Adware.Gexin.12234

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(TLS/1.0) av1.x####.com:443

DNS requests:

7f5e492####.bug####.cn
av1.x####.com
i.t####.com

File system changes:

Creates the following files:

/data/data/####/1555082232850_2296
/data/data/####/1555082232885_2296
/data/data/####/1555082232941_2296
/data/data/####/1555082233601_2351
/data/data/####/1555082233689_2351
/data/data/####/1555082234385_2401
/data/data/####/1555082234451_2401
/data/data/####/1555082237464_2461
/data/data/####/1555082237527_2461
/data/data/####/1555082238239_2511
/data/data/####/1555082238962_2559
/data/data/####/1555082240959_2619
/data/data/####/1555082241614_2667
/data/data/####/1555082242299_2715
/data/data/####/1555082243701_2773
/data/data/####/1555082244428_2821
/data/data/####/1555082245113_2869
/data/data/####/1555082247595_2928
/data/data/####/1555082248462_2976
/data/data/####/1555082249208_3024
/data/data/####/1555082252986_3083
/data/data/####/1555082253777_3131
/data/data/####/1555082254530_3179
/data/data/####/1555082256084_3237
/data/data/####/1555082256903_3285
/data/data/####/1555082257607_3333
/data/data/####/1555082261127_3392
/data/data/####/1555082261909_3440
/data/data/####/1555082262678_3488
/data/data/####/1555082266465_3546
/data/data/####/1555082267239_3595
/data/data/####/1555082267996_3643
/data/data/####/1555082269671_3703
/data/data/####/1555082271119_3751
/data/data/####/1555082271902_3799
/data/data/####/1555082273451_3858
/data/data/####/1555082274323_3906
/data/data/####/1555082275194_3954
/data/data/####/1555082277288_4013
/data/data/####/1555082278055_4061
/data/data/####/1555082278851_4109
/data/data/####/1555082282498_4166
/data/data/####/1555082283262_4214
/data/data/####/1555082284077_4262
/data/data/####/1555082287895_4319
/data/data/####/1555082288727_4365
/data/data/####/1555082289536_4411
/data/data/####/MultiDex.lock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu-917064677.so
/data/data/####/multidex.version.xml
/data/data/####/tdid.xml
/data/media/####/.nomedia
/data/media/####/.tcookieid

Miscellaneous:

Executes the following shell scripts:

getprop
logcat -v time -t 500 2296
logcat -v time -t 500 2351
logcat -v time -t 500 2401
logcat -v time -t 500 2461
logcat -v time -t 500 2511
logcat -v time -t 500 2559
logcat -v time -t 500 2619
logcat -v time -t 500 2667
logcat -v time -t 500 2715
logcat -v time -t 500 2773
logcat -v time -t 500 2821
logcat -v time -t 500 2869
logcat -v time -t 500 2928
logcat -v time -t 500 2976
logcat -v time -t 500 3024
logcat -v time -t 500 3083
logcat -v time -t 500 3131
logcat -v time -t 500 3179
logcat -v time -t 500 3237
logcat -v time -t 500 3285
logcat -v time -t 500 3333
logcat -v time -t 500 3392
logcat -v time -t 500 3440
logcat -v time -t 500 3488
logcat -v time -t 500 3546
logcat -v time -t 500 3595
logcat -v time -t 500 3643
logcat -v time -t 500 3703
logcat -v time -t 500 3751
logcat -v time -t 500 3799
logcat -v time -t 500 3858
logcat -v time -t 500 3906
logcat -v time -t 500 3954
logcat -v time -t 500 4013
logcat -v time -t 500 4061
logcat -v time -t 500 4109
logcat -v time -t 500 4166
logcat -v time -t 500 4214
logcat -v time -t 500 4262
logcat -v time -t 500 4319
logcat -v time -t 500 4365
logcat -v time -t 500 4411

Loads the following dynamic libraries:

Bugtags
LanSongffmpeg
libjiagu-917064677

Uses the following algorithms to encrypt data:

DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial