Adware.Gexin.6641

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) analy####.ray####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) fk-k8s-####.ray####.com:80
TCP(TLS/1.0) d1qtxr7####.cloudf####.net:443
TCP(TLS/1.0) a####.i####.pw:443
TCP(TLS/1.0) s####.945####.com.####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) rep####.crashly####.com:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) a.d####.icu:443
TCP(TLS/1.0) 1####.217.17.110:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) avnight####.f####.myqc####.com:443
TCP(TLS/1.0) sdk.adti####.com:443
TCP c####.g####.ig####.com:5227
TCP sdk.o####.t####.####.com:5224

DNS requests:

7j####.c####.z0.####.com
a####.b####.qq.com
a####.i####.pw
a.d####.icu
aexcep####.b####.qq.com
analy####.ray####.com
and####.b####.qq.com
avnight####.f####.myqc####.com
c####.g####.ig####.com
c####.g####.ig####.com
c-h####.g####.com
d1qtxr7####.cloudf####.net
e.crashly####.com
m.adti####.com
rep####.crashly####.com
s####.945####.com
sdk.adti####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
set####.ray####.com
sett####.crashly####.com
ssl.google-####.com

HTTP GET requests:

fk-k8s-####.ray####.com/rewardsetting?app_id=####&sign=####&channel=####...
fk-k8s-####.ray####.com/setting?app_id=####&sign=####&channel=####&platf...
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_iGj879
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
analy####.ray####.com/
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BBeginSession.json
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BSessionApp.json
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BSessionOS.json
/data/data/####/5C174E5802A5-0001-08E8-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E590366-0001-0923-D784E4D40E2B.cls
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BBeginSession.json
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionApp.json
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionCrash.cls_temp
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionOS.json
/data/data/####/5C174E590366-0001-0923-D784E4D40E2BSessionUser....leted)
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BBeginSession.cls
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BBeginSession.json
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BSessionApp.cls
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BSessionApp.json
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BSessionOS.cls
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BSessionOS.json
/data/data/####/5C174E6002B5-0002-08E8-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2B.cls_temp
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BBeginSession.json
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionApp.json
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionCrash.cls_temp
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionOS.json
/data/data/####/5C174E6203DD-0001-09FD-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BBeginSession.json
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BSessionApp.json
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BSessionOS.json
/data/data/####/5C174E680323-0002-09FD-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2B.cls_temp
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BBeginSession.json
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionApp.json
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionCrash.cls_temp
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionOS.json
/data/data/####/5C174E6C0321-0001-0AB4-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BBeginSession.json
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BSessionApp.json
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BSessionOS.json
/data/data/####/5C174E7201F6-0002-0AB4-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2B.cls_temp
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BBeginSession.json
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionApp.json
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionCrash.cls_temp
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionOS.json
/data/data/####/5C174E760073-0001-0B64-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BBeginSession.json
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BSessionApp.json
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BSessionOS.json
/data/data/####/5C174E7B028F-0002-0B64-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2B.cls_temp
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BBeginSession.json
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionApp.json
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionCrash.cls_temp
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionOS.json
/data/data/####/5C174E7D0191-0001-0BFF-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BBeginSession.json
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BSessionApp.json
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BSessionOS.json
/data/data/####/5C174E840145-0002-0BFF-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2B.cls_temp
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BBeginSession.json
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionApp.json
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionCrash.cls_temp
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionOS.json
/data/data/####/5C174E86003C-0001-0CAA-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BBeginSession.json
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BSessionApp.json
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BSessionOS.json
/data/data/####/5C174E8C006E-0002-0CAA-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2B.cls_temp
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BBeginSession.json
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionApp.json
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionCrash.cls_temp
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionOS.json
/data/data/####/5C174E8E0245-0001-0D5F-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BBeginSession.json
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BSessionApp.json
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BSessionOS.json
/data/data/####/5C174E940162-0002-0D5F-D784E4D40E2BSessionUser.cls_temp
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BBeginSession.cls_temp
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BBeginSession.json
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BSessionApp.cls_temp
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BSessionApp.json
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BSessionDevice.cls_temp
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BSessionDevice.json
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BSessionOS.cls_temp
/data/data/####/5C174E9901E9-0001-0E06-D784E4D40E2BSessionOS.json
/data/data/####/MultiDex.lock
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/UUID.xml
/data/data/####/announce.xml
/data/data/####/bugly_db_legu-journal
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.google.android.gms.analytics.prefs.xml
/data/data/####/core.xml
/data/data/####/crash_log_sp.xml
/data/data/####/crash_marker
/data/data/####/gaClientId
/data/data/####/getui_sp.xml
/data/data/####/google_analytics_v4.db-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.l.xml
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.2.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/mobvista.msdk.db-journal
/data/data/####/mobvista.xml
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sa_4f6421f4-7764-4f3d-a083-9d8ad4c6c02b_1545031321792.tap
/data/data/####/sa_60b59641-d190-4656-bbc9-e2051532837c_1545031311391.tap
/data/data/####/sa_6183f6f5-ae00-48d7-b360-44bb3231795f_1545031259110.tap
/data/data/####/sa_81cec804-bb1a-4aa3-89cf-674ad9d9a60b_1545031276965.tap
/data/data/####/sa_9ad78bfc-a918-4b23-8539-cb914fd6fc34_1545031259080.tap
/data/data/####/sa_acda74fe-14be-49c2-b79e-521f67be0004_1545031267262.tap
/data/data/####/sa_c84aa7d6-0ef5-43c6-96eb-8e5383febe39_1545031286659.tap
/data/data/####/sa_ce920932-ec75-4f9d-82ac-5651ca8554e5_1545031257892.tap
/data/data/####/sa_fd2a8b0d-e0f9-480a-aaea-c21177d28754_1545031293663.tap
/data/data/####/sa_fd8e9979-c2a8-4de0-87e9-fc439c207348_1545031303077.tap
/data/data/####/security_info
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap (deleted)
/data/data/####/session_analytics.tap.tmp
/data/data/####/share_date.xml
/data/data/####/shell_config
/data/data/####/uij
/data/media/####/.nomedia
/data/media/####/app.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/tv.i999.bin
/data/media/####/tv.i999.db

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime

Loads the following dynamic libraries:

Bugly
getuiext2
libnfix
libshella-2.9.0.2
libufix
nfix
ufix

Uses the following algorithms to encrypt data:

AES
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial