Adware.Gexin.367

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) wb.110.ta####.com:80
TCP(HTTP/1.1) zhg.ali####.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) static-####.al####.huisuo####.com:80
TCP(HTTP/1.1) rb.api.huisuo####.com:80
TCP(HTTP/1.1) 1####.205.203.110:8030
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) t####.me####.com:443
TCP(TLS/1.0) u####.umengc####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) s.mai####.com:443
TCP(TLS/1.0) nbsdk-b####.al####.com:443
TCP(TLS/1.0) sh####.me####.com:443

DNS requests:

a####.u####.com
ad####.m.ta####.com
ada####.m.ta####.com
fp.fraudme####.cn
loc.map.b####.com
msg.umengc####.com
nbsdk-b####.al####.com
rb.api.huisuo####.com
s.mai####.com
sh####.me####.com
static-####.al####.huisuo####.com
t####.me####.com
u####.umengc####.com
u####.umengc####.com
wb.110.ta####.com
wgo.mm####.com
y####.al####.com

HTTP GET requests:

ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
api.m.ta####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####...
api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
static-####.al####.huisuo####.com/app/patch/infos/138-4.4.8.4.json
static-####.al####.huisuo####.com/market/purepackage/B019-138-4484.txt

HTTP POST requests:

a####.u####.com/app_logs
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
loc.map.b####.com/offline_loc
loc.map.b####.com/sdk.php
msg.umengc####.com/v2/register
rb.api.huisuo####.com/frontend/config/app
rb.api.huisuo####.com/frontend/config/right-slide-credit-config/load
rb.api.huisuo####.com/frontend/login/device
wb.110.ta####.com/api/update.do
zhg.ali####.com/saveWb.json

Modified file system:

Creates the following files:

/data/data/####/.cfg.hq
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.lscmf.lscmf
/data/data/####/.rscms.rscm
/data/data/####/.td-3
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1d77ea041509fe06.lock
/data/data/####/21c22f492aba3de8.lock
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/AGOO_CONNECT.xml
/data/data/####/AGOO_HOST.xml
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/AppStore.xml (deleted)
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MsgLogStore.db-journal
/data/data/####/PhoneUtil.xml
/data/data/####/SDKCache.xml
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/UmengLocalNotificationStore.db-journal
/data/data/####/_andfix_.xml
/data/data/####/agoo.pid
/data/data/####/aliTradeConfigSP.xml
/data/data/####/ap.Lock
/data/data/####/area_map.db.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.huaqian_preferences.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/finalcore.jar
/data/data/####/finalcore.jar.tmp
/data/data/####/firll.dat
/data/data/####/fm_shared.xml
/data/data/####/huaqian.preferences.xml
/data/data/####/imei.xml
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/libsgsecuritybodyso-5.1.25.so.tmp
/data/data/####/lock.lock
/data/data/####/ml-region-11.db.tmp
/data/data/####/multidex.version.xml
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/onesdk_device.xml
/data/data/####/openudid_prefs.xml
/data/data/####/sdk_config.xml
/data/data/####/slldate.xml
/data/data/####/sp.lock
/data/data/####/td_fm.jar
/data/data/####/timestamp
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/.sfp
/data/media/####/.td-3
/data/media/####/.testf
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/conlts.dat
/data/media/####/dd7893586a493dc3
/data/media/####/hid.dat
/data/media/####/ller.dat
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/ml.properties
/data/media/####/ml.properties.lock
/data/media/####/test.0

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D {"package":"<Package>","appKey":"umeng:520c538a56240bdc4a0d118f","utdid":"W1DKTxze8aIDAGdzx1Eu5sjT","sdkVersion":"20151015"} -I 100.69.168.33 -O 80 -T -Z
chmod 444/storage/emulated/0/.DataStorage/.td-3
chmod 444/storage/emulated/0/.UTSystemConfig/.td-3
chmod 444/storage/emulated/0/.td-3
chmod 444/storage/emulated/0/Alarms/.td-3
chmod 444/storage/emulated/0/Android/.td-3
chmod 444/storage/emulated/0/Movies/.td-3
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop net.dns1
getprop net.dns2
ls -l /system/xbin/su
sh

Loads the following dynamic libraries:

andfix
libjiagu
locSDK6a
sgmainso-5.1
sgsecuritybodyso-5.1
tnet-2.1.20
tongdun
ut_c_api

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
desede-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial