Adware.Gexin.6106

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

TCP(DNS) <Google DNS>
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) fy.innot####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) gw.d.y####.com:443
TCP(TLS/1.0) s####.j####.cn:443
TCP(TLS/1.0) k####.eas####.com:443
TCP(TLS/1.0) api.mengtu####.com:443
TCP(TLS/1.0) log.mengtu####.com:443
TCP c####.g####.ig####.com:5225
UDP easytom####.com:19000
TCP 47.1####.216.153:8888
TCP sdk.o####.t####.####.com:5224
UDP 1####.168.120.1:137
UDP s.j####.cn:19000
TCP i####.j####.cn:7002

DNS requests:

7j####.c####.z0.####.com
and####.b####.qq.com
api.mengtu####.com
app.mengtu####.com
c####.g####.ig####.com
c-h####.g####.com
easytom####.com
f####.mengtu####.com
fy.innot####.com
gw.d.y####.com
i####.j####.cn
k####.eas####.com
log.mengtu####.com
log.u####.com
plb####.u####.com
s####.j####.cn
s.j####.cn
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sis.j####.io
u####.u####.com

HTTP GET requests:

t####.c####.q####.####.com/tdata_bca864
t####.c####.q####.####.com/tdata_fyR930
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/1004
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/JPushSA_Config.xml
/data/data/####/MultiDex.lock
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/T4JAScQNtCksZxhNY6FA0UVP9vRnOdKf
/data/data/####/T4n7jVrSZTrotbNIrZmVq0Q10-X-pC8S
/data/data/####/T4q6xpNWDkkok9kA1oexd0fjpekkMpLk
/data/data/####/T5MkfzAdZmm3oCnfhaqKxUIbXsa8RO3i
/data/data/####/T5wz5y6naUanRdRvPKlTD0b480DKq7P2
/data/data/####/T76jpOYPsJC6ZsjaWYrH30wtnNb0pRui
/data/data/####/T8DdTbuVdV6jSJqfoanFM0dDs45sna2f
/data/data/####/T8UxmrbtEB8TUOlvoYSKMknH4ugqcxCT
/data/data/####/T9b8Rtv482BmtAexpYdjrEEDVFS5T4c5
/data/data/####/T_Awp_iywr7eBp2oZIeafEudfNQtAmcw
/data/data/####/T_bywNnl5YQ01J1ZvpcAmEggdlt0ToHH
/data/data/####/Tw5jyQoB2AQEP2tgh43Gmkh4U-GSg1sV
/data/data/####/TwDBz2qY_WdvFG2zFo6kWktvOjRwzk7P
/data/data/####/Txx8WTx7ZvOa8cpVkqKX30wMROPtG-PI
/data/data/####/TyAGbd72odg5EiRAFbPgu0vR9P3TCn0K
/data/data/####/TyoHSvhDQBVacoAhlIZInUnwtxX-Atpd
/data/data/####/Typ0wtFooanjTkPe7Z0IXEiwN8gUWyZ3
/data/data/####/Tz3vtoZGCMC1HAado5tNCUM1whq20h9W
/data/data/####/TzMNYmvd_f0ZtnFQ3oup2E-3Cq9isLpM
/data/data/####/TzqpIpswEc4mJVYDELo6U0eim7xBEFrQ
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu
/data/data/####/bugly_db_legu-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.mengtuiapp.mall.xml
/data/data/####/com.mengtuiapp.mall.xml.bak
/data/data/####/com.mengtuiapp.mall.xml.bak (deleted)
/data/data/####/com.mengtuiapp.mall_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTM3MzU2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTM4NzQy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTMzMDMx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTQ1NDU2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTQ3ODcy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTQ5MDg1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTQxOTU5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTQzMTc0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTU0MDA4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTU1MTAy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTU3NDU5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTU4Njc4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTU5OTMy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTUwNDAx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTUyNTg0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTYxMzgx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTc1MDYx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTg0NDg2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTk2MTEw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTk3NTA0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTk4NjY3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTk5NzMz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTkwNTI5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTkyMTE4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNTkzMzQ4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNjA0MDc2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNjA1MzQ5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNjA2OTg0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNjAxMTI3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0MjcyNjAyODU5;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/device_id.xml.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/file_token
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/httpclient-req-650990899.cache
/data/data/####/httpclient-req-650990899.cache (deleted)
/data/data/####/i==1.2.0&&2.3.7.1_1544272533108_envelope.log
/data/data/####/i==1.2.0&&2.3.7.1_1544272590609_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jpush_uncaughtexception_file
/data/data/####/kefuinfo.xml
/data/data/####/legu_tencent_analysis.db_com.mengtuiapp.mall-journal
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.2.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mengtui_share_data.xml
/data/data/####/mix.dex
/data/data/####/mix.so
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/sys_log_1544272582499604.txt
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.jar
/data/data/####/tdata_fyR930
/data/data/####/tdata_fyR930.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cucom
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cucom
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cucom
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cucom
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cucom
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cucom
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cucom
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cucom
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cucom
/data/media/####/.595b157df788ac0a270a61af4e82461b.cucom
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.6829d1667526200f340b0ebbc50f1799.cucom
/data/media/####/.6829d1667526200f340b0ebbc50f1799.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cucom
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cucom
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cucom
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cucom
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cucom
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8d777f385d3dfec8815d20f7496026dc.cucom
/data/media/####/.8d777f385d3dfec8815d20f7496026dc.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cucom
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cucom
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.90657585874c0020e3bee77e5d77a334.cucom
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cucom
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/.a.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cucom
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.a813fc513e2acbdc7dbb94a2b0444a01.cucom
/data/media/####/.a813fc513e2acbdc7dbb94a2b0444a01.cuid
/data/media/####/.adfwe.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cucom
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b38b7579b17be151dba2d4ebf3594fd9.cucom
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cucom
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.cucom
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.c57a0b01fb1d0879195ce10fcfc070e1.cucom
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cucom
/data/media/####/.cc8dd1145e0a2d862cf37183282bd82c.cucom
/data/media/####/.cc8dd1145e0a2d862cf37183282bd82c.cuid
/data/media/####/.cca.dat
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cucom
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cucom
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cucom
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.push_deviceid
/data/media/####/.umm.dat
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/aacout
/data/media/####/acucomcu
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.mengtuiapp.mall.bin
/data/media/####/com.mengtuiapp.mall.db
/data/media/####/commonaacoutc
/data/media/####/commonaxacountc
/data/media/####/commonwcoutc
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/easemob.log
/data/media/####/sysid.dat
/data/media/####/systemccu
/data/media/####/systucomcu
/data/media/####/tdata_bca864
/data/media/####/tdata_fyR930
/data/media/####/test.log
/data/media/####/ucucomcu
/data/media/####/wcout

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.innotech.innotechpush.service.PushService 24915 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop net.hostname
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.serialno
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls -i
ls -l
ls /sys/class/thermal
ps
sh
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd <SD-Card>/ && ls -i
sh <Package Folder>/files/T4JAScQNtCksZxhNY6FA0UVP9vRnOdKf
sh <Package Folder>/files/T4q6xpNWDkkok9kA1oexd0fjpekkMpLk
sh <Package Folder>/files/T5MkfzAdZmm3oCnfhaqKxUIbXsa8RO3i
sh <Package Folder>/files/T5wz5y6naUanRdRvPKlTD0b480DKq7P2
sh <Package Folder>/files/T76jpOYPsJC6ZsjaWYrH30wtnNb0pRui
sh <Package Folder>/files/T8DdTbuVdV6jSJqfoanFM0dDs45sna2f
sh <Package Folder>/files/T8UxmrbtEB8TUOlvoYSKMknH4ugqcxCT
sh <Package Folder>/files/T9b8Rtv482BmtAexpYdjrEEDVFS5T4c5
sh <Package Folder>/files/TwDBz2qY_WdvFG2zFo6kWktvOjRwzk7P
sh <Package Folder>/files/TyAGbd72odg5EiRAFbPgu0vR9P3TCn0K
sh <Package Folder>/files/TyoHSvhDQBVacoAhlIZInUnwtxX-Atpd
sh <Package Folder>/files/Tz3vtoZGCMC1HAado5tNCUM1whq20h9W
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat random
uname -a

Loads the following dynamic libraries:

Bugly
InnoCommonSo
InnoSo
audioeffect_jni
getuiext3
hyphenate
hyphenate_av
hyphenate_av_recorder
jcore119
libnfix
libshella-2.9.0.2
libufix
nfix
sqlite
ufix
xsignal_client

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial