Adware.Gexin.696

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) if####.bj.opensto####.cn:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) www.slan####.top:80
TCP(HTTP/1.1) ads.voic####.cn:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) api.voic####.cn:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.com:5224

DNS requests:

7j####.c####.z0.####.com
a.appj####.com
ads.voic####.cn
api.voic####.cn
c####.g####.ig####.com
c-h####.g####.com
if####.bj.opensto####.cn
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
www.slan####.top

HTTP GET requests:

api.voic####.cn/hotUpdate?ver=####
if####.bj.opensto####.cn/sdk/AdDex.3.0.11.dex
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_BAI450
sni.c####.q####.####.net/tdata_YJA893
t####.c####.q####.####.com/tdata_EDT356
www.slan####.top//Files/voices/birds/Chlamydotis-macqueenii.jpg
www.slan####.top//Files/voices/birds/Columba-livia.jpg
www.slan####.top//Files/voices/birds/Coracias-garrulus.jpg
www.slan####.top//Files/voices/birds/Grus-canadensis.jpg
www.slan####.top//Files/voices/birds/Hydrornis-nipalensis.jpg
www.slan####.top//Files/voices/birds/Hydrornis-phayrei.jpg
www.slan####.top//Files/voices/birds/Lanius-tigrinus.jpg
www.slan####.top//Files/voices/birds/Lerwa-lerwa.jpg
www.slan####.top//Files/voices/birds/Melanocorypha-maxima.jpg
www.slan####.top//Files/voices/birds/Melanocorypha-yeltoniensis.jpg
www.slan####.top//Files/voices/birds/Mirafra-javanica.jpg
www.slan####.top//Files/voices/birds/Mycteria-leucocephala.jpg
www.slan####.top//Files/voices/birds/Pitta-nympha.jpg
www.slan####.top//Files/voices/birds/Pyrocephalus-rubinus.jpg
www.slan####.top//Files/voices/birds/Spizixos-canifrons.jpg
www.slan####.top//Files/voices/birds/Turnix-sylvaticus.jpg
www.slan####.top//api/check?versionCode=####&appType=####
www.slan####.top/api/getserurl
www.slan####.top/api/sys/getappadsisopen?appType=####&adsType=####
www.slan####.top/api/voicesbirds/gethotlist?pageSize=####&pageIndex=####
www.slan####.top/api/voicesbirds/getkelist?pageSize=####&pageIndex=####
www.slan####.top/api/voicesbirds/getmulist?pageSize=####&pageIndex=####
www.slan####.top/api/voicesbirds/getvoiceslistbycnkename?cn_ke_name=####...
www.slan####.top/api/voicesbirds/getvoiceslistbycnmuname?cn_mu_name=####...

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
ads.voic####.cn/ad/request
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
www.slan####.top/api/user/login

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/AdDex.3.0.1.dex
/data/data/####/AdDex.3.0.11.dex
/data/data/####/adsp.xml
/data/data/####/ca7867b10194
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_top.slantech.voicebirds8
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/run.pid
/data/data/####/share_data.xml
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_YJA893
/data/data/####/tdata_YJA893.jar
/data/data/####/umeng_general_config.xml
/data/data/####/webview.db-journal
/data/data/####/xUtils.db-journal
/data/media/####/-1136910179.tmp
/data/media/####/-1252192555.tmp
/data/media/####/-1581174050.tmp
/data/media/####/-37035143.tmp
/data/media/####/-57537667
/data/media/####/-57537667.tmp
/data/media/####/-635678173.tmp
/data/media/####/-878380563.tmp
/data/media/####/-88057200.tmp
/data/media/####/1585907701.tmp
/data/media/####/524730614.tmp
/data/media/####/832372816.tmp
/data/media/####/934317328.tmp
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/tdata_BAI450
/data/media/####/tdata_YJA893
/data/media/####/test.log
/data/media/####/top.slantech.voicebirds.bin
/data/media/####/top.slantech.voicebirds.db

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.services.DemoPushService 25347 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.services.DemoPushService 25347 300 0

Loads the following dynamic libraries:

getuiext2
libjiagu

Uses the following algorithms to encrypt data:

RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial