Adware.Gexin.20569

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) tinychi####.q####.com.####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(TLS/1.0) gw.kefan####.com:18110
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) grs.dbankc####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) 74.1####.205.95:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) gw.kefan####.com:18071
TCP(TLS/1.0) 1####.217.168.202:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.194.221.94:443
TCP(TLS/1.2) 1####.217.168.202:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.g####.com:5225
TCP 74.1####.205.95:443

DNS requests:

7j####.c####.z0.####.com
and####.cli####.go####.com
android####.go####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.g####.com
grs.dbankc####.com
gw.kefan####.com
instant####.google####.com
l####.tbs.qq.com
log.u####.com
md####.google####.com
norma-e####.m####.com
oss-cn-####.aliy####.com
p####.google####.com
plb####.u####.com
sdk-ope####.g####.com
sdk.c####.g####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

norma-e####.m####.com/android/exchange/getpublickey.do
ti####.c####.l####.####.com/tdata_LRe817
tinychi####.q####.com.####.com/config/hzv9.conf

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
norma-e####.m####.com/push/android/external/add.do
sdk-ope####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.cl
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/KFPushClient.xml
/data/data/####/cec4a1a0cf8b612f74c38caab6d3daf2.0
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.oat
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.2.xml
/data/data/####/core_info
/data/data/####/dW1weF9zaGFyZV8xNTkzNTE3ODY1NTIx;
/data/data/####/dW1weF9zaGFyZV8xNTkzNTE3ODY2NDc0;
/data/data/####/getui_sp.xml
/data/data/####/hms_global_v2_com.mjb.kefang.xml
/data/data/####/imKit.db-journal
/data/data/####/im_shared_txt.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/libjiagu.so
/data/data/####/mjbIMSystem.xml
/data/data/####/mz_push_preference.xml
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/push_client_self_info.xml
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/share.db-journal
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.mjb.kefang.bin
/data/media/####/com.mjb.kefang.db
/data/misc/####/primary.prof
/data/user_de/####/aaid.xml
/data/user_de/####/grs_move2DE_records.xml
/data/user_de/####/move_to_de_records.xml
/data/user_de/####/share_pre_grs_conf_com.mjb.kefang.xml
/data/user_de/####/share_pre_grs_conf_com.mjb.kefang.xml.bak
/data/user_de/####/zoo.xml

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes4.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
getprop ro.product.cpu.abi

Uses the following algorithms to encrypt data: