Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) 1####.76.76.76:53
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) imgal####.res.m####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) bc.g####.gosu####.COm:80
- TCP(HTTP/1.1) com####.hun####.com:80
- TCP(HTTP/1.1) bc.g####.gosu####.Com:80
- TCP(HTTP/1.1) videoc####.api.hun####.com:80
- TCP(HTTP/1.1) d####.t####.m####.com:80
- TCP(HTTP/1.1) 1####.h####.i####.tv:80
- TCP(HTTP/1.1) v1.res.log.####.com:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) mobi####.bz.m####.com:80
- TCP(HTTP/1.1) 1####.56.116.48:80
- TCP(HTTP/1.1) pcvid####.m####.com.####.net:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) hun####.m.cn.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) img.m####.com.####.com:80
- TCP(HTTP/1.1) m.i####.com:80
- TCP(HTTP/1.1) pcvid####.t####.m####.####.cOm:80
- TCP(HTTP/1.1) mo####.api.hun####.com:80
- TCP(HTTP/1.1) 4####.h####.com.####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) s.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) 3####.h####.i####.tv:80
- TCP(HTTP/1.1) pcvid####.t####.m####.####.COM:80
- TCP(HTTP/1.1) vhun####.adma####.com.cn:80
- TCP(HTTP/1.1) i####.jd.com:80
- TCP(HTTP/1.1) e####.h####.com.####.com:80
- TCP(HTTP/1.1) rc.mpp.hun####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) y.da.hun####.com:80
- TCP(HTTP/???) y.da.hun####.com:80
- TCP(TLS/1.0) pcwe####.log.m####.com:443
- TCP(TLS/1.0) m.i####.com:443
- TCP(TLS/1.0) rc.m####.com:443
- TCP(TLS/1.0) mst####.api.m####.com:443
- TCP(TLS/1.0) glb.m.m####.com:443
- TCP(TLS/1.0) mo####.api.hun####.com:443
- TCP(TLS/1.0) 4####.h####.com.####.com:443
- TCP(TLS/1.0) v2.log.m####.com:443
- TCP(TLS/1.0) cl####.adma####.com.cn:443
- TCP(TLS/1.0) 3####.h####.i####.tv:443
- TCP(TLS/1.0) ov.da.m####.com:443
- TCP(TLS/1.0) si####.api.m####.com:443
- TCP(TLS/1.0) mobi####.bz.m####.com:443
- TCP(TLS/1.0) web-####.t####.m####.com:443
- TCP(TLS/1.0) hd-####.log.m####.com:443
- TCP(TLS/1.0) com####.m####.com:443
- TCP(TLS/1.0) 1####.h####.i####.tv:443
- TCP(TLS/1.0) ox.da.m####.com:443
- TCP(TLS/1.0) img.m####.com.####.com:443
- TCP(TLS/1.0) vhun####.adma####.com.cn:443
- TCP sdk.o####.t####.####.com:5224
- TCP 42.62.1####.27:5224
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- PCVId####.T####.M####.COM
- PCvID####.T####.m####.CoM
- PcViD####.t####.M####.CoM
- PcvId####.t####.M####.COm
- a####.u####.com
- ap####.v0.m####.com
- api####.a####.com
- apm.log.hun####.com
- au.u####.com
- av####.h####.com
- c-h####.g####.com
- cl####.adma####.com.cn
- com####.hun####.com
- com####.m####.com
- d####.t####.m####.com
- e####.h####.com
- err.da.hun####.com
- g####.api.m####.com
- g####.hun####.com
- glb.m.m####.com
- h####.m####.com
- hd-####.log.m####.com
- hun####.m.cn.####.com
- i####.com
- i####.jd.com
- i4.hun####.com
- i5.hun####.com
- img.m####.com
- imgal####.res.m####.com
- js.m####.com
- log.da.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.i####.com
- m.m####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- mobi####.bz.m####.com
- mst####.api.m####.com
- ov.da.m####.com
- ox.da.m####.com
- pCvID####.T####.m####.coM
- pCviD####.T####.M####.cOm
- pcVid####.t####.M####.CoM
- pcviD####.T####.M####.Com
- pcwe####.log.m####.com
- pl####.log.hun####.com
- rc.m####.com
- rc.mpp.hun####.com
- s####.t####.i####.tv
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.i####.####.com
- sdk.o####.t####.####.com
- si####.api.m####.com
- t####.nz.ig####.com
- use####.api.max.####.com
- v1.res.log.####.com
- v2.log.hun####.com
- v2.log.m####.com
- v2.res.log.####.com
- v5m.api.m####.com
- vhun####.adma####.com.cn
- videoc####.api.hun####.com
- web-####.t####.m####.com
- www.qchann####.cn
- x.da.hun####.com
- y.da.hun####.com
Запросы HTTP GET:
- 1####.h####.i####.tv/preview/cms_icon/2018/03/20180309201204849.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180411100040436.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180411174720393.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180411174753892.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180414211624927.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180418102915065.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180418170017654.gif
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180419104413515.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180419113803499.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180419113936730.gif
- 1####.h####.i####.tv/preview/cms_icon/2018/04/20180419235102895.jpg
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4322288/201803...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4334034/201803...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4341637/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4348944/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4358204/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4358762/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4358917/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4358918/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4358926/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322562/4358929/201804...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/323564/4356679/201804...
- 1####.h####.i####.tv/s1/2016/yuanxiao/icon/dubo.png
- 1####.h####.i####.tv/s1/2016/yuanxiao/icon/yugao.png
- 1####.h####.i####.tv/s1/2016/yuanxiao/vip_v_icon.png
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4352046/201804...
- 4####.h####.com.####.com/preview/cms_icon/2018/04/20180414185655971.jpg
- ap####.v0.m####.com/buffer.php?td=####&net=####&istry=####&aver=####&tim...
- ap####.v0.m####.com/pv.php?cpn=####&nt=####&sid=####&did=####&fpn=####&c...
- ap####.v0.m####.com/pv.php?cpn=40&nt=4&sid=459030f0-1d3c-48d9-8401-1aed3...
- ap####.v0.m####.com/pv.php?cpn=56&nt=4&sid=459030f0-1d3c-48d9-8401-1aed3...
- bc.g####.gosu####.COm/pb/2018/03/30/1024/39D3D7C88E306B98C9F45BC17E521EA...
- bc.g####.gosu####.Com/pb/2018/04/13/1039/952AF500086F12E1D5F45A639FB0A04...
- com####.hun####.com/comment/read?uid=####&pageCount=####&osVersion=####&...
- com####.hun####.com/mobile_comment/top?uid=####&osVersion=####&ticket=##...
- d####.t####.m####.com/vod.do?arange=####&fid=####&gsid=####&pm=####&ver=...
- e####.h####.com.####.com/2/mava2_044oiDK47gB9S2SV7GGeyt2bnmwEKlqi.jpg
- e####.h####.com.####.com/5/cd2f1cc8/b7b1th5mugg6brhcmh70?x-oss-process=#...
- e####.h####.com.####.com/5/d6f087df/b75jg7un9l20953spnd0?x-oss-process=#...
- e####.h####.com.####.com/6/1dd12bc4/WOUiC5zZyWKezHdj?x-oss-process=####
- e####.h####.com.####.com/6/33462235/b61kt2tmugg6rpureb5g?x-oss-process=#...
- e####.h####.com.####.com/6/a0819394/b3mdv1en9l22j8vuo30g?x-oss-process=#...
- e####.h####.com.####.com/7/64a3a86b/b3udqkmn9l22phf5un4g?x-oss-process=#...
- e####.h####.com.####.com/7snfB4Smq57mnGIQuEJhfCXEjbUwzL.jpg?x-oss-proces...
- g####.hun####.com/mobile/distribute.do?deviceid=####
- hun####.m.cn.####.com/x/k=2076405&p=7DzsP&dx=0&rt=2&ns=95.211.190.198&ni...
- hun####.m.cn.####.com/x/k=2078477&p=7EYuu&dx=0&rt=2&ns=95.211.190.198&ni...
- i####.jd.com/dsp/np?posid=####&v=####&union_id=####&pid=####&tagid=####
- img.m####.com.####.com/5/1613860e/WOTfQJzZyWKelPD9?x-oss-process=####
- img.m####.com.####.com/5/60d38b6e/b54ucq6n9l22phfgmnp0?x-oss-process=####
- img.m####.com.####.com/5/ef8e9162/b67uj9lmugg6rpuvb99g?x-oss-process=####
- imgal####.res.m####.com/mediafiles/wiad_creative/1126/15236332052864.jpg
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.da.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- m.i####.com/cfg/appkey-75071557860d6b8a
- mo####.api.hun####.com/channel/getDetail?uid=####&osVersion=####&ticket=...
- mo####.api.hun####.com/channel/getList?uid=####&osVersion=####&ticket=##...
- mo####.api.hun####.com/mobile/getCategorys?uid=####&osVersion=####&ticke...
- mo####.api.hun####.com/mobile/getRsaKey?userId=####&osVersion=####&seqId...
- mo####.api.hun####.com/mobile/iconLink?uid=####&osVersion=####&ticket=##...
- mo####.api.hun####.com/mobile/loadimage?uid=####&osVersion=####&ticket=#...
- mo####.api.hun####.com/mobile/uip?uid=####&osVersion=####&ticket=####&ap...
- mo####.api.hun####.com/mobile/update
- mo####.api.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=###...
- mo####.api.hun####.com/v1/config/play?chip=####&mp_version=####&os=####&...
- mo####.api.hun####.com/v2/video/getMultiplyList?uid=####&pageCount=####&...
- mo####.api.hun####.com/v2/video/getShortList?uid=####&osVersion=####&tic...
- mo####.api.hun####.com/v5/video/getVideoInfo?uid=####&osVersion=####&tic...
- mo####.api.hun####.com/v6/video/getSource?uid=####&osVersion=####&ticket...
- mo####.api.hun####.com/video/getSupport?uid=####&osVersion=####&ticket=#...
- mobi####.bz.m####.com/channel/getDetail?uid=####&osVersion=####&ticket=#...
- mobi####.bz.m####.com/channel/getList?uid=####&osVersion=####&ticket=###...
- mobi####.bz.m####.com/mobile/getCategorys?uid=####&osVersion=####&ticket...
- mobi####.bz.m####.com/mobile/iconLink?uid=####&osVersion=####&ticket=###...
- mobi####.bz.m####.com/mobile/loadimage?uid=####&osVersion=####&ticket=##...
- mobi####.bz.m####.com/user/payConfig?uid=####&osVersion=####&ticket=####...
- mobi####.bz.m####.com/v1/config/play?chip=####&mp_version=####&os=####&t...
- mobi####.bz.m####.com/v2/video/getMultiplyList?uid=####&pageCount=####&o...
- mobi####.bz.m####.com/v2/video/getShortList?uid=####&osVersion=####&tick...
- mobi####.bz.m####.com/v5/video/getVideoInfo?uid=####&osVersion=####&tick...
- mobi####.bz.m####.com/v6/video/getSource?uid=####&osVersion=####&ticket=...
- mobi####.bz.m####.com/video/getSupport?uid=####&osVersion=####&ticket=##...
- pcvid####.m####.com.####.net/pb/2018/04/18/1155/235B46A284FBF579AA87F49D...
- pcvid####.t####.m####.####.COM/pb/2018/03/30/1024/39D3D7C88E306B98C9F45B...
- pcvid####.t####.m####.####.COM/pb/2018/04/18/1155/235B46A284FBF579AA87F4...
- pcvid####.t####.m####.####.cOm/c1/2018/04/19_0/00CF601F829C189E4AEF09A36...
- pcvid####.t####.m####.####.cOm/pb/2018/03/30/1252/C064588C69942C1C2C0548...
- pcvid####.t####.m####.####.cOm/pb/2018/04/13/1039/6D9CC88F6B30D13C86E23A...
- pl####.log.hun####.com/ad.gif?os=####&app=####&d=####&error=####&cache=#...
- pl####.log.hun####.com/playerQuality.gif?chip=####&first_frame_time=####...
- rc.mpp.hun####.com/mobile/v1/cms/alike?uid=####&osVersion=####&ticket=##...
- rc.mpp.hun####.com/mobile/v1/cms?uid=####&osVersion=####&ticket=####&app...
- t####.c####.q####.####.com/tdata_gCF347
- t####.c####.q####.####.com/tdata_wkF366
- ti####.c####.l####.####.com/config/bj-bjv4.conf
- ti####.c####.l####.####.com/config/hz-bjv4.conf
- use####.api.max.####.com/AOC14689425695885112cea980c59c1265ccf2fb23a9ffb...
- use####.api.max.####.com/AOC147991531532426788720266ad75ab5b07c2ddf211d4...
- v1.res.log.####.com/info.php?f=0&ex=&e=9.200001.0&b=1&c=1&mod=<System Pr...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- v2.log.hun####.com/info.php?f=0&ex=&e=105000&b=1&c=1&mod=<System Propert...
- vhun####.adma####.com.cn/i/a106470,b2477214,c1370,i0,m202,8a2,8b1,f95.21...
- videoc####.api.hun####.com/addPlayCount.php?uid=####&osVersion=####&tick...
- y.da.hun####.com/app/click?adid=####&adtotal=####&appver=####&b=####&cc=...
- y.da.hun####.com/app/impression?adid=####&adtotal=####&appver=####&b=###...
- y.da.hun####.com/app/midpoint?adid=####&adtotal=####&appver=####&b=####&...
- y.da.hun####.com/err?adid=####
- y.da.hun####.com/err?adid=####&adtotal=####&appver=####&b=####&cc=####&c...
Запросы HTTP POST:
- a####.u####.com/app_logs
- apilo####.a####.com/v3/log/init
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/r
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- m.i####.com/rec/se?_iwt_t=####&sv=####
- mo####.log.hun####.com/data.cgi
- mo####.log.hun####.com/dispatcher.do
- pl####.log.hun####.com/v1.gif
- s.wagbr####.alibaba####.com/api/check_app_update
- sdk-ope####.g####.com/api.php?format=####&t=####
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/video/player
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/35a58902f2c76fb9517172fa2d3e0440x.jar
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MATSharedPreferences.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MGTVCommon.xml.bak
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/_ire-journal
- /data/data/####/arch.xml
- /data/data/####/arch.xml.bak
- /data/data/####/cn.com.mma.mobile.tracking.normal.xml
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/exchangeIdentity.json
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/increment.db-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu-2104211903.so
- /data/data/####/mgsdk.xml
- /data/data/####/multidex.version.xml
- /data/data/####/playinfo.db
- /data/data/####/playinfo.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/run.pid
- /data/data/####/tdata_gCF347.jar
- /data/data/####/tdata_gCF347.tmp
- /data/data/####/tdata_wkF366.jar
- /data/data/####/tdata_wkF366.tmp
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/zbe634dae.xml
- /data/media/####/.nomedia
- /data/media/####/16oywojse2ze97xha4m5m25.tmp
- /data/media/####/184ggaejlk2ykpudk4vs9hrwd.tmp
- /data/media/####/1_log.txt
- /data/media/####/1fd4txmjfixxmlqmqeus14gje.tmp
- /data/media/####/1gu523jw7aze9uei600ncc31c.tmp
- /data/media/####/1pro1691u33aydzsh44eq2hu0.tmp
- /data/media/####/2714e8jqji0rj29joir06r11t.tmp
- /data/media/####/29oba0475urbg1hiuifaygywk.tmp
- /data/media/####/2ad8e4c47ee4a483699f4f1bd13169e6
- /data/media/####/2dbwh0mk9ehr22mwwblrewfhm.tmp
- /data/media/####/2jj7pejv2zrc7dp1ejo6k8nmx.tmp
- /data/media/####/2oaiu8fosz0xyux9guwsl95ac.tmp
- /data/media/####/2tk8tqb2zfefn4xa0xbdnw62p.tmp
- /data/media/####/2zqnry7do0ook6j548ho7mirl.tmp
- /data/media/####/39dbll9i34u007qgoacvjmqnx.tmp
- /data/media/####/3bssun9hr0tbc3n94tj5q4gq1.tmp
- /data/media/####/3iofttlbhptzs2axdi1ud1vjv.tmp
- /data/media/####/3lhtqouos7bb61nmielqgzuz4.tmp
- /data/media/####/3rqt0gd3wnebro0eer56g668j.tmp
- /data/media/####/4ge24rmb3e7ugw436sbrtefdm.tmp
- /data/media/####/4m6v8uyec3yfu5uox1bqxs7r1.tmp
- /data/media/####/4n47y7kwbf3dfhkm4108xn8iq.tmp
- /data/media/####/4qfasq35voaqqnxbzqzt6qgaq.tmp
- /data/media/####/4qfdswt317d6vixd1lg3lyukb.tmp
- /data/media/####/4yh7a885r9l39chbs654j3mdj.tmp
- /data/media/####/558yblvjej3lmf1nvaxlvo7rf.tmp
- /data/media/####/5691db8435fc24d15cd5f708e128e4b6
- /data/media/####/57532bb626293397706456260b6f2533
- /data/media/####/5dwb74g2xjth9bt0lxxdpmrgr.tmp
- /data/media/####/5fa13c86e376c04f308af0bda2a7281f
- /data/media/####/5vw0tb2wxdidhyvv20eivy5wk.tmp
- /data/media/####/5wg1km8sbu1jhcpwpwmnm2vgy.tmp
- /data/media/####/5y7hr4nihri58j6xuv0xfmg32.tmp
- /data/media/####/6188zfodlu9yr44ist7ilqv4d.tmp
- /data/media/####/620788dced76be5bcd1f1dbac278953e
- /data/media/####/637987de8c6173aab3c1d691e0d5bcea
- /data/media/####/66oabwaosq3n1wsjos8xv9hy6.tmp
- /data/media/####/6mkw3zxdu0rytt905mt7cr9l.tmp
- /data/media/####/77zqe4fg1atzb520sif1bvp9d.tmp
- /data/media/####/7a9dnes6u6geomyey5p7zg51i.tmp
- /data/media/####/7ha9zklqu2w9gsm42nz6qf4kc.tmp
- /data/media/####/7rvpbm46evf2a2buplvw4dg9.tmp
- /data/media/####/AN.csv-20180419220523
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1524175524716
- /data/media/####/UA.csv-20180419220524
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/a7ae57dd4892c3b0bf9ec3055ee6a0c6
- /data/media/####/ali9vfyydygoudupgywsivgd.tmp
- /data/media/####/apge.csv-20180419220528
- /data/media/####/apge.csv-20180419220538
- /data/media/####/apge.csv-20180419220540
- /data/media/####/apge.csv-20180419220544
- /data/media/####/apge.csv-20180419220548
- /data/media/####/apge.csv-20180419220554
- /data/media/####/apge.csv-20180419220606
- /data/media/####/apge.csv-20180419220614
- /data/media/####/apge.csv-20180419220618
- /data/media/####/app.db
- /data/media/####/bt0rdc6cg4ij0arns5p61sib.tmp
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.shg.play.daquan.db
- /data/media/####/iiysupwwf0zbsnupwp96ohhi.tmp
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/mqxuzrehup4ruww2k148yic5.tmp
- /data/media/####/qt.csv.1524175522333.txt
- /data/media/####/tdata_gCF347
- /data/media/####/tdata_wkF366
- /data/media/####/test.log
- /data/media/####/u394ikqxg6ryalgw3srzu0wf.tmp
- /data/media/####/uuid
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24851 300 0
- cat /proc/cpuinfo
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-2104211903.so
Загружает динамические библиотеки:
- CdnAuth
- MMANDKSignature
- bspatch
- libjiagu-2104211903
- mresearch
- mv3_common
- mv3_jni
- mv3_jni_4
- mv3_mpplat
- mv3_platform
- mv3_playerbase
Использует следующие алгоритмы для шифрования данных:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CFB-NoPadding
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
