/Tzk02_bPmxDUpk4nSK6IOk1fDu9WRJVW
sh /data/user/0/<Package>/files/TzkxYC2YjKW7SQJKL4E9iEcYVirAxpVo
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat app
stat etc
stat net
stat random
uname -a
uname -r

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial