Adware.Gexin.19789

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) log.sn####.com.####.net:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) cfg.a####.com:80
TCP(HTTP/1.1) midu-lo####.1####.com:80
TCP(TLS/1.0) qfc.innot####.com:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) t.hy####.com.cn:443
TCP(TLS/1.0) log.sn####.com.####.net:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) is.sn####.com:443
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) ddd.1####.com:443
TCP(TLS/1.0) api-pla####.1####.com:443
TCP(TLS/1.0) cdn.a####.com.####.com:443
TCP(TLS/1.0) api.miduka####.com:443
UDP 1####.0.1.1:137

DNS requests:

and####.b####.qq.com
api-pla####.1####.com
api.miduka####.com
cdn.a####.com
cfg.a####.com
ddd.1####.com
hx.beila####.com
img.miduka####.com
is.sn####.com
log.sn####.com
midu-lo####.1####.com
mo####.b####.com
plb####.u####.com
qfc.innot####.com
qfy.innot####.com
rcv.a####.com
res####.a####.com
t.hy####.com.cn
u####.u####.com
upd####.a####.com

HTTP GET requests:

cfg.a####.com/reqMotPkgLst
log.sn####.com.####.net/browser/midu_tingshu/voiceresource.zip

HTTP POST requests:

and####.b####.qq.com/rqd/async
cfg.a####.com/req?aid=####
log.sn####.com.####.net/service/2/app_log_exception/?openudid=####&versi...
midu-lo####.1####.com/

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1585791535782
/data/data/####/1585791543066
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/FotmatFa1538123679034.xml
/data/data/####/HMTAGENT_INFO.xml
/data/data/####/MultiDex.lock
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/T1THyDwNNm9obrQLnK6O-UEFHXTPwOtg
/data/data/####/T2-ANpoUOvRFPeg8cb0OkUcwiL-0sJPF
/data/data/####/T32RRbc4ROFi6YU0z4wRqE-PvS2LVgRj
/data/data/####/T3_0Gd2qGZGlNspitru8okeUQn9R9D-x
/data/data/####/T3dIe_8DGlSGoJgwAYWvkkXorytC7hYf
/data/data/####/T4GoPOmQfGUmCsCTbKXDuUbcLJ_FodFL
/data/data/####/T59EZ_sjrQjpSEnILbzjnkqoCbHYlFXI
/data/data/####/T89ZOJcjj2x998fYs7U-m0N32V1EmlVp
/data/data/####/T8vJF5L1TEWBgs3JtqeDY0m2YKYJ48pr
/data/data/####/Tx2ZDz7ybkTlIxEst6vC80zuf1IMK7f3
/data/data/####/TxCA8i_tGHQWEH2Ec5lk1kPgJtU2w7Jz
/data/data/####/TyPFLbmJGeFwlg5ZPZy2n0vFcIsuvJ7C
/data/data/####/TycO1E2ONZ862fKEyIfn4knTxGSa-avx
/data/data/####/TzN1V-m3QeRSWCGN_4is10NNZBcl97CB
/data/data/####/TzlB9nOArsKj8G7kVLpnPEEr5EylV7ul
/data/data/####/YD_SP.xml
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/a==7.5.3&&3.1.9.0420.1913_1585791549116_envelope.log
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/app_icon_logo.png
/data/data/####/bd_etts_common_speech_as_mand_eng_high_am_v3.0....16.dat
/data/data/####/bd_etts_common_speech_f7_mand_eng_high_am-mix_v...12.dat
/data/data/####/bd_etts_common_speech_m15_mand_eng_high_am-mix_...05.dat
/data/data/####/bd_etts_common_speech_yyjw_mand_eng_high_am-mix...12.dat
/data/data/####/bd_etts_text.dat
/data/data/####/bugly_db_-journal
/data/data/####/c0586a10777146560765a69231d89beb.xml
/data/data/####/cmd_data_tracker_v2.db
/data/data/####/cmd_data_tracker_v2.db-journal
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.lechuan.midunovel.xml
/data/data/####/com.lechuan.midunovel.xml.bak
/data/data/####/com.lechuan.midunovel.xml.bak (deleted)
/data/data/####/com.lechuan.midunovel_preference.xml
/data/data/####/config.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTg1NzkxNTQ1NzY4;
/data/data/####/data_tracker_v2.db
/data/data/####/data_tracker_v2.db-journal
/data/data/####/downloader.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/finch.db-journal
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/hmt_agent_commonutill_com.lechuan.midunovel.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting.xml
/data/data/####/hmt_analytics
/data/data/####/hmt_analytics-journal
/data/data/####/hmt_init_savetime.xml
/data/data/####/hmt_irsuid.xml
/data/data/####/hmt_session_id_savetime.xml
/data/data/####/i==1.2.0&&3.1.9.0420.1913_1585791546126_envelope.log
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/libjiagu1149782120.so
/data/data/####/libquid.so
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/midu.db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/okgo.db-journal
/data/data/####/openudid_prefs.xml
/data/data/####/pref.xml
/data/data/####/pref.xml.bak
/data/data/####/pref.xml.bak (deleted)
/data/data/####/qk_app.xml
/data/data/####/security_info
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/voiceresource.zip
/data/media/####/-1083719484
/data/media/####/.2e1b3.cuid
/data/media/####/.301d5.cuid2
/data/media/####/.801ab.cuid
/data/media/####/.91916.cuid
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.com.jifen.ac.ReportCount
/data/media/####/.com.jifen.ac.cuid
/data/media/####/.com.jifen.ac.cuid2
/data/media/####/.e8b74.cuid2
/data/media/####/.nomedia
/data/media/####/.quid
/data/media/####/.umm.dat
/data/media/####/1585791546354.db
/data/media/####/598208925bcf5114bf82889f3c51f1e0
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/config.txt
/data/media/####/crash2020-04-02 04;38;55.txt
/data/media/####/crash2020-04-02 04;39;02.txt

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/netcfg
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
getprop net.hostname
getprop ro.board.platform
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.serialno
getprop ro.vivo.os.build.display.id
ifconfig
ls -i
ls -l
ls /
ls /sys/class/thermal
ps
sh
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd <SD-Card>/ && ls -i
sh <Package Folder>/files/T1THyDwNNm9obrQLnK6O-UEFHXTPwOtg
sh <Package Folder>/files/T2-ANpoUOvRFPeg8cb0OkUcwiL-0sJPF
sh <Package Folder>/files/T32RRbc4ROFi6YU0z4wRqE-PvS2LVgRj
sh <Package Folder>/files/T3_0Gd2qGZGlNspitru8okeUQn9R9D-x
sh <Package Folder>/files/T3dIe_8DGlSGoJgwAYWvkkXorytC7hYf
sh <Package Folder>/files/T4GoPOmQfGUmCsCTbKXDuUbcLJ_FodFL
sh <Package Folder>/files/T59EZ_sjrQjpSEnILbzjnkqoCbHYlFXI
sh <Package Folder>/files/T89ZOJcjj2x998fYs7U-m0N32V1EmlVp
sh <Package Folder>/files/T8vJF5L1TEWBgs3JtqeDY0m2YKYJ48pr
sh <Package Folder>/files/Tx2ZDz7ybkTlIxEst6vC80zuf1IMK7f3
sh <Package Folder>/files/TxCA8i_tGHQWEH2Ec5lk1kPgJtU2w7Jz
sh <Package Folder>/files/TyPFLbmJGeFwlg5ZPZy2n0vFcIsuvJ7C
sh <Package Folder>/files/TycO1E2ONZ862fKEyIfn4knTxGSa-avx
sh <Package Folder>/files/TzN1V-m3QeRSWCGN_4is10NNZBcl97CB
sh <Package Folder>/files/TzlB9nOArsKj8G7kVLpnPEEr5EylV7ul
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat random
uname -a

Loads the following dynamic libraries:

Bugly
InnoSecure
InnoSo
NativeExample
libjiagu1149782120

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
DES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial