Adware.Gexin.12222

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) jc####.jingche####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80

DNS requests:

jc####.jingche####.com
localh####
sdk.o####.p####.####.com

HTTP GET requests:

jc####.jingche####.com//upload/thumb/0a173bea86a70ecf1681ae7a48e9d7ea.png
jc####.jingche####.com//upload/thumb/185ec53c85dbc6a4775fe38d728382d8.png
jc####.jingche####.com//upload/thumb/1c8854d0966e33465b8e71f483ce5272.png
jc####.jingche####.com//upload/thumb/33aedb7550dbf8941557b03c778ad6cf.png
jc####.jingche####.com//upload/thumb/458b94e01a3a4e79b234bfc124bdd96f.png
jc####.jingche####.com//upload/thumb/6c0ff09e8dcd4b8dd28fed655b093f2b.png
jc####.jingche####.com//upload/thumb/8075fd0be1500e0943ca19b34b7f7f70.png
jc####.jingche####.com//upload/thumb/90e04611bc2e283fcca9be44fbecc5a2.png
jc####.jingche####.com//upload/thumb/d5c2ee7bf23e6a682e0019aa1ddcbd60.png
jc####.jingche####.com//upload/thumb/f576b74c3326fc1ec65babbbfaca23fa.png
jc####.jingche####.com/upload/other/5ec65ee074d3a80cd41819ae67684ab9.png
jc####.jingche####.com/upload/other/image/2019-03-14/5c89fc754d9d3.jpg
jc####.jingche####.com/upload/other/image/20190321155313398177.jpg
jc####.jingche####.com/upload/other/image/20190331155400857643.png
jc####.jingche####.com/upload/other/image/20190331155400942557.png
jc####.jingche####.com/upload/other/image/20190410155486614442.jpg
jc####.jingche####.com/upload/other/image/20190410155486614466.jpg
jc####.jingche####.com/upload/other/image/20190410155486614493.jpg
jc####.jingche####.com/upload/other/image/20190411155495186783.jpg
jc####.jingche####.com/upload/other/image/20190412155503830537.jpg

HTTP POST requests:

jc####.jingche####.com/Bbs/Api/get_bbs_category_list
jc####.jingche####.com/Bbs/Api/get_hot_keys
jc####.jingche####.com/Bbs/Api/page_list
jc####.jingche####.com/Exhibition/Api/get_exhibition_info
jc####.jingche####.com/Exhibition/Api/has_exhibition
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/07634f369b5347b250dbe170cfec2ae8be6e0c16ede87bf....0.tmp
/data/data/####/117855bba6276bb7436e0a1c635881c0230a464fa8d7069....0.tmp
/data/data/####/1b97c86fe0d672a901cbe44841c3722a5144f46d44523e7....0.tmp
/data/data/####/2455c0f65a60f02934ca4976727506567785fdba21a3052....0.tmp
/data/data/####/285bb8fa055b543dc5f5d81358ff4cd415a01ad95c81cdb....0.tmp
/data/data/####/2e70750a8168a0d58d6eca6162be3656134e0012e36d812....0.tmp
/data/data/####/39a857365e00acc67bd6ac2de1b137339a3dba4662bfae1....0.tmp
/data/data/####/4185b77bf384ed81c0a221af4dde940f0fa3940f3152220....0.tmp
/data/data/####/4c45778d328248e84d8fd1844d00d58f5f5e648e6629c2c....0.tmp
/data/data/####/4f2ec35e4e736fe390b9f7ac5d2eb53c2a979d0ee9a848d....0.tmp
/data/data/####/521c13c2d6b49b113f56bcdfbde5f0e0fd5f8ea3459be1f....0.tmp
/data/data/####/52da1879efbb6c25950c3b4aa2d3078717207bec1afeb4b....0.tmp
/data/data/####/58fce434fbdceac4b2dbe60045e85606610e3adb1d19881....0.tmp
/data/data/####/603ad65bb589b6d0c79609a3b8b587b17d2c74036235382....0.tmp
/data/data/####/6c4ba03ffcc19998ac510b8d55c66d474dc9bedad001d85....0.tmp
/data/data/####/74c8a833d10e97f1330e057ec524a2a17481d2877a251fe....0.tmp
/data/data/####/77285c2a76d890a9b2bee05a55402d4120b7cb8bb49c499....0.tmp
/data/data/####/7e3db60b261ffa40d050bff36b0a45461e33e5a78b7c516....0.tmp
/data/data/####/8302248c72c9479ed196511a2c7c7eb649747babb431b8f....0.tmp
/data/data/####/9415d4c27ade8136afb1592a86723e54e209987e5aaa4fc....0.tmp
/data/data/####/9825ec1935394a52faf03222cb71006ad60daaac7ae0534....0.tmp
/data/data/####/9d21383dda8e06ff0ceeb72ba19a88c2941530ed10eb644....0.tmp
/data/data/####/BMWEEXOPEN_JS_SP.xml
/data/data/####/BMWEEXOPEN_NATIVE_SP.xml
/data/data/####/CookiePrefsFile.xml
/data/data/####/MultiDex.lock
/data/data/####/a2cc9db26375c9027957a153e80507d8a8acdba3adf2b7c....0.tmp
/data/data/####/a39c7db94350e809aece83f64c0f23e2f4204fccdfc043d....0.tmp
/data/data/####/a5d789589a474ad857b0142e70bcc76299d2a672ec0ca09....0.tmp
/data/data/####/aabc3c49c9679e5c0e089470bcf91a492ad4723081a16d5....0.tmp
/data/data/####/acebeb5a527ae6b2dbda9a9b37e826bacc7c0b97e2109aa....0.tmp
/data/data/####/ad05864b1890f7850d934f2f8e94fcd831672eac5cd544d....0.tmp
/data/data/####/bbc0eb70c7d10d92a22c818ed019f612e4e399c6aea0721....0.tmp
/data/data/####/bc481d9c81111bc9beda7d1cf5aedafb4d44f6b6fdd1620....0.tmp
/data/data/####/cdfe64da9b5a983b48ae7f55429ceaca8ac675d1082e3cd....0.tmp
/data/data/####/e452723e2b3d143bbdd38cdb96b6c2566c2785ab98d9792....0.tmp
/data/data/####/e6ffe63e9e15e03b59ea486992781a262f3808345c47f59....0.tmp
/data/data/####/e83a766a0ed7340d3219d07b3d7acb8e955fa06ad46800a....0.tmp
/data/data/####/eb6eca2e9d8eb39e333bc8f00941b81cb599cb7326c5b61....0.tmp
/data/data/####/ed8bbf812c9e66b51d92c76d3338c98fdaaacf44d78ecc8....0.tmp
/data/data/####/eea956274e68023ca6769e51cb81a21af4d1632487f71cc....0.tmp
/data/data/####/f5030c603709a5a3567b1584ee855563346b8820d9b3f83....0.tmp
/data/data/####/f80d823fedb6c7d56c3eeaafb1f6b58092bb29d3aa44c91....0.tmp
/data/data/####/f8c6fc5bd222c3251324c1b227bc810db6ecf0ed52988ef....0.tmp
/data/data/####/fc489301e5baadf1c6040f8af5a1d9dddc7d4ec5c5648ba....0.tmp
/data/data/####/fcdac8530ac94c606deb6538d3aa193ea5aeea998ecc87a....0.tmp
/data/data/####/getui_sp.xml
/data/data/####/init_c1.pid
/data/data/####/init_er.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu776641687.so
/data/data/####/libweexjsb.so
/data/data/####/multidex.version.xml
/data/media/####/1@2x.png
/data/media/####/2@2x.png
/data/media/####/Path.png
/data/media/####/addvideo.jpg
/data/media/####/back@2x.png
/data/media/####/bf@2x.png
/data/media/####/bm-chart.html
/data/media/####/bm@2x.png
/data/media/####/bmap.min.js
/data/media/####/bundle.zip
/data/media/####/ck_t@2x.png
/data/media/####/d1@2x.png
/data/media/####/d2@2x.png
/data/media/####/d3@2x.png
/data/media/####/d_tx@2x.png
/data/media/####/da_x@2x.png
/data/media/####/danwei.png
/data/media/####/dark_del@2x.png
/data/media/####/data@2x.png
/data/media/####/demo.jpg
/data/media/####/dt@2x.png
/data/media/####/dz_s@2x.png
/data/media/####/echarts.min.js
/data/media/####/empty_data@2x.png
/data/media/####/fanhui@2x.png
/data/media/####/fh_1@2x.png
/data/media/####/font_1469606063_76593.ttf
/data/media/####/font_1469606522_9417143.woff
/data/media/####/font_zn5b3jswpofuhaor.ttf
/data/media/####/fs_1@2x.png
/data/media/####/gb@2x.png
/data/media/####/gb_t1@2x.png
/data/media/####/h_Z@2x.png
/data/media/####/h_sc@2x.png
/data/media/####/hd@2x.png
/data/media/####/hh_1@2x.png
/data/media/####/hs_11@2x.png
/data/media/####/iconfont-eros.ttf
/data/media/####/iconfont.ttf
/data/media/####/img1@2x.png
/data/media/####/img_3@2x.png
/data/media/####/img_4@2x.png
/data/media/####/index.js
/data/media/####/item_img.jpg
/data/media/####/jj@2x.png
/data/media/####/jt1@2x.png
/data/media/####/jt2@2x.png
/data/media/####/jt_d@2x.png
/data/media/####/logo@2x.png
/data/media/####/logoNew@2x.png
/data/media/####/lw@2x.png
/data/media/####/md5.json
/data/media/####/more@2x.png
/data/media/####/nt_tt@2x.png
/data/media/####/path@2x.png
/data/media/####/pl_b@2x.png
/data/media/####/pl_t1@2x.png
/data/media/####/pl_t@2x.png
/data/media/####/prople@2x.png
/data/media/####/pyq@2x.png
/data/media/####/r_jt@2x.png
/data/media/####/s_c@2x.png
/data/media/####/sc_l@2x.png
/data/media/####/sc_t@2x.png
/data/media/####/sch@2x.png
/data/media/####/search@2x.png
/data/media/####/searchImg@2x.png
/data/media/####/sh_1@2x.png
/data/media/####/shipin1@2x.jpg
/data/media/####/shipin@2x.jpg
/data/media/####/sj_v@2x.png
/data/media/####/sj_v_sj@2x.png
/data/media/####/sp@2x.jpg
/data/media/####/ss_11@2x.png
/data/media/####/ss_hy@2x.png
/data/media/####/sz_h@2x.png
/data/media/####/sz_h_sz@2x.png
/data/media/####/tj_b@2x.png
/data/media/####/tj_bt1@2x.png
/data/media/####/tj_bt@2x.png
/data/media/####/tj_t@2x.png
/data/media/####/tx@2x.png
/data/media/####/tx_k.png
/data/media/####/tx_k2@2x.png
/data/media/####/tx_k@2x.png
/data/media/####/tx_z@2x.png
/data/media/####/v.png
/data/media/####/v1.png
/data/media/####/v1@2x.png
/data/media/####/v2@2x.png
/data/media/####/v3@2x.png
/data/media/####/w_dz@2x.png
/data/media/####/w_pl@2x.png
/data/media/####/w_sc@2x.png
/data/media/####/wd_11@2x.png
/data/media/####/wd_1@2x.png
/data/media/####/wh_1@2x.png
/data/media/####/ws_11@2x.png
/data/media/####/wx1_@2x.png
/data/media/####/wx@2x.png
/data/media/####/wz_img@2x.jpg
/data/media/####/x_tx@2x.png
/data/media/####/yq_r@2x.png
/data/media/####/yy_zz@2x.png
/data/media/####/z_h@2x.png
/data/media/####/z_l@2x.png
/data/media/####/za_s@2x.png
/data/media/####/zhengmingsf.png
/data/media/####/zm@2x.png
/data/media/####/zq@2x.png

Miscellaneous:

Executes the following shell scripts:

/data/app-lib/<Package>-1/libweexjsb.so 49 0
/data/app-lib/<Package>-1/libweexjsb.so 50 0

Loads the following dynamic libraries:

Patcher
getuiext2
libjiagu776641687
weexjsc

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней