Adware.Gexin.20808

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) zxz####.cn:80
TCP(HTTP/1.1) api.map.b####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) loc.map.b####.com:80

DNS requests:

a.appj####.com
api.map.b####.com
loc.map.b####.com
zxz####.cn

HTTP GET requests:

api.map.b####.com/?qt=####&ak=####&callback=####
api.map.b####.com/api?v=####&ak=####
api.map.b####.com/getscript?v=####&ak=####&services=####&t=####
api.map.b####.com/images/blank.gif?product=####&sub_product=####&v=####&...
zxz####.cn/api/Public/update/update.json
zxz####.cn/api/index.php?m=####&c=####&a=####
zxz####.cn/api/index.php?m=####&c=####&a=####&_=####
zxz####.cn/uploads/2019/01/101658004635.jpg
zxz####.cn/uploads/2019/04/101537066895.jpg
zxz####.cn/uploads/2019/10/141717571204.jpg
zxz####.cn/uploads/2020/03/262107382294.jpg
zxz####.cn/uploads/2020/04/171908486486.jpg
zxz####.cn/uploads/2020/05/122140363370.jpg
zxz####.cn/uploads/ad/2020-04-28/5ea7a64dc3d12.jpg
zxz####.cn/uploads/ad/2020-08-08/5f2e4fe374a13.jpg

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
loc.map.b####.com/offline_loc
loc.map.b####.com/sdk.php

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/H5124FCD0.xml
/data/data/####/H5124FCD0_storages.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/firll.dat
/data/data/####/getui_sp.xml
/data/data/####/index
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/pdr.xml
/data/data/####/start_statistics_data.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.cuid
/data/media/####/101537066895.jpg
/data/media/####/101658004635(1).jpg
/data/media/####/101658004635.jpg
/data/media/####/141717571204.jpg
/data/media/####/171908486486.jpg
/data/media/####/262107382294(1).jpg
/data/media/####/262107382294.jpg
/data/media/####/5ea7a64dc3d12.jpg
/data/media/####/5f2e4fe374a13.jpg
/data/media/####/bx-insurance-class.html
/data/media/####/bx-insurance-class.js
/data/media/####/bx-insurance-claus-text.html
/data/media/####/bx-insurance-information-ing-look.html
/data/media/####/bx-insurance-information-ing-look.js
/data/media/####/bx-insurance-new.html
/data/media/####/bx-insurance-new.js
/data/media/####/bx-insurance-notes.html
/data/media/####/bx-insurance-notes.js
/data/media/####/bx-insurance-text-know.html
/data/media/####/bx-insurance.html
/data/media/####/bx-insurance.js
/data/media/####/car.png
/data/media/####/che-car-source-city.html
/data/media/####/che-car-source-city.js
/data/media/####/che-car-source-release.html
/data/media/####/che-car-source-release.js
/data/media/####/che-car-source.html
/data/media/####/che-car-source.js
/data/media/####/city.data-3.js
/data/media/####/city.data.js
/data/media/####/common.js
/data/media/####/conlts.dat
/data/media/####/demo.css
/data/media/####/demo.html
/data/media/####/dt231601837685875.download
/data/media/####/dt241601837685890.download
/data/media/####/dt251601837685892.download
/data/media/####/dt261601837685894.download
/data/media/####/dt271601837685895.download
/data/media/####/dt281601837685897.download
/data/media/####/dt291601837685899.download
/data/media/####/dt301601837685900.download
/data/media/####/dt321601837686095.download
/data/media/####/global.js
/data/media/####/goods-goods-information.html
/data/media/####/goods-goods-information.js
/data/media/####/goods-goods-res.html
/data/media/####/goods-goods-res.js
/data/media/####/goods-goods-source.html
/data/media/####/goods-goods-source.js
/data/media/####/head-ico.png
/data/media/####/head.png
/data/media/####/home-head.png
/data/media/####/home.css
/data/media/####/iconfont.css
/data/media/####/iconfont.eot
/data/media/####/iconfont.svg
/data/media/####/iconfont.ttf
/data/media/####/iconfont.woff
/data/media/####/image.css
/data/media/####/immersed.js
/data/media/####/index.html
/data/media/####/jia.png
/data/media/####/jiashi.png
/data/media/####/jp-car-source-release.html
/data/media/####/jp-car-source-release.js
/data/media/####/jpbz-goods-information.html
/data/media/####/jpbz-goods-information.js
/data/media/####/jpbz-shop.html
/data/media/####/jpbz-shop.js
/data/media/####/jquery-2.1.4.min.js
/data/media/####/ller.dat
/data/media/####/loading.gif
/data/media/####/logo-01.png
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/lxtsz-system-settings.html
/data/media/####/manifest.json
/data/media/####/map.png
/data/media/####/me-background.png
/data/media/####/me-dd-sc-gz-me-follow.html
/data/media/####/me-dd-sc-gz-me-follow.js
/data/media/####/me-dd-sc-gz-me-house.html
/data/media/####/me-dd-sc-gz-me-order.html
/data/media/####/me-dd-sc-gz-me-order.js
/data/media/####/me-dd-sc-gz-me-oreder-information-ing.html
/data/media/####/me-dd-sc-gz-me-oreder-information-ing.js
/data/media/####/me-fb-me-release.html
/data/media/####/me-fb-me-release.js
/data/media/####/mentou.png
/data/media/####/mingpian.png
/data/media/####/mui.css
/data/media/####/mui.js
/data/media/####/mui.min.css
/data/media/####/mui.min.js
/data/media/####/mui.picker.css
/data/media/####/mui.picker.js
/data/media/####/mui.picker.min.js
/data/media/####/mui.poppicker.css
/data/media/####/mui.poppicker.js
/data/media/####/mui.previewimage.js
/data/media/####/mui.ttf
/data/media/####/mui.zoom.js
/data/media/####/pop_up.js
/data/media/####/pp-city.html
/data/media/####/pp-city.js
/data/media/####/public.js
/data/media/####/public_network.js
/data/media/####/publish.html
/data/media/####/publish.js
/data/media/####/push.js
/data/media/####/qita.png
/data/media/####/share.js
/data/media/####/shareApp.js
/data/media/####/shenfenzheng1.png
/data/media/####/shenfenzheng2.png
/data/media/####/shuiwu.png
/data/media/####/sy-bbs-Post.html
/data/media/####/sy-bbs-Post.js
/data/media/####/sy-qt-bbs.html
/data/media/####/sy-qt-bbs.js
/data/media/####/sy-qt-home-city-2.html
/data/media/####/sy-qt-home-city.html
/data/media/####/sy-qt-home-city.js
/data/media/####/sy-qt-home-selectCity.js
/data/media/####/sy-qt-home.html
/data/media/####/sy-qt-home.js
/data/media/####/sy-qt-main-body.html
/data/media/####/sy-qt-main-body.js
/data/media/####/sy-qt-me-data-editing-me-company.html
/data/media/####/sy-qt-me-data-editing-me-company.js
/data/media/####/sy-qt-me-login-alter.html
/data/media/####/sy-qt-me-login-alter.js
/data/media/####/sy-qt-me-login-zc.html
/data/media/####/sy-qt-me-login-zc.js
/data/media/####/sy-qt-me-login.html
/data/media/####/sy-qt-me-login.js
/data/media/####/sy-qt-me.html
/data/media/####/sy-qt-news-text.html
/data/media/####/sy-qt-news.html
/data/media/####/sy-qt-news.js
/data/media/####/sy-qt-pay-deposit-2.html
/data/media/####/sy-qt-pay-deposit-2.js
/data/media/####/sy-qt-pay-deposit.html
/data/media/####/sy-qt-pay-deposit.js
/data/media/####/sy-qt-pay-refund.html
/data/media/####/sy-qt-pay-refund.js
/data/media/####/test.0
/data/media/####/tiaokuan.html
/data/media/####/update.js
/data/media/####/update.json
/data/media/####/updateAuto.js
/data/media/####/xingshi.png
/data/media/####/xtsz-about-us.html
/data/media/####/xtsz-feedbac.html
/data/media/####/xtsz-system-settings.html
/data/media/####/xtsz-system-settings.js
/data/media/####/xtsz-use-protocol.html
/data/media/####/ye-jf-address-add.html
/data/media/####/ye-jf-address-add.js
/data/media/####/ye-jf-address-manage.html
/data/media/####/ye-jf-address-manage.js
/data/media/####/ye-jf-balance-integral.html
/data/media/####/ye-jf-balance-integral.js
/data/media/####/ye-jf-check-information.html
/data/media/####/ye-jf-check-information.js
/data/media/####/ye-jf-exchange-prizes-record.html
/data/media/####/ye-jf-exchange-prizes-record.js
/data/media/####/ye-jf-exchange-prizes.html
/data/media/####/ye-jf-exchange-prizes.js
/data/media/####/ye-jf-push-advertising.html
/data/media/####/ye-jf-recharge.html
/data/media/####/ye-jf-withdraw-deposit.html
/data/media/####/ye-jf-withdraw-deposit.js
/data/media/####/yingye.png
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat
/data/media/####/zbfw-address.html
/data/media/####/zbfw-address.js
/data/media/####/zbfw-peripheral-service-list-information.html
/data/media/####/zbfw-peripheral-service-list-information.js
/data/media/####/zbfw-peripheral-service-list.html
/data/media/####/zbfw-peripheral-service-list.js
/data/media/####/zbfw-peripheral-service.html
/data/media/####/zbfw-peripheral-service.js
/data/media/####/zx-car-source-release.html
/data/media/####/zx-special-list-.html
/data/media/####/zx-special-list.html
/data/media/####/zx-special-list.js
/data/media/####/zx-special-release-2.html
/data/media/####/zx-special-release-2.js
/data/media/####/zx-special-release.html

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

getuiext2
libjiagu
locSDK6a

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about phone status (number, IMEI, etc.).

Gets information about running apps.

Displays its own windows over windows of other apps.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней