Adware.Gexin.12183

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ap####.v0.m####.com:80
TCP(HTTP/1.1) 0####.h####.com:80
TCP(HTTP/1.1) g####.hun####.com:80
TCP(HTTP/1.1) use####.api.max.####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) st.bz.m####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) x.da.m####.com:80
TCP(HTTP/1.1) o####.ar####.api.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) 1####.h####.com:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) m####.api.m####.com:80
TCP(HTTP/1.1) x.da.hun####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) mob.bz.m####.com:80
TCP(HTTP/1.1) log.da.hun####.com:80
TCP(HTTP/1.1) cou####.pe####.m####.com:80
TCP(HTTP/1.1) o####.ac####.api.####.com:80
TCP(HTTP/1.1) s5.hun####.com:80
TCP(TLS/1.0) app.onetwo####.top.####.com:443
TCP(TLS/1.0) qq.i####.com:443
TCP(TLS/1.0) hi.tencen####.top:443
TCP sdk.o####.t####.####.com:5224
TCP 43.2####.145.4:5224
TCP t####.nz4.ig####.com:5224

DNS requests:

0####.h####.com
1####.h####.com
2####.h####.com
3####.h####.com
4####.h####.com
7j####.c####.z0.####.com
a####.u####.com
ap####.v0.m####.com
api####.a####.com
app.onetwo####.top
c-h####.g####.com
cou####.pe####.m####.com
g####.hun####.com
hi.tencen####.top
log.da.hun####.com
m####.api.m####.com
m.i####.com
mo####.api.hun####.com
mob.bz.m####.com
o####.ac####.api.####.com
o####.ar####.api.####.com
pub-####.qin####.com
pv.s####.com
rc.m####.com
s5.hun####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st.bz.m####.com
t####.nz4.g####.net
t####.nz4.ge####.com
t####.nz4.ig####.com
use####.api.max.####.com
www.qchann####.cn
x.da.hun####.com
x.da.m####.com

HTTP GET requests:

0####.h####.com/preview/channel_images/20190329195359830.jpg_738x416.jpg
0####.h####.com/preview/cms_icon/2019/4/10/04/20190410100417917.jpg_366x...
0####.h####.com/preview/cms_icon/2019/4/10/04/20190410101840208.gif
0####.h####.com/preview/cms_icon/2019/4/11/04/20190411111953612.jpg_366x...
0####.h####.com/preview/cms_icon/2019/4/11/04/20190411193100129.jpg_750x...
0####.h####.com/preview/cms_icon/2019/4/11/04/20190411203826075.jpg_750x...
0####.h####.com/preview/cms_icon/2019/4/3/04/20190403193339709.jpg_130x1...
0####.h####.com/preview/cms_icon/auto_gif/2019/04/11/401537966443907618....
0####.h####.com/preview/internettv/sp_images/ott/2019/4/8/yinle/10002563...
0####.h####.com/preview/sp_images/2018/zongyi/323564/4457296/20180709091...
0####.h####.com/preview/sp_images/2019/4/11/zongyi/328308/5453118/201904...
0####.h####.com/preview/sp_images/2019/4/11/zongyi/328308/5454610/201904...
1####.h####.com/preview/channel_images/20180126144432796.jpg_738x416.jpg
1####.h####.com/preview/channel_images/20190313104401743.jpg_366x206.jpg
1####.h####.com/preview/channel_images/20190318092137392.jpg_366x206.jpg
1####.h####.com/preview/cms_icon/2019/4/10/04/20190410110253086.jpg_366x...
1####.h####.com/preview/cms_icon/2019/4/10/04/20190410213847353.gif
1####.h####.com/preview/cms_icon/2019/4/11/04/20190411000801878.jpg_750x...
1####.h####.com/preview/cms_icon/2019/4/11/04/20190411093154281.jpg_366x...
1####.h####.com/preview/cms_icon/2019/4/11/04/20190411113926656.jpg_750x...
1####.h####.com/preview/cms_icon/2019/4/11/04/20190411152436030.jpg_366x...
1####.h####.com/preview/cms_icon/2019/4/11/04/20190411152514469.jpg_366x...
1####.h####.com/preview/cms_icon/2019/4/11/04/20190411180153126.jpg_366x...
1####.h####.com/preview/cms_icon/2019/4/11/04/20190411195050864.gif
1####.h####.com/preview/cms_icon/2019/4/3/04/20190403170354733.jpg_750x3...
1####.h####.com/preview/cms_icon/2019/4/3/04/20190403170514043.jpg_750x3...
1####.h####.com/preview/cms_icon/2019/4/3/04/20190403193237449.jpg_130x1...
1####.h####.com/preview/cms_icon/2019/4/3/04/20190403193352314.jpg_130x1...
1####.h####.com/preview/cms_icon/2019/4/4/04/20190404203839610.jpg_750x3...
1####.h####.com/preview/cms_icon/2019/4/5/04/20190405223708030.jpg_366x2...
1####.h####.com/preview/cms_icon/2019/4/8/04/20190408122223054.jpg_366x2...
1####.h####.com/preview/cms_icon/2019/4/8/04/20190408195525166.jpg_750x3...
1####.h####.com/preview/cms_icon/2019/4/9/04/20190409211647556.jpg_366x2...
1####.h####.com/preview/cms_icon/auto_gif/2019/04/09/482789994086746014....
1####.h####.com/preview/sp_images/2018/12/25/dianshiju/323323/4863265/20...
1####.h####.com/preview/sp_images/2019/4/11/zongyi/328308/5452105/201904...
1####.h####.com/preview/sp_images/2019/4/11/zongyi/328308/5452523/201904...
1####.h####.com/preview/sp_images/2019/4/11/zongyi/328308/5454312/201904...
ap####.v0.m####.com/pv.php?nt=####&cpid=####&md=####&tst=####&gps=####&s...
ap####.v0.m####.com/pv.php?nt=####&ftl=####&cpid=####&md=####&tst=####&g...
cou####.pe####.m####.com/message/poll?uid=####&osVersion=####&did=####&m...
g####.hun####.com/mobile/distribute.do?deviceid=####
gdv.a.s####.com/cityjson
mob.bz.m####.com/odin/c1/channel/list?uid=####&osVersion=####&mac=####&o...
o####.ac####.api.####.com/artist/getRecommendCollectArtist?uid=####&osVe...
o####.ar####.api.####.com/artist/getArtistListByIds?uid=####&type=####&t...
qin####.com.www.####.com/tdata_EDT369
s5.hun####.com/channel/live?uid=####&osVersion=####&ticket=####&appVersi...
s5.hun####.com/mobile/rank?c=####
s5.hun####.com/mobile/rank?uid=####&osVersion=####&c=####&mac=####&osTyp...
s5.hun####.com/recommend?uid=####&platform=####&osVersion=####&mac=####&...
s5.hun####.com/user/getActivity?uid=####&osVersion=####&ticket=####&appV...
s5.hun####.com/v1/config/play?uid=####&osVersion=####&ticket=####&appVer...
s5.hun####.com/v5/listconfig?uid=####&platform=####&osVersion=####&mac=#...
s5.hun####.com/v6/search/recommend?uid=####&osVersion=####&ticket=####&a...
st.bz.m####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
t####.c####.q####.####.com/config/bj-bjv7.conf
t####.c####.q####.####.com/config/hz-bjv8.conf
t####.c####.q####.####.com/tdata_AXX896
t####.c####.q####.####.com/tdata_BAI450
t####.c####.q####.####.com/tdata_IcB528
use####.api.max.####.com/person57ea2d83c18cc.jpg@1wh_1e_1c_0o_0l_130h_13...
use####.api.max.####.com/person57fb6062d84a5.png
use####.api.max.####.com/person5ad6eea479eeb.png@1wh_1e_1c_0o_0l_130h_13...
use####.api.max.####.com/person5b1b72e5b9d13.jpg@1wh_1e_1c_0o_0l_130h_13...
use####.api.max.####.com/person5c7b4e267cb76.jpg
use####.api.max.####.com/preview/cms_icon/2019/4/10/04/20190410094156892...
use####.api.max.####.com/preview/cms_icon/2019/4/10/04/20190410220155350...
use####.api.max.####.com/preview/cms_icon/2019/4/11/04/20190411193610851...
use####.api.max.####.com/preview/cms_icon/2019/4/11/04/20190411193901858...
use####.api.max.####.com/preview/cms_icon/2019/4/11/04/20190411194027159...
use####.api.max.####.com/preview/cms_icon/2019/4/3/04/20190403193418257....
use####.api.max.####.com/preview/sp_images/2019/4/10/zongyi/328103/54509...
use####.api.max.####.com/preview/sp_images/2019/4/10/zongyi/328308/54505...
use####.api.max.####.com/preview/sp_images/2019/4/11/zongyi/328308/54532...
use####.api.max.####.com/preview/sp_images/2019/4/11/zongyi/328308/54542...

HTTP POST requests:

a####.u####.com/app_logs
c-h####.g####.com/api.php?format=####&t=####
log.da.hun####.com/v1/t
m####.api.m####.com/mpns/parseLog
o####.ac####.api.####.com/global/config
res####.a####.com/v3/log/init
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
www.qchann####.cn/center/adj
www.qchann####.cn/center/adj?appkey=####
x.da.hun####.com/json/app/boot
x.da.m####.com/m/page

File system changes:

Creates the following files:

/data/data/####/-613446801
/data/data/####/-613446835
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/06462449425f059a280afd7f6e5a0945e400c8987fe884f....0.tmp
/data/data/####/09728ddcee61f0a8a6bbcbf2d801296357bd30d8d3518e4....0.tmp
/data/data/####/0b889c168b327331db4200cce2af4fec0745b3516684c04....0.tmp
/data/data/####/0c708a4ea9a65d467261e11258e8771c
/data/data/####/16cc43660839b8b9d46fcda954851c0bad4fad5f0fa11a0....0.tmp
/data/data/####/1703720991
/data/data/####/19671b8d9f60270845a006feab3a20860d68f8edde1aac1....0.tmp
/data/data/####/1e9c3b8792d0d45daf02d1a54a94d60c8a7b3aa227f60a8....0.tmp
/data/data/####/20453f311ee1fc345de57651f1a9cd66cb625fcc9794a65....0.tmp
/data/data/####/239c5bd6dbb7e3c100afb728db85d03a1082ea5f1f5efd7....0.tmp
/data/data/####/257306020
/data/data/####/257306028
/data/data/####/285d03f590134dab0fd7b095ff3c4e13822182aefba029b....0.tmp
/data/data/####/2f7546a3b2b3df3ebda0e233a9a33c81a4f6a011a1a6056....0.tmp
/data/data/####/30ea001aa5c7308df0cc4c014a21d80dd006fb73b59939e....0.tmp
/data/data/####/3536e2512391c31a633b407d749fc03ed28781b7db2513d....0.tmp
/data/data/####/3e304289cd3b71103d37ee2fb132cfb0037512e71267254....0.tmp
/data/data/####/3e53e955742bfd28cd0febf49c86c3c5
/data/data/####/3e89473faa4cfcdc314ae4bcf1756b1159037302cef4717....0.tmp
/data/data/####/452adc0f1e9975b63833bf7391e5a3ced0596e507c4541d....0.tmp
/data/data/####/453b4961be6b301b8a42370a3f33191d
/data/data/####/46f3194885730bc27861f7f63d65b4f2306c4202807efee....0.tmp
/data/data/####/47b498846bd92eaab1475dd83a6f50776df93cc1478925d....0.tmp
/data/data/####/508f99b573cdbc524f984ab62e08f4a5fa6b0ac42e9e551....0.tmp
/data/data/####/51998ecddb483c544d9ef8a21eb8b9f812a1346c6c02cf9....0.tmp
/data/data/####/51adb891f56f896865b27a4ba0ea221a
/data/data/####/521dcf913fdbafe03f6c14f4d698ccc4985bb0baa209f3e....0.tmp
/data/data/####/5aa00c73ba283ec0860fec9b6319740471b21da091e12ea....0.tmp
/data/data/####/5ab7227ead972f1b7ff6c234be7188eec69e54bb1003e56....0.tmp
/data/data/####/5c0a392ca8caf368d30078cd1886a874074e329195ab9ba....0.tmp
/data/data/####/5c77f90c0b8e9f84427ce435d85e8490
/data/data/####/60902b237da78daa5cfff1e68d96f8913f76748866f9ffb....0.tmp
/data/data/####/614108960
/data/data/####/6164488808ecdfe1bb669cf1488d6e4f
/data/data/####/64e1ff3322d2cccc9f9b7d020e2f1d3f9765fcc06fe2540....0.tmp
/data/data/####/65a53ec1f3baa04cb89562ea3920f8648c60785b5afd580....0.tmp
/data/data/####/6a3a9fe7e958c82c0653a01660441678745d924f89df8d3....0.tmp
/data/data/####/7115a56b634554a215dea44ee35ec98cbb6dbff42b37696....0.tmp
/data/data/####/732b32656703e867717f19d0d1a357d96ba57adb9b1868f....0.tmp
/data/data/####/7352e32c4984c18ed1eb07a8c2df2988d10a9a8dc2a4eeb....0.tmp
/data/data/####/79e971699b0786b687cc7cc971c9b1f8f9daa2ae5ba1853....0.tmp
/data/data/####/7f17aa13225ed7b29193fbcbd55acca95a744420c10ea5c....0.tmp
/data/data/####/8ef7ddbaf7f82e8eed91c1a0fe7a819c36eb040612a79ed....0.tmp
/data/data/####/933978904
/data/data/####/95f21cb14535
/data/data/####/9b1d412450f5e4e95a82bba4f2fa010d78de5fe7b3b0b98....0.tmp
/data/data/####/ImgoPad-journal
/data/data/####/MGTVCommon.xml
/data/data/####/MGTVCommon.xml.bak (deleted)
/data/data/####/MV3Plugin.ini
/data/data/####/MV3Plugin_Default.ini
/data/data/####/QT.xml
/data/data/####/a0220.xml
/data/data/####/a0220.xml.bak
/data/data/####/a022001.xml
/data/data/####/a24b24944caf789b4af928fcc4b172e77de7af40a8c8b9f....0.tmp
/data/data/####/a3d9817df551c10ea2c2c92c3ccd4408303e00e846da834....0.tmp
/data/data/####/a4bbe2c85c409d396c74a50744bbdf40fe67cd303f6ae73....0.tmp
/data/data/####/a7770a65fdd549a7c2d85f9e9de903283335476d7936628....0.tmp
/data/data/####/a93371dd921932297deb26d17afef409
/data/data/####/acd7ebb3e131901b45898453b1d2409f56854d6071e3436....0.tmp
/data/data/####/arch.xml
/data/data/####/b4b4ffe74e9c38e51152407aa063e598f4413c060356f26....0.tmp
/data/data/####/c385.db-journal
/data/data/####/ca96d07d4b9809e0c1395522047b3758
/data/data/####/cbabf44f965ba4fea52181d9d99b6e3295ddf63c52cddea....0.tmp
/data/data/####/cc880db8c804b1ac5556b34f4ea2c5ffaa4fe0848ac1565....0.tmp
/data/data/####/cn.com.mma.mobile.tracking.other.xml
/data/data/####/d58aa1dca9a05ec28a055a3852bbde4399404e1ab4bf176....0.tmp
/data/data/####/d5c4241207ad7804200ee71055bae8d4
/data/data/####/daaf44d5144bbc3c766697feef82956bef3b04780ccaa2e....0.tmp
/data/data/####/e148e233366eeff492b348ca7b7c525d85a6abde567726d....0.tmp
/data/data/####/e1b9f7023dd9604c0bfe4eebd4eeacd74c514d1fe7fdb0a....0.tmp
/data/data/####/e7b5c74b248d2bb50688221386d599e6a0c3494e6bd775c....0.tmp
/data/data/####/e7b5c74b248d2bb50688221386d599e6a0c3494e6bd775c...746f.0
/data/data/####/e931d4f56366eec2652be904933004a7d2631421a8b9a58....0.tmp
/data/data/####/ed4017c9ccc641e99eb9320c9532e1a408fdbbfdc6ef575....0.tmp
/data/data/####/ee864b19de88413af624e22b8f602ef729010a70e698993....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/fa81657809b452aec55667b0a56008f61c5ae1d152cf493....0.tmp
/data/data/####/fc5bd814d8adcd40daf1c15397cf99a8e5375e3d2b5bc53....0.tmp
/data/data/####/fe8b27745da224d2a0e8d6faec4bf49da55e0896c577b92....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hmt_agent_commonutill_com.tianyou.play.kuaikan.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting_com.tianyou.play.kuaikan.xml
/data/data/####/hmt_analytics
/data/data/####/hmt_analytics-journal
/data/data/####/hmt_init_savetime.xml
/data/data/####/hmt_irsuid.xml
/data/data/####/hmt_session_id.xml
/data/data/####/hmt_session_id_savetime.xml
/data/data/####/hmt_session_id_savetime.xml.bak
/data/data/####/hmt_session_id_savetime.xml.bak (deleted)
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/isr.xml
/data/data/####/journal.tmp
/data/data/####/last_know_location.xml
/data/data/####/libjiagu1430661464.so
/data/data/####/multidex.version.xml
/data/data/####/openudid_prefs.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qtsession.xml
/data/data/####/root.db-journal
/data/data/####/run.pid
/data/data/####/tdata_AXX896
/data/data/####/tdata_AXX896.jar
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_IcB528
/data/data/####/tdata_IcB528.jar
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/media/####/.nomedia
/data/media/####/2f2c2f02c1168edadb9b80c2c927d0fd
/data/media/####/5ac331745e7715f7a37161e66bd2c182
/data/media/####/AN.csv-20190411164350
/data/media/####/TruthInfo.csv-1555001031076
/data/media/####/UA.csv-20190411164351
/data/media/####/UnicomTrafficFree.log
/data/media/####/app.db
/data/media/####/b3f793e4b5fa8e9194b3dd5f79132400
/data/media/####/bb5745b286dd68cc55172c6d81c5e418
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.tianyou.play.kuaikan.bin
/data/media/####/com.tianyou.play.kuaikan.db
/data/media/####/dcaf33b4539f916bdd8d151281025a1f
/data/media/####/fcb3926cd183f026ba0b19257b7264fd
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/journal.tmp
/data/media/####/qt.csv.1555001027742.txt
/data/media/####/tdata_AXX896
/data/media/####/tdata_BAI450
/data/media/####/tdata_IcB528
/data/media/####/test.log
/data/media/####/uuid

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25412 300 0
cat /proc/cpuinfo
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
ls -l /system/bin/su
ls -l /system/xbin/su
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25412 300 0

Loads the following dynamic libraries:

getuiext2
libjiagu1430661464

Uses the following algorithms to encrypt data:

AES-CFB-NoPadding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней