Adware.Gexin.9118

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.a####.liveme####.com:9002
TCP(HTTP/1.1) kingsof####.b####.yy.####.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) m####.h####.com:80
TCP(HTTP/1.1) crash-r####.yy.com:80
TCP(TLS/1.0) co####.h####.com:443
TCP(TLS/1.0) f####.yy.com:443
TCP(TLS/1.0) s####.yy.com:443
UDP 61.1####.29.215:6002
UDP 61.1####.52.149:5002
TCP 1####.185.109.46:8084
TCP 1####.239.231.113:8080
UDP 1####.242.117.100:6002
UDP 60.2####.219.164:6002
UDP 4####.56.75.12:4002
UDP 1####.231.141.196:80
TCP 1####.138.209.34:8093
TCP 1####.247.249.82:8084
UDP 61.1####.29.221:5002

DNS requests:

a####.exc.mob.com
c####.a####.liveme####.com
co####.h####.com
crash-r####.yy.com
f####.yy.com
m####.h####.com
makefri####.b####.yy.com
s####.yy.com
y####.h####.com

HTTP GET requests:

kingsof####.b####.yy.####.com/game_unlocked_audio.mp3
kingsof####.b####.yy.####.com/pkGame_add_score.mp3
kingsof####.b####.yy.####.com/pkGame_add_star.mp3
kingsof####.b####.yy.####.com/pkGame_drop_score.mp3
kingsof####.b####.yy.####.com/pkGame_drop_star.mp3
kingsof####.b####.yy.####.com/pkGame_grade_up.mp3
kingsof####.b####.yy.####.com/pkGame_level_up.mp3
kingsof####.b####.yy.####.com/pkGame_winPoint_change.mp3
kingsof####.b####.yy.####.com/samescreen_game_over1.mp3
kingsof####.b####.yy.####.com/samescreen_round_over1.mp3
kingsof####.b####.yy.####.com/samescreen_switch_game1.mp3
kingsof####.b####.yy.####.com/ww_im_msg_receive_voice.wav
kingsof####.b####.yy.####.com/ww_login_success_voice.wav
kingsof####.b####.yy.####.com/ww_matching_success_voice.wav
m####.h####.com/c.gif?act=####&time=####&key=####&userIp=####&isAnonymou...

HTTP POST requests:

a####.exc.mob.com/errconf
c####.a####.liveme####.com:9002/argo-proxy/configs/query
crash-r####.yy.com/dau/reporting
m####.h####.com/c.gif?act=####&smkdata=####&EC=####&appkey=####&item=###...

File system changes:

Creates the following files:

/data/data/####/.duid
/data/data/####/.jg.ic
/data/data/####/.lock
/data/data/####/.vpl_lock
/data/data/####/CrashPref
/data/data/####/MessageStore.db-journal
/data/data/####/ModulerDatabase.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/audio_asr_09_13.dat
/data/data/####/global.cfg
/data/data/####/hdid.bck
/data/data/####/hdid_v2
/data/data/####/hdstatis_cache_4bcbabc0.db-journal
/data/data/####/hdstatis_cache_e3b504e0.db-journal
/data/data/####/hdstatis_cache_f4df5118.db-journal
/data/data/####/hduuid_v1
/data/data/####/k.store
/data/data/####/libjiagu543564182.so
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/multidex.version.xml
/data/data/####/udbauthlooog-journal
/data/data/####/user_account-journal
/data/media/####/.artc_lock
/data/media/####/.di
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.im_lock
/data/media/####/.lecd
/data/media/####/.lesd_lock
/data/media/####/.mn_-1464060969
/data/media/####/.nomedia
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.rc_lock
/data/media/####/.slw
/data/media/####/.ss_lock
/data/media/####/1c5d025410c5c5af65632f6cfbf7a032.0.tmp
/data/media/####/1c5d025410c5c5af65632f6cfbf7a032.1.tmp
/data/media/####/97b68ed12b62765c3b21a4f9bc86258f.0.tmp
/data/media/####/97b68ed12b62765c3b21a4f9bc86258f.1.tmp
/data/media/####/Device
/data/media/####/Device_v2
/data/media/####/Global
/data/media/####/ba4c95ef6820a44a570df98a6e6af4ad.0.tmp
/data/media/####/ba4c95ef6820a44a570df98a6e6af4ad.1.tmp
/data/media/####/cfeeb953d52ae915d739ecc82b221ef1.0.tmp
/data/media/####/cfeeb953d52ae915d739ecc82b221ef1.1.tmp
/data/media/####/d2b08ce4-1e6c-4515-b320-680ecdd98da2
/data/media/####/d40f836027f05c7e1bd984e9389364ed.0.tmp
/data/media/####/d40f836027f05c7e1bd984e9389364ed.1.tmp
/data/media/####/ff13060df15d2e0ce3bab5b4f6c4ee2d.0.tmp
/data/media/####/ff13060df15d2e0ce3bab5b4f6c4ee2d.1.tmp
/data/media/####/game_unlocked_audio.mp3
/data/media/####/hdcltid.ini
/data/media/####/hdstatis_20190226.log
/data/media/####/hduuid_v1
/data/media/####/journal.tmp
/data/media/####/pkGame_add_score.mp3
/data/media/####/pkGame_add_star.mp3
/data/media/####/pkGame_drop_score.mp3
/data/media/####/pkGame_drop_star.mp3
/data/media/####/pkGame_grade_up.mp3
/data/media/####/pkGame_level_up.mp3
/data/media/####/pkGame_winPoint_change.mp3
/data/media/####/samescreen_game_over1.mp3
/data/media/####/samescreen_round_over1.mp3
/data/media/####/samescreen_switch_game1.mp3
/data/media/####/ww_im_msg_receive_voice.wav
/data/media/####/ww_login_success_voice.wav
/data/media/####/ww_matching_success_voice.wav
/data/media/####/yysdk_adapter-02-26-09-56.txt

Miscellaneous:

Executes the following shell scripts:

cat /sys/class/net/wlan0/address

Loads the following dynamic libraries:

DeviceIdentifier
asr_cpu
audiosuper
gnustl_shared
hiidostatisjni
libjiagu543564182
mmkv
protocomm
signalsdk
udbauth-shared
yycrashreport
yylivesdk4cloud

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-ECB-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-ECB-NoPadding
DES

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial