Adware.Gexin.9535

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) o####.map.b####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) c.appj####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) cdnpu####.c####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) www.c####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5227

DNS requests:

7j####.c####.z0.####.com
a####.u####.com
a.appj####.com
api.map.b####.com
c####.g####.ig####.com
c-h####.g####.com
c.appj####.com
cdnpu####.c####.com
loc.map.b####.com
log.u####.com
o####.map.b####.com
pub-####.qin####.com
s####.u####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
www.c####.com

HTTP GET requests:

cdnpu####.c####.com/PUBLIC/ADVERT/B2C/bbmc_and.jpg
cdnpu####.c####.com/PUBLIC/ADVERT/INDEX/Banner-Andriod.png
cdnpu####.c####.com/PUBLIC/BACKGROUNT_FILE/2017-04-11/android_personalIn...
cdnpu####.c####.com/PUBLIC/BACKGROUNT_FILE/2017-04-11/banner.png
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-02-19/13a3d03f-b649-4b6f-9356-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-02-22/2fb5c240-cb90-4d32-8848-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-02-28/228b54c2-1d68-499c-a35f-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-02-28/408ff2bc-e9f3-43f4-9edc-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-03-01/2eeba4c5-0f23-4c40-aab4-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-03-01/6e0fe771-6095-4754-b7ee-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-03-02/2a96850e-d6da-453b-9b4f-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-03-03/1280028b-6849-4145-acbc-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-03-03/89b596ad-6722-4fc7-8f69-...
cdnpu####.c####.com/PUBLIC/CAR_IMAGE/2019-03-03/d3587a46-e6f0-4d0a-822d-...
t####.c####.q####.####.com/tdata_JNg986
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_iRz660
t####.c####.q####.####.com/tdata_zzW503

HTTP POST requests:

a####.u####.com/app_logs
a.appj####.com/jiagu/check/upgrade
c-h####.g####.com/api.php?format=####&t=####
c.appj####.com/ad/splash/stats.html
loc.map.b####.com/sdk.php
o####.map.b####.com/offline_loc
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0482c40928f633631c6746b45c2ba3b221d2cff967c7ebf....0.tmp
/data/data/####/1551666698675.log
/data/data/####/171d3e3f0001f9d322149b91d7a42fd89a0d71029f50ace....0.tmp
/data/data/####/196ca61905604b8b46049ed677a6ce79c90ecac4d49f700....0.tmp
/data/data/####/1b2b0f0d1c0ae7db98e41c34616450fb070d8164e1d1112....0.tmp
/data/data/####/1e75ab726915d5a621a285038eaa8b1d0c0b4dbd04f01cb....0.tmp
/data/data/####/2b86b9339aa6497dc91cbf42d046b1135c8800e78ca15dd....0.tmp
/data/data/####/2c597ae13da90c0513cbf7707f73fe6f8626bfa03360ec6....0.tmp
/data/data/####/404.html
/data/data/####/5034688040f05116cd8dfeb7ee8104f7306592ceae55785....0.tmp
/data/data/####/50dd98ca18e972e3d495022b72143752eea601bac4b13d4....0.tmp
/data/data/####/7fc64d87a834d4a722fb149c44611d46a17d3392f945962....0.tmp
/data/data/####/8aac172bce109a0aa21ffa770fa9311b785dc1a7f9690f3....0.tmp
/data/data/####/8e6ae3c41ff4be05c7f59be99bc76d7cffd288b13ada597....0.tmp
/data/data/####/The_slider.png
/data/data/####/The_slider@3x.png
/data/data/####/WEB_ZIP_FILE.zip
/data/data/####/about.html
/data/data/####/about.js
/data/data/####/aboutsService.js
/data/data/####/ad_show_time.xml
/data/data/####/address@2x.png
/data/data/####/address@3x.png
/data/data/####/alert-icon-faild.png
/data/data/####/alert-icon-success.png
/data/data/####/andriodPhone@2x.png
/data/data/####/andriodPhone@3x.png
/data/data/####/angular-animate.min.js
/data/data/####/angular-ui-router.min.js
/data/data/####/angular.min.js
/data/data/####/animate-arrow@2x.gif
/data/data/####/animate-arrow@3x.gif
/data/data/####/app.js
/data/data/####/apply.html
/data/data/####/apply.js
/data/data/####/authStatus_com.btjf.app.cheok.xml
/data/data/####/authStatus_com.btjf.app.cheok;pushservice.xml
/data/data/####/authStatus_com.btjf.app.cheok;remote.xml
/data/data/####/authentication.html
/data/data/####/authentication.js
/data/data/####/bank_branch_support.html
/data/data/####/bank_branch_support.js
/data/data/####/bank_support.html
/data/data/####/bank_support.js
/data/data/####/bankcard.html
/data/data/####/bankcard.js
/data/data/####/banner-default.png
/data/data/####/banner-defaultD.png
/data/data/####/bannerService.js
/data/data/####/base.min.js
/data/data/####/billService.js
/data/data/####/bind_bankcard.html
/data/data/####/bind_bankcard.js
/data/data/####/bind_success.html
/data/data/####/bind_success.js
/data/data/####/bindbk.html
/data/data/####/bindbk.js
/data/data/####/bindcard.html
/data/data/####/bindcard.js
/data/data/####/brandIcon.png
/data/data/####/bt-lazyload.js
/data/data/####/btBaseModule.js
/data/data/####/buriedService.js
/data/data/####/c203ed208d9b5db22e5ac2d6473b84d367352d71767fbc9....0.tmp
/data/data/####/c6f454f55762d924b0b5d308aa03ef0f6d600a643a0353b....0.tmp
/data/data/####/c91a8898a5c0e58af3edde586cc7e0a63ddb33abe06467e....0.tmp
/data/data/####/captchaService.js
/data/data/####/car-default.png
/data/data/####/car-quotes1@2x.png
/data/data/####/car-quotes1@3x.png
/data/data/####/car-quotes2@2x.png
/data/data/####/car-quotes2@3x.png
/data/data/####/car-wallet@2x.png
/data/data/####/car-wallet@3x.png
/data/data/####/carLoan-nobill@2x.png
/data/data/####/carLoan-nobill@3x.png
/data/data/####/carLoan-paidoff@2x.png
/data/data/####/carLoan-paidoff@3x.png
/data/data/####/carLoan-repayment@2x.png
/data/data/####/carLoan-repayment@3x.png
/data/data/####/carService.js
/data/data/####/car_loan.html
/data/data/####/car_loan.js
/data/data/####/cardetail_seller@2x.png
/data/data/####/cardetail_seller@3x.png
/data/data/####/carture.png
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cheok_main.db
/data/data/####/cheok_main.db-journal
/data/data/####/cheok_main.db-shm
/data/data/####/cheok_main.db-wal
/data/data/####/cheok_static.db
/data/data/####/cheok_static.db-journal
/data/data/####/cheok_static.db-shm
/data/data/####/cheok_static.db-wal
/data/data/####/close.png
/data/data/####/com.btjf.app.commonlib.APP_PREF.xml
/data/data/####/config.html
/data/data/####/config.js
/data/data/####/config.min.js
/data/data/####/confirm.min.js
/data/data/####/confirm_bill.html
/data/data/####/confirm_bill.js
/data/data/####/d192a4d373d1cb8e67f764c3e926ed8246213eafec878de....0.tmp
/data/data/####/debug.js
/data/data/####/deduct_agreement.html
/data/data/####/deduct_agreement.js
/data/data/####/default-upgrade@2x.png
/data/data/####/default-upgrade@3x.png
/data/data/####/detail.html
/data/data/####/detail.js
/data/data/####/detail_1.0.0.html
/data/data/####/detail_1.0.0.js
/data/data/####/detail_1.3.0.html
/data/data/####/detail_1.3.0.js
/data/data/####/detail_arrow@2x.png
/data/data/####/detail_arrow@3x.png
/data/data/####/detail_bg@2x.png
/data/data/####/detail_bg@3x.png
/data/data/####/dialog.min.js
/data/data/####/directiveModule.js
/data/data/####/easyLoanService.js
/data/data/####/evaluateService.js
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f08a063ba24952271d9f84eb9daaf6d2140acdd4100c4a7....0.tmp
/data/data/####/f434b0207ffdc17d9d7ad3e32f2c83d4b90de0e3997b770....0.tmp
/data/data/####/failT.png
/data/data/####/failT@3x.png
/data/data/####/firll.dat
/data/data/####/gal.db
/data/data/####/gal.db-journal
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/global.min.css
/data/data/####/global.min.js
/data/data/####/globalBase.js
/data/data/####/guide.html
/data/data/####/guide.js
/data/data/####/hammer.min.js
/data/data/####/history.html
/data/data/####/history.js
/data/data/####/home-InBuy@2x.png
/data/data/####/home-InBuy@3x.png
/data/data/####/home-bmw@3x.png
/data/data/####/home-buycar@2x.png
/data/data/####/home-buycar@3x.png
/data/data/####/home-checkIllegal@2x.png
/data/data/####/home-checkIllegal@3x.png
/data/data/####/home-evaluation@2x.png
/data/data/####/home-evaluation@3x.png
/data/data/####/home-hot@2x.png
/data/data/####/home-hot@3x.png
/data/data/####/home-hoverA@2x.png
/data/data/####/home-hoverA@3x.png
/data/data/####/home-kmr@2x.png
/data/data/####/home-kmr@3x.png
/data/data/####/home-stagescar@2x.png
/data/data/####/home-stagescar@3x.png
/data/data/####/home_a6L@2x.png
/data/data/####/home_a6L@3x.png
/data/data/####/home_glk@2x.png
/data/data/####/home_glk@3x.png
/data/data/####/home_new@2x.png
/data/data/####/home_new@3x.png
/data/data/####/home_priceoff@2x.png
/data/data/####/home_priceoff@3x.png
/data/data/####/home_yfnd@3x.png
/data/data/####/home_zero@2x.png
/data/data/####/home_zero@3x.png
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/iconfont.css
/data/data/####/iconfont.eot
/data/data/####/iconfont.svg
/data/data/####/iconfont.ttf
/data/data/####/iconfont.woff
/data/data/####/imgScroll.js
/data/data/####/index.html
/data/data/####/index.min.css
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/installmentService.js
/data/data/####/intention.html
/data/data/####/intention.js
/data/data/####/intentionService.js
/data/data/####/isbindService.js
/data/data/####/iscroll-probe.js
/data/data/####/iscroll.js
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/journal.tmp
/data/data/####/jquery.min.js
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/list-noData.html
/data/data/####/list.html
/data/data/####/list.js
/data/data/####/loading-icon.gif
/data/data/####/loading.gif
/data/data/####/loading.min.js
/data/data/####/loading.png
/data/data/####/loanService.js
/data/data/####/loan_contract.html
/data/data/####/loan_contract.js
/data/data/####/locationService.js
/data/data/####/login.html
/data/data/####/login.js
/data/data/####/logo@2x.png
/data/data/####/logo@3x.png
/data/data/####/main.html
/data/data/####/main.js
/data/data/####/modelModule.js
/data/data/####/multidex.version.xml
/data/data/####/news@2x.png
/data/data/####/news@3x.png
/data/data/####/noData-appriaisal.png
/data/data/####/noData-appriaisal@3x.png
/data/data/####/noData.html
/data/data/####/noDate-peccancy.png
/data/data/####/noDate-peccancy@3x.png
/data/data/####/noRecord.png
/data/data/####/noRecord@3x.png
/data/data/####/noRepaidData.html
/data/data/####/noRepayData.html
/data/data/####/no_login.html
/data/data/####/nonData.html
/data/data/####/notice@2x.png
/data/data/####/notice@3x.png
/data/data/####/noticeService.js
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/openApp.js
/data/data/####/overlay.html
/data/data/####/overlay.min.css
/data/data/####/payment_history.html
/data/data/####/payment_history.js
/data/data/####/peccancyService.js
/data/data/####/photoSwipe.min.css
/data/data/####/photoSwipe.min.js
/data/data/####/pickAreaDirective.js
/data/data/####/pinyin.js
/data/data/####/pop_bargain.html
/data/data/####/pop_bargain.js
/data/data/####/pop_callup400.html
/data/data/####/pop_callup400.js
/data/data/####/pop_depreciate.html
/data/data/####/pop_depreciate.js
/data/data/####/pop_received.html
/data/data/####/pop_received.js
/data/data/####/preview_float.html
/data/data/####/preview_float.js
/data/data/####/protocol.html
/data/data/####/protocol.js
/data/data/####/province-data.min.js
/data/data/####/pull-down.gif
/data/data/####/pull-icon@2x.png
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/record@2x.png
/data/data/####/record@3x.png
/data/data/####/refresh@2x.png
/data/data/####/refresh@3x.png
/data/data/####/refreshArrow.png
/data/data/####/refreshArrow@3x.png
/data/data/####/repayment.html
/data/data/####/repayment.js
/data/data/####/require.min.js
/data/data/####/result.html
/data/data/####/result.js
/data/data/####/round.png
/data/data/####/route.js
/data/data/####/run.pid
/data/data/####/say.min.js
/data/data/####/scrollbar.css
/data/data/####/scrollbar.png
/data/data/####/searchCity.html
/data/data/####/searchCity.js
/data/data/####/serviceModule.js
/data/data/####/share@2x.png
/data/data/####/share@3x.png
/data/data/####/skip.html
/data/data/####/skip.js
/data/data/####/submit_fail@2x.png
/data/data/####/submit_fail@3x.png
/data/data/####/submit_result.html
/data/data/####/submit_result.js
/data/data/####/submit_sucess@2x.png
/data/data/####/submit_sucess@3x.png
/data/data/####/sucsessT.png
/data/data/####/sucsessT@3x.png
/data/data/####/superspecial.html
/data/data/####/superspecial.js
/data/data/####/supportBank@2x.png
/data/data/####/supportBank@3x.png
/data/data/####/tankuang.png
/data/data/####/tankuang@3x.png
/data/data/####/tdata_JNg986
/data/data/####/tdata_JNg986.jar
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_iRz660
/data/data/####/tdata_iRz660.jar
/data/data/####/tdata_zzW503
/data/data/####/tdata_zzW503.jar
/data/data/####/text.min.js
/data/data/####/tip.html
/data/data/####/tip.js
/data/data/####/tip.min.js
/data/data/####/tween.min.js
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/userService.js
/data/data/####/util.js
/data/data/####/validate.html
/data/data/####/validate.js
/data/data/####/version.txt
/data/data/####/webViewBridge.js
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/xcarloan_Banner@2x.png
/data/data/####/xcarloan_Banner@3x.png
/data/data/####/xcarloan_arrow@2x.png
/data/data/####/xcarloan_arrow@3x.png
/data/data/####/xcarloan_devide@2x.png
/data/data/####/xcarloan_devide@3x.png
/data/data/####/xcarloan_function1@2x.png
/data/data/####/xcarloan_function1@3x.png
/data/data/####/xcarloan_function2@2x.png
/data/data/####/xcarloan_function2@3x.png
/data/data/####/xcarloan_function3@2x.png
/data/data/####/xcarloan_function3@3x.png
/data/data/####/xcarloan_tips1@2x.png
/data/data/####/xcarloan_tips1@3x.png
/data/data/####/xcarloan_tips2@2x.png
/data/data/####/xcarloan_tips2@3x.png
/data/data/####/xcarloan_tips3@2x.png
/data/data/####/xcarloan_tips3@3x.png
/data/data/####/zepto.min.js
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/344972fa03385da99c0a21270cf3d484.0.tmp
/data/media/####/344972fa03385da99c0a21270cf3d484.1.tmp
/data/media/####/35704a8150cc51222386627dee57a33c.0.tmp
/data/media/####/35704a8150cc51222386627dee57a33c.1.tmp
/data/media/####/370eaff6470548b2b119c9b42b9b8b0d.0.tmp
/data/media/####/370eaff6470548b2b119c9b42b9b8b0d.1.tmp
/data/media/####/3a854a496fc522a8f3677f9c0d1047a6.0.tmp
/data/media/####/3a854a496fc522a8f3677f9c0d1047a6.1.tmp
/data/media/####/48c516fe588a1c1efb358ef44a29e1fe.0.tmp
/data/media/####/48c516fe588a1c1efb358ef44a29e1fe.1.tmp
/data/media/####/500e63350696fe1292d7bc3779f56ebf.0.tmp
/data/media/####/500e63350696fe1292d7bc3779f56ebf.1.tmp
/data/media/####/7c3db8ff38314c58f708ee2f4f8bed82.0.tmp
/data/media/####/7c3db8ff38314c58f708ee2f4f8bed82.1.tmp
/data/media/####/98ef9700b2a983a0bf854fc48063b72b.0.tmp
/data/media/####/98ef9700b2a983a0bf854fc48063b72b.1.tmp
/data/media/####/9fe99d8c0c10463bcb92001b6937700b.0.tmp
/data/media/####/9fe99d8c0c10463bcb92001b6937700b.1.tmp
/data/media/####/a34ce9eb2db0c373c65572f41de84dac.0.tmp
/data/media/####/a34ce9eb2db0c373c65572f41de84dac.1.tmp
/data/media/####/af364f9ca50ae8a51110e793faa687b0.0.tmp
/data/media/####/af364f9ca50ae8a51110e793faa687b0.1.tmp
/data/media/####/app.db
/data/media/####/b33f2b36e5ee4613fe8a53f7f0e9ade4.0.tmp
/data/media/####/b33f2b36e5ee4613fe8a53f7f0e9ade4.1.tmp
/data/media/####/com.btjf.app.cheok.bin
/data/media/####/com.btjf.app.cheok.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/conlts.dat
/data/media/####/d0c5b59f53d690d8b14e5742571d2326.0.tmp
/data/media/####/d0c5b59f53d690d8b14e5742571d2326.1.tmp
/data/media/####/d423f909804f175b9a947e4563063fed.0.tmp
/data/media/####/d423f909804f175b9a947e4563063fed.1.tmp
/data/media/####/f373d1552aa711423d3ec3df7702b1f1.0.tmp
/data/media/####/f373d1552aa711423d3ec3df7702b1f1.1.tmp
/data/media/####/f6733f4914c3eb129cfd4f7d5c3d5a31.0.tmp
/data/media/####/f6733f4914c3eb129cfd4f7d5c3d5a31.1.tmp
/data/media/####/f6775024dc9c38160af294313f2ef271.0.tmp
/data/media/####/f6775024dc9c38160af294313f2ef271.1.tmp
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/journal.tmp
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/tdata_JNg986
/data/media/####/tdata_MkX219
/data/media/####/tdata_iRz660
/data/media/####/tdata_zzW503
/data/media/####/test.log
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.receiver.GTCustomService 24722 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.receiver.GTCustomService 24722 300 0

Loads the following dynamic libraries:

BaiduMapSDK_base_v4_2_1
getuiext2
libjiagu
locSDK7a

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
RSA
RSA-ECB-NoPadding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial