Adware.Gexin.19215

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) as.lie####.cn:80
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) ad.midong####.com:80
TCP(HTTP/1.1) f.qia####.com:80
TCP(HTTP/1.1) a####.w####.com:80
TCP(HTTP/1.1) mm.ylx####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) et2-####.wagbr####.ali####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) ap####.g####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) 47.2####.11.30:80
TCP(HTTP/1.1) 47.90.1####.89:8082
TCP(HTTP/1.1) api.v2.sdk.####.cn:80
TCP(HTTP/1.1) sdk.yu####.mobi:80
TCP(HTTP/1.1) t####.3g.qq.com:80
TCP(HTTP/1.1) news####.co####.com:80
TCP(HTTP/1.1) c####.g####.com:80
TCP(HTTP/1.1) ip.adi####.net:80
TCP(HTTP/1.1) lar####.c####.l####.####.com:80
TCP(HTTP/1.1) dcs.co####.com:80
TCP(HTTP/1.1) cn-hang####.oss####.aliyun####.com:80
TCP(HTTP/1.1) j.quwe####.com:80
TCP(HTTP/1.1) b####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) na61-na####.wagbr####.adverti####.####.com:80
TCP(HTTP/1.1) api.t####.taol####.cn:80
TCP(TLS/1.0) xinwenz####.co####.com:443
TCP(TLS/1.0) api.co####.com:443
TCP(TLS/1.0) sdkup####.bo####.com:443
TCP(TLS/1.0) baichua####.al####.com:443
TCP(TLS/1.0) gd-s####.j####.cn:443
TCP(TLS/1.0) ip.adi####.net:443
TCP(TLS/1.0) xwz.co####.com:443
TCP(TLS/1.0) api.v2.sdk.####.cn:443
TCP(TLS/1.0) api####.me####.com:443
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) sf6-ttc####.ps####.com.####.com:443
TCP(TLS/1.0) user####.al####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) t####.c####.q####.####.net:443
TCP(TLS/1.0) t####.j####.cn:443
TCP(TLS/1.0) i####.co####.com:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) sdkc####.e.360.cn:443
TCP(TLS/1.0) secgw-n####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) sf1-ttc####.ps####.com:443
TCP(TLS/1.0) ali-s####.j####.cn:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5226
UDP 4####.89.26.110:19000
TCP m####.3g.qq.com:443
UDP 1####.168.105.1:137
TCP 1####.202.138.13:7005

DNS requests:

a####.w####.com
ad.midong####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
ali-s####.j####.cn
and####.b####.qq.com
ap####.g####.com
api####.me####.com
api.co####.com
api.t####.taol####.cn
api.v2.sdk.####.cn
as.lie####.cn
b####.g####.com
b####.g####.com
baichua####.al####.com
baichua####.ta####.com
c####.cs.pp.cn
c####.g####.com
c####.g####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.ig####.com
cn-hang####.oss####.aliyun####.com
dcs.co####.com
f.qia####.com
fp.fraudme####.cn
gd-s####.j####.cn
h####.ali####.com
h####.b####.com
i####.co####.com
ip.adi####.net
ip.ta####.com
is.sn####.com
j.quwe####.com
l####.cs.pp.cn
l####.tbs.qq.com
m####.3g.qq.com
mm.ylx####.com
news####.co####.com
norma-e####.m####.com
o####.sjzs####.2####.com
r####.co####.com
res####.a####.com
s####.adi####.net
s.startog####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.ipad####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sdk.yu####.mobi
sdkc####.e.360.cn
sdkup####.bo####.com
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
t####.3g.qq.com
t####.j####.cn
u####.al####.org
user####.al####.com
www.b####.com
www.co####.com
xinwenz####.co####.com
xwz.co####.com
y####.al####.org

HTTP GET requests:

b####.g####.com/api/addr.htm
cdn-sdk####.g####.com.####.com/tdata_EDB102
cdn-sdk####.g####.com.####.com/tdata_jiP572
cdn-sdk####.g####.com.####.com/tdata_wxc339
cdn-sdk####.g####.com.####.com/tdata_yHR736
cn-hang####.oss####.aliyun####.com/amap-api/comm/upload/CoordinateSoEnhe...
dcs.co####.com/data/config/Android.conf
dcs.co####.com/ip
f.qia####.com/e/20191224140820b_600016_v74.enc
ip.adi####.net/api/ad/ad/sendDeviceInfo
ip.adi####.net/extra/information/list?acc=####
ip.ta####.com/service/getIpInfo2.php?ip=####
lar####.c####.l####.####.com/1569729237115_191c4ae3638a6e43.png
mm.ylx####.com/xmsdkcf.json
news####.co####.com/20191224/upload/21432E1308C34DBCB1E04199B0E5B057.jpg...
news####.co####.com/20191224/upload/68A85DB2CB4F41DBA0C5C3782BE3A438.jpg...
norma-e####.m####.com/android/exchange/getpublickey.do
q####.c####.l####.####.com/config/hz-hzv6.conf
sdk.yu####.mobi/sdk2?ipv4=####&model=####&media_type=####&app_package=##...
t####.3g.qq.com/cw.html

HTTP POST requests:

a####.w####.com/rest/pt
ad.midong####.com/api/ads/appinit
ad.midong####.com/api/ads/appinstalllist
ad.midong####.com/api/ads/mdic
and####.b####.qq.com/rqd/async?aid=####
ap####.g####.com/uploadIdBinding
api.t####.taol####.cn/init/main/init
api.t####.taol####.cn/task/game/index
api.v2.sdk.####.cn/v2/aiList
as.lie####.cn/v2/cp?appId=####
b####.g####.com/api.php?format=####&t=####
c####.g####.com/api.php?format=####&t=####
dcs.co####.com/data/v1?project=####
et2-####.wagbr####.ali####.com/utdid_pp_helper/get_aid/?auth[token]=####...
j.quwe####.com/f/m1
l####.tbs.qq.com/ajax?c=####&k=####
na61-na####.wagbr####.adverti####.####.com/api/log.upload
na61-na####.wagbr####.adverti####.####.com/api/op.config.list
na61-na####.wagbr####.adverti####.####.com/api/resource.app.checkUpdateV1
norma-e####.m####.com/push/android/external/add.do
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####

File system changes:

Creates the following files:

/data/data/####/.QRd_
/data/data/####/.Y_Tz.xml
/data/data/####/.jg.ic
/data/data/####/.td-3
/data/data/####/.ukPkC
/data/data/####/.ukPkC.zip
/data/data/####/.zH_O.xml
/data/data/####/.zH_O.xml.bak
/data/data/####/0791f3f260__local_stat_cache.json
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1004
/data/data/####/1021689741840853517
/data/data/####/12f36ff3-8445-4c92-90af-27e7aaf856e1
/data/data/####/152b60333d61
/data/data/####/1690892622591.0
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/31115380692315.0
/data/data/####/3b4b070d-60f9-4cf0-b605-1263599100d3
/data/data/####/40805.dat
/data/data/####/4480820274012.0
/data/data/####/4f8d2596-34e7-4fd6-9867-14cba0474ba9
/data/data/####/53112788006728.0
/data/data/####/54109872615939.0
/data/data/####/65103881655123.0
/data/data/####/66106695671100.0
/data/data/####/6f4ed4cc-2c55-4c53-a73b-8bc9ff6bfffa
/data/data/####/787909234173.0
/data/data/####/83101138604781.0
/data/data/####/9b782a1d-866b-4705-8360-e5e2b35625f7
/data/data/####/A3AEECD8.dex
/data/data/####/AKTorchDownload.db-journal
/data/data/####/Alvin2.xml
/data/data/####/BonreeCrashStore.xml
/data/data/####/ConfigInterval.xml
/data/data/####/ConfigResponseTime.xml
/data/data/####/ContextData.xml
/data/data/####/CrashKeepTime.xml
/data/data/####/GrayID.xml
/data/data/####/JPushSA_Config.xml
/data/data/####/JPushSA_Config.xml.bak
/data/data/####/JPushSA_Config.xml.bak (deleted)
/data/data/####/JX0WDG83P1ZN.txt8e2
/data/data/####/LY_AD_KEY.xml
/data/data/####/MultiDex.lock
/data/data/####/OfJbkLdFbPOMbGyP.xml
/data/data/####/PreAppVersion.xml
/data/data/####/PreferanceUtil.xml
/data/data/####/SGMANAGER_DATA2
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/SG_INNER_DATA
/data/data/####/UTCommon.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/ap.Lock
/data/data/####/appPackageNames_v2
/data/data/####/auth_sdk_device.xml
/data/data/####/avmp_315435600.pkgInfo
/data/data/####/avmp_315435600.pkgInfo.tmp
/data/data/####/bc_config
/data/data/####/bugly_db_-journal
/data/data/####/c182de9b-147c-45cb-ab3f-deeeaae5b3f7
/data/data/####/cbxlib.xml
/data/data/####/cdu_st_-1793521376
/data/data/####/cloud_switch_cache
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.android.user.profile.xml.bak
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.coohua.xinwenzhuan_preferences.xml
/data/data/####/com.coohua.xinwenzhuan_preferences.xml.bak (deleted)
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDa...leted)
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDa...ml.bak
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.2.xml
/data/data/####/config_1.xml
/data/data/####/configuration.xml
/data/data/####/core_info
/data/data/####/core_update
/data/data/####/core_update_locker
/data/data/####/crashrecord.xml
/data/data/####/data_dir.xml
/data/data/####/db_downloader-journal
/data/data/####/dc61e10fdcf754f36e
/data/data/####/dc7b759e897974ba7e
/data/data/####/dc7dfddc457bff13a0
/data/data/####/dc7f3eae047f75ffe3
/data/data/####/device_collector
/data/data/####/device_collector_locker
/data/data/####/doc.zip
/data/data/####/downloader.db-journal
/data/data/####/e83f0a42-bfa8-4845-9ae1-b55961b3c7db
/data/data/####/fm_shared.xml
/data/data/####/foc.png
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gin.db-journal
/data/data/####/gtc.db-journal
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/hoc.xml
/data/data/####/ibkad_config.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/init_urls.xml
/data/data/####/journal
/data/data/####/journal.bkp
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/k.store
/data/data/####/libcuid.so
/data/data/####/libjiagu-2010666175.so
/data/data/####/libsgavmpso-5.4.36.so
/data/data/####/libsgavmpso-5.4.36.so.tmp.2274
/data/data/####/libsgmainso-5.4.171.so.tmp.2274
/data/data/####/libsgsecuritybodyso-5.4.99.so.tmp.2274
/data/data/####/libsgsgmiddletierso-5.4.7.so.tmp.2274
/data/data/####/libwgs2gcj.so
/data/data/####/local_crash_lock
/data/data/####/lock.lock
/data/data/####/loctemp.so (deleted)
/data/data/####/log_reupload_task
/data/data/####/log_reupload_task_locker
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/longyun_sdk.xml
/data/data/####/main_315435600.pkgInfo
/data/data/####/main_315435600.pkgInfo.tmp
/data/data/####/md_ad_config.xml
/data/data/####/md_ad_config.xml.bak
/data/data/####/msg_queue
/data/data/####/multidex.version.xml
/data/data/####/mz_push_preference.xml
/data/data/####/pack.xml
/data/data/####/pattern_urls
/data/data/####/ppsdk_pref.xml
/data/data/####/pref.xml
/data/data/####/pref.xml.bak (deleted)
/data/data/####/profile_task
/data/data/####/profile_task_locker
/data/data/####/profile_torch_platform
/data/data/####/pull_live_sp.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/securitybody_315435600.pkgInfo
/data/data/####/securitybody_315435600.pkgInfo.tmp
/data/data/####/sensorsdata-journal
/data/data/####/sensorsdata.xml
/data/data/####/sgFile.lock
/data/data/####/sgmiddletier_315435600.pkgInfo
/data/data/####/sgmiddletier_315435600.pkgInfo.tmp
/data/data/####/sk.xml
/data/data/####/smart_link_sp.xml
/data/data/####/sp.lock
/data/data/####/sp_push_time.xml
/data/data/####/taoqu.xml
/data/data/####/taoxinwenh5
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_jiP572
/data/data/####/tdata_jiP572.jar
/data/data/####/tdata_wxc339-695836674.tmp
/data/data/####/tdata_wxc339.jar
/data/data/####/tdata_yHR736
/data/data/####/tdata_yHR736.jar
/data/data/####/timestamp
/data/data/####/tms_base.xml
/data/data/####/torch_sdk_config.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/uninstall_apk
/data/data/####/uninstall_apk_locker
/data/data/####/update.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/waitingDown
/data/data/####/waitingDown_locker
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/xinwenzhuan_ownerInfo.xml
/data/media/####/.0
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.lock
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/.sfp
/data/media/####/.td-3
/data/media/####/.tdck
/data/media/####/.testf
/data/media/####/1577363847181.db
/data/media/####/1b28465a6dab655d305b760c4380992f.tmp
/data/media/####/2019-12-26.log.txt
/data/media/####/215d4cd151f9044722e84261f4c79a450c5ba45b69a6f2....0.tmp
/data/media/####/419f7d8430ba622dc57670ffbe01b041
/data/media/####/5c5717af24f254e70d1deb41ec5c36ff862260dfe4309d...504b.0
/data/media/####/@gs_1241_m.coohua.xinwenzhuan_
/data/media/####/@gs_1241_m.coohua.xinwenzhuan_.lock
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/app.db
/data/media/####/com.coohua.xinwenzhuan.bin
/data/media/####/com.coohua.xinwenzhuan.db
/data/media/####/com.coohua.xinwenzhuan_.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/hid.dat.new
/data/media/####/journal.tmp
/data/media/####/mdtecfzb.txt
/data/media/####/tdata_jiP572
/data/media/####/tdata_wxc339
/data/media/####/tdata_yHR736
/data/media/####/temp_pkg_info.json
/data/media/####/test.log
/data/media/####/uninstall_apk_list

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/dc61e10fdcf754f36e
<Package Folder>/files/dc7b759e897974ba7e
<Package Folder>/files/dc7f3eae047f75ffe3
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.coohua.pushsdk.core.GeTuiService 25265 300 0
busybox ifconfig
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop
getprop net.dns1
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.letv.release.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
mount
ps
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.coohua.pushsdk.core.GeTuiService 25265 300 0
su

Loads the following dynamic libraries:

317844B0CDB0A833
A3AEECD8
Bugly
getuiext3
jcore126
libjiagu-2010666175
sgavmpso-5.4
sgmainso-5.4
sgsecuritybodyso-5.4
sgsgmiddletierso-5.4
tongdun
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NOPADDING
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NOPADDING
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Uses elevated priveleges.

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial