Adware.Gexin.8094

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) i.t####.com:80
TCP(HTTP/1.1) rp-na####.ron####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) j####.d####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) s####.cn.ron####.com:443
TCP 1####.92.122.56:8621

DNS requests:

and####.b####.qq.com
av1.x####.com
c####.x####.com
c####.x####.com
i.t####.com
j####.d####.com
nav.cn.ron####.com
s####.cn.ron####.com
sdk.o####.p####.####.com

HTTP GET requests:

i.t####.com/a/3994fde373056574af91d5fd9e6b1ba83

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
rp-na####.ron####.com/navipush.json
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/000001.dbtmp
/data/data/####/000002.dbtmp
/data/data/####/1004
/data/data/####/1548641282848_2291
/data/data/####/1548641285298_2291
/data/data/####/1548641285371_2377
/data/data/####/1548641286164_2291
/data/data/####/1548641286218_2377
/data/data/####/1548641286484_2291
/data/data/####/1548641287003_2291
/data/data/####/1548641287177_2377
/data/data/####/1548641287453_2291
/data/data/####/1548641287685_2377
/data/data/####/1548641287771_2291
/data/data/####/1548641287983_2291
/data/data/####/1548641288033_2394
/data/data/####/1548641289488_2291
/data/data/####/1548641289692_2291
/data/data/####/1548641290268_2291
/data/data/####/1548641290405_2394
/data/data/####/1548641291331_2394
/data/data/####/1548641292101_2394
/data/data/####/1548641296490_2291
/data/data/####/1548641296669_2291
/data/data/####/1548641347459_2291
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/COUNTLY_STORE.xml
/data/data/####/FwLog.xml
/data/data/####/INSTALLATION
/data/data/####/MANIFEST-000001
/data/data/####/Pythagoras_phase.xml
/data/data/####/RongPush.xml
/data/data/####/RongPushAppConfig.xml
/data/data/####/Statistics.xml
/data/data/####/TDCloudSettingsConfig463D49B5213A0224599EE7B475E1D593.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/add-city-list.69d08ebd9812879a3ded6a8d8b106adc.css
/data/data/####/add-city-list.99cb5a9217b5fe1db9b8.js
/data/data/####/add-city-list.html
/data/data/####/add-other-cert.99cb5a9217b5fe1db9b8.js
/data/data/####/add-other-cert.b0ff9d879bd32e271badb7ebdd6a479b.css
/data/data/####/add-other-cert.html
/data/data/####/addworkplace.0f4b827f25c0eab350af5c757d62fc95.css
/data/data/####/addworkplace.99cb5a9217b5fe1db9b8.js
/data/data/####/addworkplace.html
/data/data/####/agreement.1c40f51aed1ae45c35db6cc5519422fd.css
/data/data/####/agreement.99cb5a9217b5fe1db9b8.js
/data/data/####/agreement.html
/data/data/####/alipay-result.99cb5a9217b5fe1db9b8.js
/data/data/####/alipay-result.e4eba7cc5d67bfb0f01b739d81d424d0.css
/data/data/####/alipay-result.html
/data/data/####/alipayinfo.7f715a17b5c01f962460be809515e618.css
/data/data/####/alipayinfo.99cb5a9217b5fe1db9b8.js
/data/data/####/alipayinfo.html
/data/data/####/applydetail.99cb5a9217b5fe1db9b8.js
/data/data/####/applydetail.a71286d44655c00562b295f52668f200.css
/data/data/####/applydetail.html
/data/data/####/applylist.4eaf9ff1939b4b8196cbf6424a26b962.css
/data/data/####/applylist.99cb5a9217b5fe1db9b8.js
/data/data/####/applylist.html
/data/data/####/auditing.99cb5a9217b5fe1db9b8.js
/data/data/####/auditing.fa163b91ada075cc27cfa62d30f85b98.css
/data/data/####/auditing.html
/data/data/####/b_speed_icon.png
/data/data/####/bg_status.png
/data/data/####/bind-account.99cb5a9217b5fe1db9b8.js
/data/data/####/bind-account.ca4a35fd71ddafb297ec661f3d6c4e19.css
/data/data/####/bind-account.html
/data/data/####/bind-outbound-call.56248b11e45b49f5cd370b7bfb855baf.css
/data/data/####/bind-outbound-call.99cb5a9217b5fe1db9b8.js
/data/data/####/bind-outbound-call.html
/data/data/####/bind-phone-num.99cb5a9217b5fe1db9b8.js
/data/data/####/bind-phone-num.c6bfd61b785b80b19d5a7399b1af0367.css
/data/data/####/bind-phone-num.html
/data/data/####/bugly_db_-journal
/data/data/####/bundle.js
/data/data/####/cache.manifest
/data/data/####/cert-list.89d6769c9575ff3a99dedaa8c70d7792.css
/data/data/####/cert-list.99cb5a9217b5fe1db9b8.js
/data/data/####/cert-list.html
/data/data/####/certifi_icon.png
/data/data/####/certifi_pass_mask.png
/data/data/####/city.371e0abf363bb7174e916a9155b3ff3e.css
/data/data/####/city.99cb5a9217b5fe1db9b8.js
/data/data/####/city.html
/data/data/####/cityInfo.chunk.js
/data/data/####/com.doumi.bclient_preferences.xml
/data/data/####/common-language.85541220ab0b3c9811af6e17e02e550c.css
/data/data/####/common-language.99cb5a9217b5fe1db9b8.js
/data/data/####/common-language.html
/data/data/####/company-cert-detail.99cb5a9217b5fe1db9b8.js
/data/data/####/company-cert-detail.c6cf3f22adb0c02e96b2c99d185ac58f.css
/data/data/####/company-cert-detail.html
/data/data/####/company-cert.56aacb8b7aa4c57ac8bab74f6686f0f8.css
/data/data/####/company-cert.99cb5a9217b5fe1db9b8.js
/data/data/####/company-cert.html
/data/data/####/companyinfo-edit.6e0db1215dae1e111f56cbced0231632.css
/data/data/####/companyinfo-edit.99cb5a9217b5fe1db9b8.js
/data/data/####/companyinfo-edit.html
/data/data/####/crashrecord.xml
/data/data/####/deposit-detail.72722698fe4b88535f29724a0ced1d69.css
/data/data/####/deposit-detail.99cb5a9217b5fe1db9b8.js
/data/data/####/deposit-detail.html
/data/data/####/deposit-info.871109f1a132a5cdbc2d0eb275185b85.css
/data/data/####/deposit-info.99cb5a9217b5fe1db9b8.js
/data/data/####/deposit-info.html
/data/data/####/detail-hotpot.26f56f99a99eaa9b5b67502abf7b9a18.css
/data/data/####/detail-hotpot.99cb5a9217b5fe1db9b8.js
/data/data/####/detail-hotpot.html
/data/data/####/detail.249a9fa662e999e8a5d6f27e884c9219.css
/data/data/####/detail.99cb5a9217b5fe1db9b8.js
/data/data/####/detail.html
/data/data/####/dmdid
/data/data/####/domSetting
/data/data/####/effect-promote.25cfa96525125da93dfe42ace7b8f731.css
/data/data/####/effect-promote.99cb5a9217b5fe1db9b8.js
/data/data/####/effect-promote.html
/data/data/####/enter1.png
/data/data/####/enterprise-rank.071fa7437c9bc56c7233ac03f5b0a519.css
/data/data/####/enterprise-rank.99cb5a9217b5fe1db9b8.js
/data/data/####/enterprise-rank.html
/data/data/####/evaluate.1d6d13e47eee629a295f3c8f7eeb6a92.css
/data/data/####/evaluate.99cb5a9217b5fe1db9b8.js
/data/data/####/evaluate.html
/data/data/####/everyday-task.99cb5a9217b5fe1db9b8.js
/data/data/####/everyday-task.afae6757271d84978aaea069a6dc89e8.css
/data/data/####/everyday-task.html
/data/data/####/f1e5994e2a5f4dbe680c.worker.js
/data/data/####/fe5312fdbe923e425eb3.worker.js
/data/data/####/feedback.02a80ed8259317707854bc55acc8c1c8.css
/data/data/####/feedback.99cb5a9217b5fe1db9b8.js
/data/data/####/feedback.html
/data/data/####/forget-pwd.56248b11e45b49f5cd370b7bfb855baf.css
/data/data/####/forget-pwd.99cb5a9217b5fe1db9b8.js
/data/data/####/forget-pwd.html
/data/data/####/free-job.99cb5a9217b5fe1db9b8.js
/data/data/####/free-job.html
/data/data/####/fullMore.chunk.js
/data/data/####/fullSalary.chunk.js
/data/data/####/fulltimejob.99cb5a9217b5fe1db9b8.js
/data/data/####/fulltimejob.efbd7c06e6dc33f09f6c4f0bf6c7b7ce.css
/data/data/####/fulltimejob.html
/data/data/####/getcaptchaway.99cb5a9217b5fe1db9b8.js
/data/data/####/getcaptchaway.abbac59518324660e45286975595ac19.css
/data/data/####/getcaptchaway.html
/data/data/####/getui_sp.xml
/data/data/####/ico_level.png
/data/data/####/icon.png
/data/data/####/icon_deliver.png
/data/data/####/icon_detail.png
/data/data/####/icon_form.png
/data/data/####/icon_list.png
/data/data/####/icon_merchant_v2.png
/data/data/####/icon_type.png
/data/data/####/im-common-language.99cb5a9217b5fe1db9b8.js
/data/data/####/im-common-language.d4d7733c3eb73da5df26a392de2ff06b.css
/data/data/####/im-common-language.html
/data/data/####/imkit.db-journal
/data/data/####/init_c1.pid
/data/data/####/init_er.pid
/data/data/####/integral.05e85e5884ae1d7353bc3a2addf3b448.css
/data/data/####/integral.99cb5a9217b5fe1db9b8.js
/data/data/####/integral.html
/data/data/####/inv_icon.png
/data/data/####/inv_prize.png
/data/data/####/invite-prize.99cb5a9217b5fe1db9b8.js
/data/data/####/invite-prize.9f698e178344a98367ce36540551940d.css
/data/data/####/invite-prize.html
/data/data/####/jianZhi.xml
/data/data/####/job-optimize.591e79c316ccb53330888fc10c740093.css
/data/data/####/job-optimize.99cb5a9217b5fe1db9b8.js
/data/data/####/job-optimize.html
/data/data/####/job-status.055c497fa8ad04ff21f011e0b185934b.css
/data/data/####/job-status.99cb5a9217b5fe1db9b8.js
/data/data/####/job-status.html
/data/data/####/jobDescription.chunk.js
/data/data/####/jobType.chunk.js
/data/data/####/jobdescription.99cb5a9217b5fe1db9b8.js
/data/data/####/jobdescription.f25a3b2c4dcbb0d30823dd3486f4263e.css
/data/data/####/jobdescription.html
/data/data/####/joblist.99cb5a9217b5fe1db9b8.js
/data/data/####/joblist.9bac5d4ec48d0409ec19c0cf1456e1c7.css
/data/data/####/joblist.html
/data/data/####/ker.db-journal
/data/data/####/leave-message.85541220ab0b3c9811af6e17e02e550c.css
/data/data/####/leave-message.99cb5a9217b5fe1db9b8.js
/data/data/####/leave-message.html
/data/data/####/libjiagu1769550344.so
/data/data/####/local_crash_lock
/data/data/####/login_guide_bg.png
/data/data/####/logo_app.png
/data/data/####/mPBE.xml
/data/data/####/main.dek
/data/data/####/manage_msg_icon.png
/data/data/####/massmsg-detail.99cb5a9217b5fe1db9b8.js
/data/data/####/massmsg-detail.c50158ca96a4e6cb8528afc39ad21b61.css
/data/data/####/massmsg-detail.html
/data/data/####/massmsg-list.99cb5a9217b5fe1db9b8.js
/data/data/####/massmsg-list.c50158ca96a4e6cb8528afc39ad21b61.css
/data/data/####/massmsg-list.html
/data/data/####/massmsg-send.99cb5a9217b5fe1db9b8.js
/data/data/####/massmsg-send.c50158ca96a4e6cb8528afc39ad21b61.css
/data/data/####/massmsg-send.html
/data/data/####/merchant.02a80ed8259317707854bc55acc8c1c8.css
/data/data/####/merchant.99cb5a9217b5fe1db9b8.js
/data/data/####/merchant.html
/data/data/####/message-detail.207ef3891340b1301c1fd2098a8988fb.css
/data/data/####/message-detail.99cb5a9217b5fe1db9b8.js
/data/data/####/message-detail.html
/data/data/####/message-list.03270dda64fd5db1159ae91cf1044951.css
/data/data/####/message-list.99cb5a9217b5fe1db9b8.js
/data/data/####/message-list.html
/data/data/####/modify-pay-price.9568085f1f3b3e18ab6a13477c23496d.css
/data/data/####/modify-pay-price.99cb5a9217b5fe1db9b8.js
/data/data/####/modify-pay-price.html
/data/data/####/moreConfig.chunk.js
/data/data/####/msg-sys-list.99cb5a9217b5fe1db9b8.js
/data/data/####/msg-sys-list.cd2cfac27c226d337507de4baae37870.css
/data/data/####/msg-sys-list.html
/data/data/####/multidex.version.xml
/data/data/####/my-message.99cb5a9217b5fe1db9b8.js
/data/data/####/my-message.b140f481aea855d5438c03ff34f89f86.css
/data/data/####/my-message.html
/data/data/####/my-wallet.99cb5a9217b5fe1db9b8.js
/data/data/####/my-wallet.de937efd86600376e64b70fd0e25f848.css
/data/data/####/my-wallet.html
/data/data/####/newbie-task.99cb5a9217b5fe1db9b8.js
/data/data/####/newbie-task.afae6757271d84978aaea069a6dc89e8.css
/data/data/####/newbie-task.html
/data/data/####/noList.png
/data/data/####/other-cert-type-list.99cb5a9217b5fe1db9b8.js
/data/data/####/other-cert-type-list.c29e6d03e7163bcd58afc4189aa9f0a8.css
/data/data/####/other-cert-type-list.html
/data/data/####/other-cert.99cb5a9217b5fe1db9b8.js
/data/data/####/other-cert.c7bcccfc058cce8f8a4968c61f51f2b8.css
/data/data/####/other-cert.html
/data/data/####/other_cert_bg.png
/data/data/####/partSalary.chunk.js
/data/data/####/parttimejob.99cb5a9217b5fe1db9b8.js
/data/data/####/parttimejob.efbd7c06e6dc33f09f6c4f0bf6c7b7ce.css
/data/data/####/parttimejob.html
/data/data/####/pay-balancesucc.99cb5a9217b5fe1db9b8.js
/data/data/####/pay-balancesucc.c8833889a4b3a685bffaa1eccdda609f.css
/data/data/####/pay-balancesucc.html
/data/data/####/pay-depositsucc.871109f1a132a5cdbc2d0eb275185b85.css
/data/data/####/pay-depositsucc.99cb5a9217b5fe1db9b8.js
/data/data/####/pay-depositsucc.html
/data/data/####/payconfirm.7f715a17b5c01f962460be809515e618.css
/data/data/####/payconfirm.99cb5a9217b5fe1db9b8.js
/data/data/####/payconfirm.html
/data/data/####/paydetail.99cb5a9217b5fe1db9b8.js
/data/data/####/paydetail.a260bc58bb826c923f4b9086061a55ef.css
/data/data/####/paydetail.html
/data/data/####/payhistory.99cb5a9217b5fe1db9b8.js
/data/data/####/payhistory.c8833889a4b3a685bffaa1eccdda609f.css
/data/data/####/payhistory.html
/data/data/####/paylist.52335ada38a7d3c6b8c1abab05a49935.css
/data/data/####/paylist.99cb5a9217b5fe1db9b8.js
/data/data/####/paylist.html
/data/data/####/payment_status.png
/data/data/####/payrecorddetail.8970b665cc7d7c6afa78835325f0aeff.css
/data/data/####/payrecorddetail.99cb5a9217b5fe1db9b8.js
/data/data/####/payrecorddetail.html
/data/data/####/perDem.chunk.js
/data/data/####/person-requirements.26b20c8a4367e50f679e0e0f928101be.css
/data/data/####/person-requirements.99cb5a9217b5fe1db9b8.js
/data/data/####/person-requirements.html
/data/data/####/personal-cert.75a4ba13faa6134445536776eca44ae9.css
/data/data/####/personal-cert.99cb5a9217b5fe1db9b8.js
/data/data/####/personal-cert.html
/data/data/####/personal_center.png
/data/data/####/personalinfo-edit.298b70d0600444bd77843e6dfac6bc96.css
/data/data/####/personalinfo-edit.99cb5a9217b5fe1db9b8.js
/data/data/####/personalinfo-edit.html
/data/data/####/personalnickname-edit.99cb5a9217b5fe1db9b8.js
/data/data/####/personalnickname-edit.d0d57c3314b469ee006c74b9bf29bd8e.css
/data/data/####/personalnickname-edit.html
/data/data/####/privileged-task.99cb5a9217b5fe1db9b8.js
/data/data/####/privileged-task.afae6757271d84978aaea069a6dc89e8.css
/data/data/####/privileged-task.html
/data/data/####/ptj_icons.png
/data/data/####/pub-success.28e286da06ef99ead73253ff063224c0.css
/data/data/####/pub-success.99cb5a9217b5fe1db9b8.js
/data/data/####/pub-success.html
/data/data/####/pwd-manage.99cb5a9217b5fe1db9b8.js
/data/data/####/pwd-manage.f406dedb4923f5886398f46c42d92337.css
/data/data/####/pwd-manage.html
/data/data/####/rank_bg.png
/data/data/####/rank_list.png
/data/data/####/real-name.74a78a08778a13c8ab30dbd26496e93f.css
/data/data/####/real-name.99cb5a9217b5fe1db9b8.js
/data/data/####/real-name.html
/data/data/####/real_name_n.png
/data/data/####/real_name_y.png
/data/data/####/recharge.99cb5a9217b5fe1db9b8.js
/data/data/####/recharge.da57e6fa4c5ddaef7330bcb06b936c85.css
/data/data/####/recharge.html
/data/data/####/register.99cb5a9217b5fe1db9b8.js
/data/data/####/register.abbac59518324660e45286975595ac19.css
/data/data/####/register.html
/data/data/####/requirement.chunk.js
/data/data/####/resetpwd.99cb5a9217b5fe1db9b8.js
/data/data/####/resetpwd.a307296522da088bc28615caab235d2e.css
/data/data/####/resetpwd.html
/data/data/####/returndeposucc.028b83ea122382f819d6a0a4d1969504.css
/data/data/####/returndeposucc.99cb5a9217b5fe1db9b8.js
/data/data/####/returndeposucc.html
/data/data/####/revise-pwd.99cb5a9217b5fe1db9b8.js
/data/data/####/revise-pwd.f406dedb4923f5886398f46c42d92337.css
/data/data/####/revise-pwd.html
/data/data/####/rule-activity.01c654055ae13f21d5e29b789f631a2f.css
/data/data/####/rule-activity.99cb5a9217b5fe1db9b8.js
/data/data/####/rule-activity.html
/data/data/####/salRem.chunk.js
/data/data/####/security_info
/data/data/####/select-supple-cert.99cb5a9217b5fe1db9b8.js
/data/data/####/select-supple-cert.9efeb9451d91656c3409063a7cf1e800.css
/data/data/####/select-supple-cert.html
/data/data/####/selectPlace.chunk.js
/data/data/####/sesame_logo.jpg
/data/data/####/setting.332ad5dc98a20498deef88f9672c9f1e.css
/data/data/####/setting.99cb5a9217b5fe1db9b8.js
/data/data/####/setting.html
/data/data/####/star.png
/data/data/####/task_bn.png
/data/data/####/task_bn1.png
/data/data/####/task_icon.png
/data/data/####/task_loading.png
/data/data/####/task_progress_bg.png
/data/data/####/tasklist.99cb5a9217b5fe1db9b8.js
/data/data/####/tasklist.afae6757271d84978aaea069a6dc89e8.css
/data/data/####/tasklist.html
/data/data/####/tdid.xml
/data/data/####/tel-cert.75a4ba13faa6134445536776eca44ae9.css
/data/data/####/tel-cert.99cb5a9217b5fe1db9b8.js
/data/data/####/tel-cert.html
/data/data/####/tmp.zip
/data/data/####/vendor.dll.js
/data/data/####/walletdetail.99cb5a9217b5fe1db9b8.js
/data/data/####/walletdetail.bce01bf044c20042c78fe31e7596fbab.css
/data/data/####/walletdetail.html
/data/data/####/webview.db-journal
/data/data/####/weixin-login.99cb5a9217b5fe1db9b8.js
/data/data/####/weixin-login.a307296522da088bc28615caab235d2e.css
/data/data/####/weixin-login.html
/data/data/####/workPlace.chunk.js
/data/data/####/worktime.89a0ef4effc07904c0f42292606048e1.css
/data/data/####/worktime.99cb5a9217b5fe1db9b8.js
/data/data/####/worktime.html
/data/data/####/zm-cert.99cb5a9217b5fe1db9b8.js
/data/data/####/zm-cert.c7bbd4dd23a2da8b139da5334a442f91.css
/data/data/####/zm-cert.html
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/BeLog_1548641288723.log
/data/media/####/dmdid
/data/media/####/domSetting
/data/media/####/journal
/data/media/####/journal.tmp

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
/system/bin/sh -c type su
getprop

Loads the following dynamic libraries:

RongIMLib
dek
getuiext2
kerdb
kerkee_util
libjiagu1769550344

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial