Adware.Gexin.20818

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) lo####.sp####.mig.####.net:80
TCP(HTTP/1.1) berm####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) api.bem####.com:8080
TCP(HTTP/1.1) al####.u####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) al####.u####.com:443

DNS requests:

a####.u####.com
api.bem####.com
berm####.oss-cn-####.aliy####.com
l####.tbs.qq.com
plb####.u####.com
sdk.o####.p####.####.com
u####.u####.com

HTTP GET requests:

api.bem####.com:8080/api/advertisement/list?locationKey=####
api.bem####.com:8080/api/article/category
api.bem####.com:8080/api/article/weektop
api.bem####.com:8080/api/resource/getting/flash_android
api.bem####.com:8080/api/systemSetting/default
berm####.oss-cn-####.aliy####.com/418055568322859008
berm####.oss-cn-####.aliy####.com/418055675516686336
berm####.oss-cn-####.aliy####.com/418055965892546560
berm####.oss-cn-####.aliy####.com/418058676671221760
berm####.oss-cn-####.aliy####.com/422771943964545024
berm####.oss-cn-####.aliy####.com/423523073979977728
berm####.oss-cn-####.aliy####.com/430437257040760832
berm####.oss-cn-####.aliy####.com/437978769857318912
berm####.oss-cn-####.aliy####.com/438002074500861952
berm####.oss-cn-####.aliy####.com/438011196361281536
berm####.oss-cn-####.aliy####.com/438058160310325248
berm####.oss-cn-####.aliy####.com/441276441401888768
berm####.oss-cn-####.aliy####.com/441984199830933504
berm####.oss-cn-####.aliy####.com/443000868229484544
berm####.oss-cn-####.aliy####.com/448442929061695488
berm####.oss-cn-####.aliy####.com/450310864688517120
berm####.oss-cn-####.aliy####.com/451429167381221376
berm####.oss-cn-####.aliy####.com/451430554546606080
berm####.oss-cn-####.aliy####.com/453138201666785280
berm####.oss-cn-####.aliy####.com/453924755968495616
berm####.oss-cn-####.aliy####.com/456425639067652096
berm####.oss-cn-####.aliy####.com/461488873483145216
berm####.oss-cn-####.aliy####.com/466568735206019072
berm####.oss-cn-####.aliy####.com/468468254990536704
berm####.oss-cn-####.aliy####.com/469898826459779072
berm####.oss-cn-####.aliy####.com/472454817512558592
berm####.oss-cn-####.aliy####.com/486215376238153728
berm####.oss-cn-####.aliy####.com/488764733797830656
berm####.oss-cn-####.aliy####.com/501408486941396992
berm####.oss-cn-####.aliy####.com/503882905563566080
berm####.oss-cn-####.aliy####.com/528255174557437952
berm####.oss-cn-####.aliy####.com/552077076824461312
berm####.oss-cn-####.aliy####.com/552091337059602432
berm####.oss-cn-####.aliy####.com/557248119042084864
berm####.oss-cn-####.aliy####.com/557248766281912320
berm####.oss-cn-####.aliy####.com/557248959689658368
berm####.oss-cn-####.aliy####.com/559761172010766336
berm####.oss-cn-####.aliy####.com/562633996631150592
berm####.oss-cn-####.aliy####.com/568108358238867456
berm####.oss-cn-####.aliy####.com/568809529677058048
berm####.oss-cn-####.aliy####.com/569901946127912960
berm####.oss-cn-####.aliy####.com/574640946524852224
berm####.oss-cn-####.aliy####.com/584748462835372032
berm####.oss-cn-####.aliy####.com/584755698274013184
berm####.oss-cn-####.aliy####.com/587668242806476800

HTTP POST requests:

al####.u####.com/app_logs
api.bem####.com:8080/api/user/now
lo####.sp####.mig.####.net/ajax?c=####&k=####
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0150daa74a393e8ef6ffd2744b481529c334f2ebc234686....0.tmp
/data/data/####/02efd7cc222a65dd27eec22dc151aca8d77471be005629a....0.tmp
/data/data/####/0703f788af1feb758c256e1192f4c78a.0.tmp
/data/data/####/0703f788af1feb758c256e1192f4c78a.1.tmp
/data/data/####/12e0c67ac5d6a54eae63a540aa94eebb0e33c96b42cd2e8....0.tmp
/data/data/####/1e829e2ff5dcc72e38fb4a9dc884863ca33b8d1fb6f73dd....0.tmp
/data/data/####/2a0743a382425bd2b37f47750d211d23ed0eeacece974c1....0.tmp
/data/data/####/2b1e8292a7f694e382e9e6573a2d8862153a2c2979e5536....0.tmp
/data/data/####/2f43772238f0758aeac99d2e6a0e985c51ceb4506e5c55a....0.tmp
/data/data/####/3e865d84b0953dbf4cbfba6db7e5555d5e5c28f003e4438....0.tmp
/data/data/####/4068e714599878609cd4d6c131e601d887eca3120f746a2....0.tmp
/data/data/####/4181d1b0bd6a79f9bad3481c45a93e61db4ab4a78332379....0.tmp
/data/data/####/42b1382f44556698bde8088798a2c93274bc3c05f65bc80....0.tmp
/data/data/####/488e5d291953f1b1e460937dfc6848d1.0.tmp
/data/data/####/488e5d291953f1b1e460937dfc6848d1.1.tmp
/data/data/####/4a3fc253cb9c398756360f4de6f7a4a9.0.tmp
/data/data/####/4a3fc253cb9c398756360f4de6f7a4a9.1.tmp
/data/data/####/51885f4d2fb988ca88078d47713ac67b0e796a34b1e581b....0.tmp
/data/data/####/56d3312e2b86985a725f0433f1d2b5edb0865de2e6331da....0.tmp
/data/data/####/5fd1913d8ee5433517810007fdb9065e7c76a7622dee0c9....0.tmp
/data/data/####/62acdffda2955ec89b077ee1d3d943ad466a1414817a2bc....0.tmp
/data/data/####/6a26d99b241e1b9beb102d4dd97b640cfe81500a5ebc0e2....0.tmp
/data/data/####/715398f55ba4b6572b43397841bb4b50107fd1358e69027....0.tmp
/data/data/####/77d53a84b7912754aafad538efb8bdd817897f43aa4f287....0.tmp
/data/data/####/7dc3e8618047fe3e16797bace6f2ea5e0716ce05df6e8db....0.tmp
/data/data/####/7dd2e4e58768627612a041a0e027480791ca8cf05b92f8f....0.tmp
/data/data/####/8b1cea3b40822552a25ca73c5693431d0c28f551bf62c71....0.tmp
/data/data/####/8da30b436d3dbbe432c395f9a3468a092453a9b9e8ff03f....0.tmp
/data/data/####/8f234b4448a0f131c1eea35b5576cbf5805e588d6fa6e2e....0.tmp
/data/data/####/966ade20a56356d37944c439d110c0f8c5d58b9ed790c14....0.tmp
/data/data/####/993ad12953b792f5f387c7a0d47e0bf1ade794f5b470197....0.tmp
/data/data/####/9e899ac0b0a958fac5cafcb308367339a7bc04d17f05614....0.tmp
/data/data/####/a412764713cb5570256507e72c6e883c.0.tmp
/data/data/####/a412764713cb5570256507e72c6e883c.1.tmp
/data/data/####/a834eb45019a4ab3d87ca96cc65d3354b46e9e6be43599a....0.tmp
/data/data/####/aa722b31ee11dbbb07a4ffd687d949614ae07ac5397805b....0.tmp
/data/data/####/af3c2d277aaf4bfbdba088713311f89a92cc8f273909faf....0.tmp
/data/data/####/af6c8808c5058ee0a5068f44da96f4913a7bac9e71638c9....0.tmp
/data/data/####/bad206080edca8f5aa12e6890386e49e88f2f619e57256f....0.tmp
/data/data/####/bf83210ad7d1e1c5e2472d78e1dd7bf2636f99af8f5453b....0.tmp
/data/data/####/bf86de2c4fc66b14367581373930abee4747fc8a8c66036....0.tmp
/data/data/####/c11bb174e1d13e15cbb9f234cfe2cd802caaa56944587a5....0.tmp
/data/data/####/c3975f6e91c82ffe78ec1380445aa210c94428917deb525....0.tmp
/data/data/####/cba1070d5688bca08f02b6ea9ba4d5f045db6197c4e5c26....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/core_info
/data/data/####/d742c248024e6936f86b0462863eeacc9117dc661fdfd69....0.tmp
/data/data/####/d7af2fd7e247b135b9b681f56229d9301af3f0807659bd8....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNjAyMzMwNzI2NDg2;
/data/data/####/e1b735d5ad7a7c9aa17882b2310518e26da4e0f12579a28....0.tmp
/data/data/####/e1beed48d3215a91cf6d74ae259d40d7af960c18c42697b....0.tmp
/data/data/####/eee2561ca1ec605568fa672d09bc92c3274262bc92ed905....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f1ccc61a152cde81a70f5ebc54e9bf58b23efffe18f77a8....0.tmp
/data/data/####/f2c249ab3072f119596c850466830924fbfcab19039d595....0.tmp
/data/data/####/f72297c158ff251a5afddd34917e6d6d.0.tmp
/data/data/####/f72297c158ff251a5afddd34917e6d6d.1.tmp
/data/data/####/f7f3cd1b5b0971294e858baa0d4acc4431b076b75fb8c4b....0.tmp
/data/data/####/f85d6dbc4a1c30c0f93c97b32ac50eefeaf8ad3ad7bc1cc....0.tmp
/data/data/####/fa719908b2c854ef5f3aec28a15a167922911f9cac40df7....0.tmp
/data/data/####/fbdff86acc6cd684e5525ae5dbb93a63c13b8459af150be....0.tmp
/data/data/####/ff69bc8d18b27a43f6eb3e0a84be7d7fcb6ebb99a8c8692....0.tmp
/data/data/####/getui_sp.xml
/data/data/####/i==1.2.0&&2.3.1_1602330726547_envelope.log
/data/data/####/info.xml
/data/data/####/init_c1.pid
/data/data/####/init_er.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu789360534.so
/data/data/####/multidex.version.xml
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/share_date.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.umm.dat
/data/media/####/tbslog.txt

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
chmod 755 <Package Folder>/.jiagu/libjiagu789360534.so
getprop ro.product.cpu.abi
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

getuiext2
libjiagu789360534

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
RSA-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial