Adware.Gexin.21078

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) o####.map.b####.com:80
TCP(HTTP/1.1) c.appj####.com:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) d####.opensp####.cn:80
TCP(HTTP/1.1) h####.opensp####.cn:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) qy-swa####.qi####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.217.17.46:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.2) 1####.250.179.195:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) 1####.217.17.46:443
TCP sdk.o####.t####.####.com:5224
TCP sdk.o####.t####.####.net:5224

DNS requests:

and####.b####.qq.com
and####.google####.com
android####.go####.com
api.map.b####.com
c.appj####.com
cm-1####.g####.com
cm-1####.g####.com
d####.opensp####.cn
f####.x####.cn
f####.x####.cn.####.8
h####.opensp####.cn
instant####.google####.com
loc.map.b####.com
md####.google####.com
o####.map.b####.com
p####.google####.com
qy-swa####.qi####.com
sdk.c####.g####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

d####.c####.l####.####.com/config/hzv9.conf
h####.opensp####.cn/launchconfig?t=####&p=b25lL####

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
c.appj####.com/ad/splash/stats.html
d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
loc.map.b####.com/sdk.php
o####.map.b####.com/offline_loc

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/XZLandlady.xml
/data/data/####/ad_show_time.xml
/data/data/####/authStatus_com.xizhi.mezone.b.xml
/data/data/####/authStatus_com.xizhi.mezone.b;core.xml
/data/data/####/authStatus_com.xizhi.mezone.b;pushservice.xml
/data/data/####/authStatus_com.xizhi.mezone.b;remote.xml
/data/data/####/b21278f2682c5b0998f36948131ed8adf5accda137fe72e...3fdb.0
/data/data/####/bugly_db_-journal
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/classes3.dex
/data/data/####/com.iflytek.msc.xml
/data/data/####/com.qiyukf.analytics.xml
/data/data/####/com.qiyukf.analytics.xml.bak
/data/data/####/crashrecord.xml
/data/data/####/firll.dat
/data/data/####/gal.db
/data/data/####/gal.db-journal
/data/data/####/getui_sp.xml
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/ifly_launch_lib.xml
/data/data/####/ifly_launch_lib.xml.bak
/data/data/####/ifly_launch_lib.xml.bak (deleted)
/data/data/####/iflytek_state_com.xizhi.mezone.b.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/mac.xml
/data/data/####/native_record_lock (deleted)
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/okgo_cache.db
/data/data/####/okgo_cache.db-journal
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qiyu_save_ffe6600f40067cfc7e518d0cefe0b228.xml
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/unicorn#cheese#
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/com.xizhi.mezone.b.bin
/data/media/####/conlts.dat
/data/media/####/iflyworkdir_test
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/tmp_c_20210501
/data/media/####/tmp_u_20210501
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes2.dex --dex-file=<Package Folder>/.jiagu/classes3.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/sh -c type su
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
getprop

Uses the following algorithms to encrypt data: