Adware.Gexin.2034

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) f####.yy.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) kingsof####.b####.yy.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) m####.h####.com:80
UDP(TELNET) 1####.247.249.98:23
UDP(TELNET) 2####.194.67.7:23
TCP(TLS/1.0) f####.yy.com:443
TCP(TLS/1.0) co####.h####.com:443
TCP(TLS/1.0) s####.yy.com:443
TCP(TLS/1.0) msg.umengc####.com:443
UDP 14.2####.84.167:5002
UDP 2####.228.248.99:4002
TCP openj####.m.ta####.com:80
TCP c####.g####.ig####.com:5227
TCP 1####.232.157.86:8082
TCP 61.1####.231.104:8093
TCP 2####.194.67.125:8093
TCP 1####.1.97.133:8085
UDP 1####.20.84.154:5002
UDP 61.1####.52.174:80
TCP sdk.o####.t####.####.net:5224
TCP 61.1####.52.34:8087
UDP 60.2####.219.164:80
UDP 1####.231.141.196:5002
TCP ope####.m.ta####.com:443

DNS requests:

7j####.c####.z0.####.com
a####.exc.mob.com
ag####.m.ta####.com
amdc####.m.ta####.com
c####.g####.ig####.com
c-h####.g####.com
co####.h####.com
crash-r####.yy.com
f####.yy.com
m####.h####.com
makefri####.b####.yy.com
msg.umengc####.com
norma-e####.m####.com
pub-####.qin####.com
s####.yy.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
short-y####.yy.com
umen####.m.ta####.com
umengj####.m.ta####.com
y####.h####.com

HTTP GET requests:

kingsof####.b####.yy.####.com/game_unlocked_audio.mp3
kingsof####.b####.yy.####.com/pkGame_add_score.mp3
kingsof####.b####.yy.####.com/pkGame_add_star.mp3
kingsof####.b####.yy.####.com/pkGame_drop_score.mp3
kingsof####.b####.yy.####.com/pkGame_drop_star.mp3
kingsof####.b####.yy.####.com/pkGame_grade_up.mp3
kingsof####.b####.yy.####.com/pkGame_level_up.mp3
kingsof####.b####.yy.####.com/pkGame_winPoint_change.mp3
kingsof####.b####.yy.####.com/samescreen_game_over1.mp3
kingsof####.b####.yy.####.com/samescreen_round_over1.mp3
kingsof####.b####.yy.####.com/samescreen_switch_game1.mp3
kingsof####.b####.yy.####.com/ww_im_msg_receive_voice.wav
kingsof####.b####.yy.####.com/ww_login_success_voice.wav
kingsof####.b####.yy.####.com/ww_matching_success_voice.wav
m####.h####.com/c.gif?act=####&time=####&key=####&userIp=####&isAnonymou...
norma-e####.m####.com/android/exchange/getpublickey.do
t####.c####.q####.####.com/tdata_EDT356
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_iGj879
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

a####.exc.mob.com/errconf
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
c-h####.g####.com/api.php?format=####&t=####
f####.yy.com/dau/reporting
m####.h####.com/c.gif?act=####&smkdata=####&EC=####&appkey=####&item=###...
sdk.o####.p####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

/data/data/####/.duid
/data/data/####/.jg.ic
/data/data/####/.lock
/data/data/####/.vpl_lock
/data/data/####/6a76c3114ab6
/data/data/####/ACCS_BINDumeng;57b5550467e58e036a0029be.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/CrashPref.xml
/data/data/####/DaemonServer
/data/data/####/MakeFriends_Common.xml
/data/data/####/MakeFriends_Splash.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/com.x.y.1.xml
/data/data/####/com.yy.shortpushsvc.db-journal
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/global.cfg
/data/data/####/gx_sp.xml
/data/data/####/hd_default_pref.xml
/data/data/####/hdcltid.xml
/data/data/####/hdcommon_config_cache_pref.xml
/data/data/####/hdid.bck
/data/data/####/hdid_v2
/data/data/####/hdstatis_cache_4b04df0e.db-journal
/data/data/####/hdstatis_cache_e3b504e0.db-journal
/data/data/####/hduuid_v1
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/k.store
/data/data/####/lbscache.xml
/data/data/####/libjiagu543564182.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/table.xml
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_iGj879
/data/data/####/tdata_iGj879.jar
/data/data/####/udbauthlooog-journal
/data/data/####/user_account-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/yymobile_log_files.xml
/data/media/####/.artc_lock
/data/media/####/.di
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.im_lock
/data/media/####/.lecd
/data/media/####/.lesd_lock
/data/media/####/.mn_-1464060969
/data/media/####/.nomedia
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.rc_lock
/data/media/####/.slw
/data/media/####/.ss_lock
/data/media/####/1c5d025410c5c5af65632f6cfbf7a032.0.tmp
/data/media/####/1c5d025410c5c5af65632f6cfbf7a032.1.tmp
/data/media/####/2018-09-01.log.txt
/data/media/####/40ca6b11-e3bc-4cdd-b418-4ea2e26a5f0d.syslog
/data/media/####/41e5a512bd4945e5852f29568dcd7097
/data/media/####/8e74366f6a6b453694a7967e855fcde0
/data/media/####/90f73adb19fd4a88a764a26ab0f7c52f
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/Device
/data/media/####/Device_v2
/data/media/####/Global
/data/media/####/LogPath.txt
/data/media/####/app.db
/data/media/####/cfe8870b7b5a423a8de9468bcf3ab0c4
/data/media/####/cfeeb953d52ae915d739ecc82b221ef1.0.tmp
/data/media/####/cfeeb953d52ae915d739ecc82b221ef1.1.tmp
/data/media/####/com.duowan.makefriends.bin
/data/media/####/com.duowan.makefriends.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/d2b08ce4-1e6c-4515-b320-680ecdd98da2
/data/media/####/d40f836027f05c7e1bd984e9389364ed.0.tmp
/data/media/####/d40f836027f05c7e1bd984e9389364ed.1.tmp
/data/media/####/deviceToken
/data/media/####/ff13060df15d2e0ce3bab5b4f6c4ee2d.0.tmp
/data/media/####/ff13060df15d2e0ce3bab5b4f6c4ee2d.1.tmp
/data/media/####/game_unlocked_audio.mp3
/data/media/####/hdcltid.ini
/data/media/####/hdstatis_20180901.log
/data/media/####/hduuid_v1
/data/media/####/info.txt
/data/media/####/journal.tmp
/data/media/####/logs_2018_09_01_17_43.txt
/data/media/####/pkGame_add_score.mp3
/data/media/####/pkGame_add_star.mp3
/data/media/####/pkGame_drop_score.mp3
/data/media/####/pkGame_drop_star.mp3
/data/media/####/pkGame_grade_up.mp3
/data/media/####/pkGame_level_up.mp3
/data/media/####/pkGame_winPoint_change.mp3
/data/media/####/pushsvc_log.txt
/data/media/####/samescreen_game_over1.mp3
/data/media/####/samescreen_round_over1.mp3
/data/media/####/samescreen_switch_game1.mp3
/data/media/####/tdata_MkX219
/data/media/####/tdata_iGj879
/data/media/####/test.log
/data/media/####/ww_im_msg_receive_voice.wav
/data/media/####/ww_login_success_voice.wav
/data/media/####/ww_matching_success_voice.wav
/data/media/####/yysdk_adapter-09-01-17-43.txt

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57b5550467e58e036a0029be","utdid":"W4rPw6HXi5cDAGdzx1H78e4N","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.yy.pushsvc.GTPush.GeTuiService 25226 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu543564182.so
mount
sh

Loads the following dynamic libraries:

DeviceIdentifier
getuiext2
hiidostatisjni
libjiagu543564182
tnet-3.1
yycrashreport
yylivesdk4cloud
yyprotolitesdk

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding
DES
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-ECB-NoPadding
DES

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial