Adware.Gexin.12219

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.lingha####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) va####.c####.qini####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

DNS requests:

7j####.c####.z0.####.com
c####.g####.ig####.com
c-h####.g####.com
l####.tbs.qq.com
lingha####.com
log.u####.com
plb####.u####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
u####.u####.com
www.lingha####.com

HTTP GET requests:

t####.c####.q####.####.com/config/hz-hzv6.conf
t####.c####.q####.####.com/tdata_FhD658
t####.c####.q####.####.com/tdata_ngv385
t####.c####.q####.####.com/tdata_oAh725
t####.c####.q####.####.com/tdata_vHH584
va####.c####.qini####.com/lhdj153.apk
www.lingha####.com/upload/201810231.jpg
www.lingha####.com/upload/201810232.jpg
www.lingha####.com/upload/201810233.jpg
www.lingha####.com/upload/39366208.jpg
www.lingha####.com/upload/50332998.jpg
www.lingha####.com/upload/51233557.jpg
www.lingha####.com/upload/51369284.jpg
www.lingha####.com/upload/51510643.jpg
www.lingha####.com/upload/61094835.jpg
www.lingha####.com/upload/78670837.jpg
www.lingha####.com/upload/91185800.jpg

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
l####.tbs.qq.com/ajax?c=####&k=####
sdk-ope####.g####.com/api.php?format=####&t=####
www.lingha####.com/home_move/article_list
www.lingha####.com/home_move/getVersionUpdate
www.lingha####.com/home_move/menus

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0a9d3d9fd152c103a22065b64712282e8a6f3586dad2c7c....0.tmp
/data/data/####/0ceb075d582ed0e55e23c79f0b46f0580faac946e10b069....0.tmp
/data/data/####/139a9313b4261d4e9fc478325f6448a737a57ebb113934a....0.tmp
/data/data/####/2614fb8cfeb3291d1d6cede636f49a1a869c64acca56f51....0.tmp
/data/data/####/319ba1ef5a5d555a95365d558859dbfe181f4c89eb5904d....0.tmp
/data/data/####/5bb146cc1ba4a2983b2601d34106d40739d2c250d85e9d6....0.tmp
/data/data/####/760e41368e0da24d3d01952b2097c4b9358446899cdebf6....0.tmp
/data/data/####/8872a0a1220edb982f478f1047420582a4934f3559562a3....0.tmp
/data/data/####/94e92c8ea26e062bb5d9e4dce1fde16a9d12cb1d8a62207....0.tmp
/data/data/####/ClassicsHeader.xml
/data/data/####/MultiDex.lock
/data/data/####/a==7.5.0&&1.5.2_1555062601654_envelope.log
/data/data/####/c9066818336af8301838fe49682238d6b744b69e6a9e8ab....0.tmp
/data/data/####/cf4e8beeeab2a364cb71f048e4a541faf33f18f400fde29....0.tmp
/data/data/####/core_info
/data/data/####/dW1weF9zaGFyZV8xNTU1MDYyNjAxODQ2;
/data/data/####/dW1weF9zaGFyZV8xNTU1MDYyNjAxODk5;
/data/data/####/device_id.xml.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu-363291294.so
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/share.db-journal
/data/data/####/system_setting.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_FhD658
/data/data/####/tdata_FhD658.jar
/data/data/####/tdata_ngv385
/data/data/####/tdata_ngv385.jar
/data/data/####/tdata_oAh725
/data/data/####/tdata_oAh725.jar
/data/data/####/tdata_vHH584
/data/data/####/tdata_vHH584.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/media/####/.nomedia
/data/media/####/app.db
/data/media/####/com.emof.party.building.bin
/data/media/####/com.emof.party.building.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tdata_FhD658
/data/media/####/tdata_ngv385
/data/media/####/tdata_oAh725
/data/media/####/tdata_vHH584
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.manager.service.GPushService 25286 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop ro.product.cpu.abi
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.manager.service.GPushService 25286 300 0

Loads the following dynamic libraries: