Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.728.origin
- Android.HiddenAds.180.origin
- Android.HiddenAds.181.origin
- Android.Triada.222.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m.jis####.com:80
- TCP(HTTP/1.1) 1####.75.3.32:8961
- TCP(HTTP/1.1) ubv.91####.com:80
- TCP(HTTP/1.1) 1####.38.56.105:80
- TCP(HTTP/1.1) d####.91h####.com:80
- TCP(HTTP/1.1) dl.api.kyli####.com:80
- TCP(HTTP/1.1) wn.pos.b####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) n.3####.com:80
- TCP(HTTP/1.1) ub####.baidust####.com:80
- TCP(HTTP/1.1) a####.b####.qq.com:8011
- TCP(HTTP/1.1) ada####.m.ta####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) int.d####.s####.####.cn:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) api.con####.kyli####.com:666
- TCP(HTTP/1.1) s.08####.com.####.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) n####.hatch####.com:8080
- TCP(HTTP/1.1) cdn.1####.wang:80
- TCP(HTTP/1.1) 4####.97.20.12:80
- TCP(HTTP/1.1) weiboi####.g####.sina####.com:80
- TCP(HTTP/1.1) car.moyum####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) p.icap####.com:6088
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) 1####.75.3.32:8881
- TCP(HTTP/1.1) ad####.m.ta####.com:80
- TCP(HTTP/1.1) img1-do####.b0.a####.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) d####.wos####.com:80
- TCP(HTTP/1.1) p.rqco####.com:8806
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) apk.91h####.com:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(HTTP/1.1) api.map.b####.com:80
- TCP(HTTP/1.1) 4a34####.cdn.uc####.####.cn:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) a####.a####.m.####.com:80
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP(TLS/1.0) vt####.y####.com:443
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) n.3####.com:443
- TCP(TLS/1.0) weiboi####.g####.sina####.com:443
- TCP(TLS/1.0) api.map.b####.com:443
- TCP(TLS/1.0) owe.joy-r####.com:9050
- TCP(TLS/1.0) s.08####.com.####.com:443
- TCP(TLS/1.0) a####.a####.m.####.com:443
- TCP(TLS/1.0) aserver####.m.ta####.com:443
- TCP(TLS/1.0) log.mm####.com:443
- UDP 2####.255.255.250:1900
- TCP umengj####.m.ta####.com:80
- TCP ope####.m.ta####.com:443
Запросы DNS:
- a####.b####.qq.com
- a####.m.ta####.com
- a####.man.aliy####.com
- a####.u####.com
- ad####.m.ta####.com
- ada####.m.ta####.com
- adser####.go####.com
- adser####.go####.nl
- aexcep####.b####.qq.com
- ag####.m.ta####.com
- and####.b####.qq.com
- api.con####.kyli####.com
- api.map.b####.com
- apk.91h####.com
- c####.mm####.com
- c.08####.com
- c.c####.com
- car.moyum####.com
- cdn.1####.wang
- cdn.joy-r####.com
- cle.3####.com
- d####.91h####.com
- d####.wos####.com
- dl.api.kyli####.com
- googl####.g.doublec####.net
- h####.c####.com
- hm.b####.com
- i####.doub####.com
- int.d####.s####.####.cn
- kldyn####.u####.uc####.####.cn
- l####.tbs.qq.com
- loc.map.b####.com
- log.mm####.com
- log.u####.com
- m.b####.com
- m.jis####.com
- mi.g####.qq.com
- mo####.b####.com
- mobads-####.b####.com
- msg.umengc####.com
- mti.3####.com
- n####.hatch####.com
- n.3####.com
- oc.u####.com
- owe.joy-r####.com
- p.icap####.com
- p.rqco####.com
- p98c7####.bkt.clo####.com
- pag####.googles####.com
- q####.qq.com
- qzones####.g####.cn
- s####.e.qq.com
- s####.u####.com
- s.08####.com
- s22.c####.com
- ub####.baidust####.com
- ubv.91####.com
- umen####.m.ta####.com
- umengj####.m.ta####.com
- ups.y####.com
- vt####.y####.com
- wn.pos.b####.com
- wx1.sin####.cn
- wx2.sin####.cn
- wx3.sin####.cn
- wx4.sin####.cn
- z8.c####.com
Запросы HTTP GET:
- 4####.97.20.12/ad/ad_size.do?ss=####&appcode=####&s=####&nt=####&n=####&...
- 4a34####.cdn.uc####.####.cn/1527602219098_utils.ttf
- ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
- apk.91h####.com/apk/p_le_16.png
- apk.91h####.com/apk/urlparse_66252_a.zip
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/z_stat.php?id=####&web_id=####
- car.moyum####.com/nfile/mkres/mudata.zip
- car.moyum####.com/nfile/mkres/mures.zip
- cdn.1####.wang/sc_151_3
- d####.91h####.com/ad/ad_size.do?ss=####&appcode=####&s=####&nt=####&n=##...
- d####.91h####.com/danmu/querypart.php?seg=####&part=####&lekuid=####&ste...
- d####.c####.l####.####.com/16047176-6a17-44ad-8910-7c75bc7a090cbdco_20037
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?987221d####
- img1-do####.b0.a####.com/view/photo/l/public/p2522410329.webp
- m.jis####.com/
- m.jis####.com/main.js
- mi.g####.qq.com/gdt_mview.fcg?adposcount=####&charset=####&datafmt=####&...
- mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
- mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
- mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7048.jar
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1527675076264=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1527675076288=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1527675076302=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1527675076324=####
- n####.hatch####.com:8080/adv_platform/getJarVersion/keli04/23/cn
- n.3####.com/Clickad/hbtest?s=####&u=####&aaid=####&prid=####&wkid=####&r...
- p####.tc.qq.com/qzone/biz/res/tmpl/js/finger.js
- p####.tc.qq.com/qzone/qzact/act/game/ad/proxy/index.html
- p.rqco####.com:8806/c/1527675089754
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20180521/r20180525/show_ads_impl.js
- s.08####.com.####.com/cnzz_yxs061.html
- s.08####.com.####.com/data/materiel/20180514112707.jpg
- s.08####.com.####.com/images/close_green.png
- s.08####.com.####.com/images/sign-ad.png
- s.08####.com.####.com/js/fingerprint2.min.js
- s.08####.com.####.com/proxy/indexd.html
- sh.wagbr####.alibaba####.com/bar/get/55a51a9867e58e7eb10055b7/?ud_get=####
- t####.c####.q####.####.com/path_jar_keli04_cn_update.dat
- ub####.baidust####.com/media/v1/0f000KgiX_hNtBczMJ-Ulf.jpg
- wap.n.sh####.com/mobads.php?af00000####
- weiboi####.g####.sina####.com/large/006zfkKAgy1frrz3jr8klj31jk111qjr.jpg
- weiboi####.g####.sina####.com/large/006zfkKAgy1frt7mh6zdcj30w80k07q4.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1frd8s1pbbuj30q80g37pi.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1frm8r3gascj30zj0lth3d.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1frr1lwqhnmj30qe0g7tu6.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1frr20u4gmrj30ri0gvwpr.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1frt4p355d0j30oz0eze81.jpg
- weiboi####.g####.sina####.com/small/006qOKOtgy1fjsgasqnj0g30460463ya.gif
- wn.pos.b####.com/adx.php?c=####&ext=####
- z.c####.com/stat.htm?id=####&cnzz_eid=####
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- 4####.97.20.12/ad/ad_behave.do?ss=####&appcode=####&s=####&nt=####&n=###...
- 4####.97.20.12/ad/ad_default.do?ss=####&appcode=####&s=####&nt=####&n=##...
- 4####.97.20.12/ad/ad_info.do?ss=####&appcode=####&s=####&nt=####&n=####&...
- 4####.97.20.12/ysdq-web/baodian/detail.do?s=####&nt=####&n=####&o=####&v...
- 4####.97.20.12/ysdq-web/center/key.do?s=####&nt=####&n=####&o=####&v=###...
- 4####.97.20.12/ysdq-web/center/uploadusetime.do?s=####&nt=####&n=####&o=...
- 4####.97.20.12/ysdq-web/main/catalogue.do?s=####&nt=####&n=####&o=####&v...
- 4####.97.20.12/ysdq-web/main/main.do?s=####&nt=####&n=####&o=####&v=####...
- 4####.97.20.12/ysdq-web/main/mymaintag.do?s=####&nt=####&n=####&o=####&v...
- 4####.97.20.12/ysdq-web/more/list.do?s=####&nt=####&n=####&o=####&v=####...
- 4####.97.20.12/ysdq-web/second/yingping.do?s=####&nt=####&n=####&o=####&...
- a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&platform=####&v=#...
- a####.b####.qq.com:8011/rqd/async
- a####.u####.com/app_logs
- ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- and####.b####.qq.com/rqd/async?aid=####
- api.con####.kyli####.com:666/v1/config
- api.map.b####.com/location/ip?ak=####&mcode=####&s=####&nt=####&n=####&o...
- d####.91h####.com/ysdq-web/center/key.do?s=####&nt=####&n=####&o=####&v=...
- d####.91h####.com/ysdq-web/more/list.do?s=####&nt=####&n=####&o=####&v=#...
- d####.wos####.com/upload/longheartbeat.jsp
- d####.wos####.com/upload/sdklongheartbeat.jsp
- d####.wos####.com/upload/shortheartbeat.jsp
- dl.api.kyli####.com/v2/load/mobile
- int.d####.s####.####.cn/iplookup/iplookup.php?format=####&s=####&nt=####...
- l####.tbs.qq.com/ajax?c=####&k=####
- loc.map.b####.com/sdk.php
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- p.icap####.com:6088/s/
- p.rqco####.com:8806/p/1527675090398
- s####.e.qq.com/activate
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- ubv.91####.com/uav/ac.do
- ubv.91####.com/uav/as.do
- ubv.91####.com/ubv/col/app.do
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.flv
- /data/data/####/.imprint
- /data/data/####/.mp4
- /data/data/####/03751BCA345F56C07CFA4B3FF24986DC.jar
- /data/data/####/03751BCA345F56C07CFA4B3FF24986DC.tmp
- /data/data/####/0f25f104c2eeb95dc56a75f4c58d1a7a.0.tmp
- /data/data/####/0f25f104c2eeb95dc56a75f4c58d1a7a.1.tmp
- /data/data/####/1002
- /data/data/####/1004
- /data/data/####/1527675072740.log
- /data/data/####/2592c3b393bf94cc75fac72b80b449795d8989caa67488c....0.tmp
- /data/data/####/3018798.jar
- /data/data/####/30c6416a4f3f6bf0c62cc424dddc2f0269b38e1ccb5b018....0.tmp
- /data/data/####/3323003.jar
- /data/data/####/3323003.ttf
- /data/data/####/399e9fd565edf7d1c4669a54045a6227a35308fd8bc381b....0.tmp
- /data/data/####/40fbe4afaa2f031b208decb2ccef55224df9f78c8b66aad....0.tmp
- /data/data/####/471397940.dex
- /data/data/####/471397940.jar
- /data/data/####/4ed0cf1726040eb2aacfe592f1fd1dfe03e0799f8026fd4....0.tmp
- /data/data/####/5dcbf8ee828e30652fde78f0bf8a4495c70455b5f07ef77....0.tmp
- /data/data/####/5ee6dc1dd80c3b4679ff6196a9709c5521f5c0f5f3d1d37....0.tmp
- /data/data/####/62ac1cd9316c77cb3cb9112f525f514bed68d80a9ac5989....0.tmp
- /data/data/####/6a13c1f0100bc3f9258685d958c840d6193a9cb3e2a9adf....0.tmp
- /data/data/####/6d2de5938f3204a183fd789fbf5a4731.0.tmp
- /data/data/####/6d2de5938f3204a183fd789fbf5a4731.1.tmp
- /data/data/####/6de5e04e4ec7de105a38703036e591c780ce6070aeac4da....0.tmp
- /data/data/####/82fa2c82932d275d4a0521de0be5dd63a6ad354eaa21b77....0.tmp
- /data/data/####/89cffb4f977c798c48d46996569e7e1191e273403ec1e48....0.tmp
- /data/data/####/8bdc06af6b008912120e7351844014cb9083e614897e455....0.tmp
- /data/data/####/905502b0c9102dcd029295c3e412381adf08e8cbc6f1da2....0.tmp
- /data/data/####/ACCS_BINDumeng;55a51a9867e58e7eb10055b7.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/EventDex.dex
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/UTCommon.xml
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__send_data_1527675088533
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__4d557d3e-9977-48e1-bbd...a6.jar
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/__xadsdk__remote__final__builtinversion__.jar
- /data/data/####/__xadsdk__remote__final__running__.jar
- /data/data/####/__xadsdk_downloaded__version__.xml
- /data/data/####/accs.db-journal
- /data/data/####/ads2017
- /data/data/####/agoo.pid
- /data/data/####/android-util.ttf
- /data/data/####/android-util.zip
- /data/data/####/ap.Lock
- /data/data/####/authStatus_org.keke.tv.vod;remote.xml
- /data/data/####/bc53a3d3f6f79d27cb8995ba5989465d43e9205a91f791d....0.tmp
- /data/data/####/bdco
- /data/data/####/bdco.cf
- /data/data/####/bugly_db_-journal
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c3a3aebea68a7cda4401df0e2fd66ff2a77899547b5bd94....0.tmp
- /data/data/####/c3c9f7caebf171a8c531824c9809bac4.0.tmp
- /data/data/####/c3c9f7caebf171a8c531824c9809bac4.1.tmp
- /data/data/####/c831d32e307beaedae192228119e3b58df3ba7ebea971a6....0.tmp
- /data/data/####/cb5e8758f81764e91fa242d7caa8d6f67b4bfb54e407f5f....0.tmp
- /data/data/####/cc6d7406a766c52f837cd48abe3fe749706d1ac183db8d5....0.tmp
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/core_info
- /data/data/####/corelib.tmp.jar
- /data/data/####/crashrecord.xml
- /data/data/####/data.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/default.xml
- /data/data/####/defaultpref1.xml
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/df7f5de902849f41878bd8ae0527c14d2ca051ee5c9c040....0.tmp
- /data/data/####/diary.xml
- /data/data/####/e74de05128e03a36609a74c33503ca42.0.tmp
- /data/data/####/e74de05128e03a36609a74c33503ca42.1.tmp
- /data/data/####/ea6e95840340c2a79afbca82247338e49abb2121350f35a....0.tmp
- /data/data/####/evtlog.dat
- /data/data/####/exchangeIdentity.json
- /data/data/####/f58c0b1e9def8103477e2a52de7b2ebb89a95c4d2de0851....0.tmp
- /data/data/####/f8ed9b1aad79da13e10c01eb5b8ab2a516864e848611d6c....0.tmp
- /data/data/####/f9e8d6e773677fc8d4718e9f2a633c59.0.tmp
- /data/data/####/f9e8d6e773677fc8d4718e9f2a633c59.1.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/file_multithreading_info.db-journal
- /data/data/####/firll.dat
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_suid
- /data/data/####/hst.db
- /data/data/####/hst.db-journal
- /data/data/####/http_cle.35kds.com_0.localstorage-journal
- /data/data/####/http_m.jisuanq.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/install_sent.xml
- /data/data/####/journal.tmp
- /data/data/####/kk_spf.xml
- /data/data/####/libcuid.so
- /data/data/####/libnfix.so
- /data/data/####/libshahe.so
- /data/data/####/libshella-2.8.so
- /data/data/####/local_crash_lock
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/mures.dex
- /data/data/####/native_record_lock
- /data/data/####/odddk.xml
- /data/data/####/oglfvj
- /data/data/####/onlineconfig_agent_online_setting_org.keke.tv.vod.xml
- /data/data/####/org.keke.tv.vod.BETA_VALUES.xml
- /data/data/####/org.keke.tv.vod_preferences.xml
- /data/data/####/p.l
- /data/data/####/path_jar_keli04_cn_update.temp (deleted)
- /data/data/####/pl_sp.xml
- /data/data/####/plugin_v3_471397940.jar.lock
- /data/data/####/plugins.xml
- /data/data/####/rdata_@apkloader-unique.pkgname@.new
- /data/data/####/res.tmp
- /data/data/####/rws_sp.xml
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/security_info
- /data/data/####/sp_config.xml
- /data/data/####/sp_rvp.xml
- /data/data/####/success
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/unit__local_last_session.json
- /data/data/####/unit__local_stat_cache.json
- /data/data/####/update_lc
- /data/data/####/ut.db
- /data/data/####/ut.db-journal
- /data/data/####/util_HtCfg.xml
- /data/data/####/util_MEvtSave.xml
- /data/data/####/util_RSS_COUNTLY_STORE.xml
- /data/data/####/util___Baidu_Stat_SDK_SendRem.xml
- /data/data/####/util_baidu_mtj_sdk_record.xml
- /data/data/####/util_bridads.xml
- /data/data/####/util_bugly_db_-journal
- /data/data/####/util_count_control.xml
- /data/data/####/util_crashrecord.xml
- /data/data/####/util_ljtq.xml
- /data/data/####/util_rws_sp.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/ysdq.xml
- /data/media/####/-1478978029.xml
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.jsDex.apk
- /data/media/####/.nomedia
- /data/media/####/.timestamp
- /data/media/####/.urlparse.zip
- /data/media/####/224f20ed644249998310297e3bdfb1fe
- /data/media/####/508fb1564db94cfb8eed694b9549b860
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/YvscMPs.xml
- /data/media/####/adv
- /data/media/####/c1342c30640f4ab1a46ee650496dd683
- /data/media/####/config
- /data/media/####/deviceId
- /data/media/####/deviceToken
- /data/media/####/inapp_20180530.log
- /data/media/####/master
- /data/media/####/master.lock
- /data/media/####/tbslog.txt
- /data/media/####/urlparse.js
- /data/media/####/urlparse.js (deleted)
- /data/media/####/webinfo.xml
- /data/media/####/yoh.dat
- /data/media/####/yol.dat
- /data/media/####/yom.dat
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:55a51a9867e58e7eb10055b7","utdid":"Ww54v6EzcKQDAGdzx1EmmbtK","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
- cat /proc/cpuinfo
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 /data/user/0/<Package>/tx_shell/libnfix.so
- chmod 700 /data/user/0/<Package>/tx_shell/libshella-2.8.so
- chmod 700 /data/user/0/<Package>/tx_shell/libufix.so
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.display.id
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.smartisan.version
- getprop ro.vivo.os.build.display.id
- getprop ro.vivo.os.version
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh
Загружает динамические библиотеки:
- Bugly
- ijkffmpeg
- ijkplayer
- ijksdl
- libnfix
- libshahe
- libshella-2.8
- libufix
- locSDK7a
- ndkbitmap
- nfix
- tnet-3.1
- ufix
- ut_c_api
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- DES-ECB-NoPadding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
