Adware.Gexin.884

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) s####.vp####.com:80
TCP(HTTP/1.1) aserver####.m.ta####.com:80
TCP(HTTP/1.1) t####.vpgam####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) www.vp####.com.####.net:80
TCP(HTTP/1.1) webser####.vp####.com.####.net:80
TCP(HTTP/1.1) d####.ser####.vp####.####.net:80
TCP(HTTP/1.1) ds-ak####.akam####.net.####.net:80
TCP(HTTP/1.1) at.al####.com:80
TCP(HTTP/1.1) t####.vp####.com:80
TCP(TLS/1.0) t.growi####.com:443
TCP(TLS/1.0) d506####.cdn.uc####.####.cn:443
TCP(TLS/1.0) api.vp####.com.####.net:443
TCP(TLS/1.0) resourc####.vp####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) api.growi####.com:443
TCP(TLS/1.0) svi####.cdnv####.ru:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) cdn.boo####.com.####.com:443
TCP(TLS/1.0) t####.growi####.com:443

DNS requests:

a####.exc.mob.com
api.growi####.com
api.vp####.com
as####.growi####.com
at.al####.com
cdn.boo####.com
d####.ser####.vp####.com
ds-ak####.akam####.net
e.crashly####.com
l####.tbs.qq.com
pl####.y####.com
r####.wx.qq.com
resourc####.vp####.com
s####.vp####.com
sett####.crashly####.com
st####.d####.vp####.com
svi####.cdnv####.ru
t####.growi####.com
t####.vp####.com
t####.vpgam####.com
t.growi####.com
webser####.vp####.com
www.vp####.com

HTTP GET requests:

aserver####.m.ta####.com/jsapi
aserver####.m.ta####.com/unifull/css/unifull.min.css?v=####
at.al####.com/t/font_37570_2shrtt6xbd8cl3di.css
d####.ser####.vp####.####.net/dota2/pro/webservice/schedule/schedule-rec...
ds-ak####.akam####.net.####.net/2/653049/b?dE=####&cS=####&cE=####&rqS=#...
ds-ak####.akam####.net.####.net/aksb.min.js
s####.tc.qq.com/open/js/jweixin-1.2.0.js
s####.vp####.com/steamcommunity/public/images/avatars/4c/4c0d9798787a508...
t####.vp####.com/167b7fab00.png
t####.vp####.com/198a817ca.jpg
t####.vp####.com/1b07b776e.jpg
t####.vp####.com/20fddc216.png
t####.vp####.com/2b9567.jpg
t####.vp####.com/33a1c35.jpg
t####.vp####.com/44e8de40.jpg
t####.vp####.com/480e957.jpg
t####.vp####.com/51a858e.jpg
t####.vp####.com/63187c8276.jpg
t####.vp####.com/8cff687837.jpg
t####.vp####.com/css/app/news.css?v=####
t####.vp####.com/f479e1104.jpg
t####.vp####.com/img/app/note-icon.png
t####.vp####.com/img/wechat/VP.png
t####.vp####.com/js/app/video.js?v=####
t####.vp####.com/js/app/wx-sdk.js?v=####
t####.vp####.com/js/zepto.1.2.min.js?v=####
t####.vpgam####.com/file/12be841f4a.jpg
t####.vpgam####.com/file/28461eb0.jpg
t####.vpgam####.com/file/32673925.jpg
t####.vpgam####.com/file/88263a7884c.jpg
t####.vpgam####.com/file/aff9be476e.jpg
webser####.vp####.com.####.net/social/topic/list?type=####&curr_page=###...
webser####.vp####.com.####.net/v2/app/global/config?uid=####&token=####
webser####.vp####.com.####.net/v2/mobile/device/index?os_versions=####&i...
webser####.vp####.com.####.net/v2/mobile/event/commentList?offset=####&l...
webser####.vp####.com.####.net/v2/social/dynamic/new_counts?game_type=##...
webser####.vp####.com.####.net/v2/social/message/count?uid=####&token=####
www.vp####.com.####.net/api/news/view?news_id=####&version=####&app-vers...

HTTP POST requests:

a####.exc.mob.com/errconf
l####.tbs.qq.com/ajax?c=####&k=####
webser####.vp####.com.####.net/v2/mobile/event/likeStatus?id=####&uid=##...

Modified file system:

Creates the following files:

/data/data/####/.duid
/data/data/####/.jg.ic
/data/data/####/.lock
/data/data/####/.vpl_lock
/data/data/####/1cbe952c811cd2df6464db102dad16e3.0.tmp
/data/data/####/1cbe952c811cd2df6464db102dad16e3.1.tmp
/data/data/####/346d2bff536c6532c609356b46de0bb4.0.tmp
/data/data/####/346d2bff536c6532c609356b46de0bb4.1.tmp
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637BeginSession.cls_temp
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637BeginSession.json
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637SessionApp.cls_temp
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637SessionApp.json
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637SessionDevice.cls_temp
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637SessionDevice.json
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637SessionOS.cls_temp
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637SessionOS.json
/data/data/####/5B637BAB0096-0001-0828-ECC345DF2637SessionUser.cls_temp
/data/data/####/5B637BAC035C-0001-0857-ECC345DF2637BeginSession.cls_temp
/data/data/####/5B637BAC035C-0001-0857-ECC345DF2637BeginSession.json
/data/data/####/5B637BAC035C-0001-0857-ECC345DF2637SessionApp.cls_temp
/data/data/####/5B637BAC035C-0001-0857-ECC345DF2637SessionApp.json
/data/data/####/5B637BAC035C-0001-0857-ECC345DF2637user.meta
/data/data/####/5B637BB500DC-0001-08B7-ECC345DF2637BeginSession.cls_temp
/data/data/####/5B637BB500DC-0001-08B7-ECC345DF2637BeginSession.json
/data/data/####/5B637BB500DC-0001-08B7-ECC345DF2637SessionApp.cls_temp
/data/data/####/5B637BB500DC-0001-08B7-ECC345DF2637SessionApp.json
/data/data/####/5B637BB500DC-0001-08B7-ECC345DF2637SessionOS.cls_temp
/data/data/####/5B637BB500DC-0001-08B7-ECC345DF2637SessionOS.json
/data/data/####/5B637BBD0348-0001-0902-ECC345DF2637BeginSession.cls_temp
/data/data/####/5B637BBD0348-0001-0902-ECC345DF2637BeginSession.json
/data/data/####/5B637BBD0348-0001-0902-ECC345DF2637SessionApp.cls_temp
/data/data/####/5B637BBD0348-0001-0902-ECC345DF2637SessionApp.json
/data/data/####/5B637BBD0348-0001-0902-ECC345DF2637SessionOS.cls_temp
/data/data/####/5B637BBD0348-0001-0902-ECC345DF2637SessionOS.json
/data/data/####/5c3bc21f1099a9898ea26abb20ac9144.0.tmp
/data/data/####/5c3bc21f1099a9898ea26abb20ac9144.1.tmp
/data/data/####/6c9cdad7f935bfc35f7e3763e3219605.0.tmp
/data/data/####/6c9cdad7f935bfc35f7e3763e3219605.1.tmp
/data/data/####/82d7c36bb0de27899241dd9d5b691a71.0.tmp
/data/data/####/82d7c36bb0de27899241dd9d5b691a71.1.tmp
/data/data/####/936da66a51c94cd80a73d3f0fbba607c.0.tmp
/data/data/####/936da66a51c94cd80a73d3f0fbba607c.1.tmp
/data/data/####/MultiDex.lock
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/ac9ba329cef3827eb7d36a101a4d790f.0.tmp
/data/data/####/ac9ba329cef3827eb7d36a101a4d790f.1.tmp
/data/data/####/b803c3c190721323d3c2d54126c6a316.0.tmp
/data/data/####/b803c3c190721323d3c2d54126c6a316.1.tmp
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.vpgame.eric;pushservice.growing.db-journal
/data/data/####/com.vpgame.eric_preferences.xml
/data/data/####/core_info
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/debug.conf
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/fba16990a98ddf18d76dd655255d3f08.0.tmp
/data/data/####/fba16990a98ddf18d76dd655255d3f08.1.tmp
/data/data/####/getui_sp.xml
/data/data/####/growing.db-journal
/data/data/####/growing_ecsid.xml
/data/data/####/growing_persist_data.xml
/data/data/####/growing_profile.xml
/data/data/####/growing_server_pref.xml
/data/data/####/index
/data/data/####/init_c1.pid
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.andr...ng.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu1996635172.so
/data/data/####/mob_commons_1
/data/data/####/multidex.version.xml
/data/data/####/nbaplus-journal
/data/data/####/pushsdk.db-journal
/data/data/####/sa_645bd4f9-d84c-4b24-8b22-397f28f81c64_1533246379630.tap
/data/data/####/sa_b84792e5-1c9f-4c6e-b30c-f6a741d61cdf_1533246381600.tap
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.artc_lock
/data/media/####/.di
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.im_lock
/data/media/####/.lecd
/data/media/####/.lesd_lock
/data/media/####/.mn_-1464060969
/data/media/####/.nomedia
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.rc_lock
/data/media/####/.slw
/data/media/####/.ss_lock
/data/media/####/077b624a031e7f94dffbe56a9e89e061a30b2722d14cf7....0.tmp
/data/media/####/0aca99c473e71c2c5da3e61538f6e807aa2a6e7fe1caa5....0.tmp
/data/media/####/0e171914d05312e31f01e6201f3963380046462dff2eb4....0.tmp
/data/media/####/2df4bb2a4db83c613d506dd0d38b2f10f51e0ba20cfa8c....0.tmp
/data/media/####/30faeec0dc2fd29000d225f3479273bf94154ef13c9efa....0.tmp
/data/media/####/318b90cb5e7ed0e4a590007aaba7c7fcc5b2227146ea59....0.tmp
/data/media/####/3f3eddfaaa05442c5a68934bddc75cf0b135ed8d641f96....0.tmp
/data/media/####/475a022772714aaa1c9e8575d2b0d8be44cbab566d163f....0.tmp
/data/media/####/51326d550cdbca0f8d4506db2db6cbfcd6b5cd730ac88a....0.tmp
/data/media/####/57f40d48cbb6b387db189b45de536c55f01a611f5dabf1....0.tmp
/data/media/####/5eebf27934c818cfebacdacf858e040be0c2d0887f5e3e....0.tmp
/data/media/####/6056f6530d1274da174efbf1387dd5e014b22fcc16ba63....0.tmp
/data/media/####/6d5ca270bc7c64dc041eeeebdb11625827057d7a8c1f65....0.tmp
/data/media/####/9213b05470ca30ef2215d3501f1281755a1b26b093d571....0.tmp
/data/media/####/953976bc1927cb9aa0063b46c7a0a0edb28d878649b8b9....0.tmp
/data/media/####/b20566ae67559eae426e21b8c8a87e90a3d4c15efdef22....0.tmp
/data/media/####/c2e89bcd3b31369c4271061bd420bf5e4c65348ee975fb....0.tmp
/data/media/####/cd7b1371cb648d588cdccbe52c14b729fd50d65b761102....0.tmp
/data/media/####/f1b431d7f779616974e952c775458dfe6fa9169bf7b196....0.tmp
/data/media/####/f6627721fd8bd89d33f7684c6cfc3c83f174f0fa4b4ff2....0.tmp
/data/media/####/journal.tmp
/data/media/####/log-2018-08-02-1533246381310.txt
/data/media/####/log-2018-08-02-1533246381370.txt
/data/media/####/log-2018-08-02-1533246387720.txt
/data/media/####/log-2018-08-02-1533246387770.txt
/data/media/####/log-2018-08-02-1533246389760.txt
/data/media/####/log-2018-08-02-1533246398350.txt
/data/media/####/log-2018-08-02-1533246398430.txt
/data/media/####/log-2018-08-02-1533246398450.txt
/data/media/####/log-2018-08-02-1533246398480.txt
/data/media/####/log-2018-08-02-1533246398500.txt
/data/media/####/log-2018-08-02-1533246398530.txt
/data/media/####/log-2018-08-02-1533246429420.txt
/data/media/####/log-2018-08-02-1533246439800.txt
/data/media/####/log-2018-08-02-1533246439820.txt
/data/media/####/log-2018-08-02-1533246439830.txt
/data/media/####/log-2018-08-02-1533246439860.txt
/data/media/####/log-2018-08-02-1533246439880.txt
/data/media/####/tbslog.txt

Miscellaneous:

Executes next shell scripts:

cat /sys/class/net/wlan0/address
chmod 755 <Package Folder>/.jiagu/libjiagu1996635172.so
getprop ro.product.cpu.abi

Loads the following dynamic libraries:

getuiext2
libjiagu1996635172

Uses the following algorithms to encrypt data:

AES-ECB-PKCS7Padding
RSA-ECB-NoPadding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-ECB-NoPadding

Uses special library to hide executable bytecode.

Gains access to telephone information (number, imei, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial