Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.728.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) dl.api.kyli####.com:80
- TCP(HTTP/1.1) 1####.75.3.32:8961
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) n.3####.com:80
- TCP(HTTP/1.1) cdn.1####.wang:80
- TCP(HTTP/1.1) tt.kyli####.com:80
- TCP(HTTP/1.1) www.a.sh####.com:80
- TCP(HTTP/1.1) api.ila####.com:80
- TCP(HTTP/1.1) beacon####.aliy####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) p.icap####.com:6088
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) api.con####.kyli####.com:666
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) 4####.97.20.12:80
- TCP(HTTP/1.1) weiboi####.g####.sina####.com:80
- TCP(HTTP/1.1) rcv.ila####.com:80
- TCP(HTTP/1.1) 4a34####.cdn.uc####.####.cn:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) yun.tui####.com.####.com:80
- TCP(HTTP/1.1) 1####.75.3.32:8881
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) ubv.91####.com:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) p####.q####.cn.####.net:80
- TCP(HTTP/1.1) p.rqco####.com:8806
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) apk.91h####.com:80
- TCP(HTTP/1.1) sdk.c####.com:80
- TCP(HTTP/1.1) api.map.b####.com:80
- TCP(HTTP/1.1) hjq.91h####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) m.jis####.com:80
- TCP(HTTP/1.1) d####.wos####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(TLS/1.0) u####.36####.com.cn:443
- TCP(TLS/1.0) yun.d####.com.cn:443
- TCP(TLS/1.0) an####.l####.com:443
- TCP(TLS/1.0) n.3####.com:443
- TCP(TLS/1.0) cdn-dai####.36####.com.####.com:443
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP(TLS/1.0) fp.fraudme####.cn:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) co####.b0.a####.com:443
- TCP(TLS/1.0) en####.tui####.com:443
- TCP(TLS/1.0) fp-st####.b0.a####.com:443
- TCP(TLS/1.0) sh.wagbr####.ta####.com:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP(TLS/1.0) fp.ton####.net:443
- TCP(TLS/1.0) acti####.tui####.com:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) embe####.d####.com.cn:443
- TCP(TLS/1.0) yun.tuis####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) api.map.b####.com:443
- TCP(TLS/1.0) acti####.yu####.com.####.com:443
- TCP(TLS/1.0) mkt.36####.com.cn:443
- TCP(TLS/1.0) l####.ne####.com:443
- TCP(TLS/1.0) ada####.ut.ta####.com:443
- TCP(TLS/1.0) yun.tui####.com.####.com:443
- TCP(TLS/1.0) so.pyti####.com.####.com:443
- TCP ope####.m.ta####.com:443
- TCP umengj####.m.ta####.com:80
Запросы DNS:
- a####.man.aliy####.com
- a####.u####.com
- acti####.tui####.com
- acti####.yu####.com
- ada####.ut.ta####.com
- adas####.ut.ta####.com
- adser####.go####.com
- adser####.go####.nl
- ag####.m.ta####.com
- amdc####.m.ta####.com
- an####.l####.com
- and####.b####.qq.com
- and####.cli####.go####.com
- api.con####.kyli####.com
- api.ila####.com
- api.map.b####.com
- apk.91h####.com
- beacon####.aliy####.com
- c####.mm####.com
- c.08####.com
- c.72####.com
- c.c####.com
- cdn-dai####.36####.com.cn
- cdn.1####.wang
- cdn.ne####.com
- d####.wos####.com
- dl.api.kyli####.com
- embe####.d####.com.cn
- en####.tui####.com
- fp.fraudme####.cn
- fp.ton####.net
- googl####.g.doublec####.net
- hjq.91h####.com
- hm.b####.com
- kldyn####.u####.uc####.####.cn
- l####.ne####.com
- l####.tbs.qq.com
- loc.map.b####.com
- log.u####.com
- m.jis####.com
- mi.g####.qq.com
- mkt.36####.com.cn
- mo####.b####.com
- mobads-####.b####.com
- mti.3####.com
- n.3####.com
- oc.u####.com
- p####.q####.cn
- p.icap####.com
- p.rqco####.com
- pag####.googles####.com
- plb####.u####.com
- qzones####.g####.cn
- rcv.ila####.com
- s####.e.qq.com
- s####.u####.com
- s.08####.com
- s19.c####.com
- s22.c####.com
- sdk.c####.com
- so.pyti####.com
- st####.fraudme####.cn
- tt.kyli####.com
- u####.36####.com.cn
- u####.u####.com
- ubv.91####.com
- umen####.m.ta####.com
- umengj####.m.ta####.com
- www.b####.com
- wx1.sin####.cn
- wx2.sin####.cn
- wx3.sin####.cn
- wx4.sin####.cn
- yun.d####.com.cn
- yun.tui####.com
- yun.tuis####.com
- z8.c####.com
Запросы HTTP GET:
- 4a34####.cdn.uc####.####.cn/1529304175106_utils.ttf
- api.ila####.com/c/_ii_?_=####
- api.ila####.com/c/szssl_20_sdk
- api.ila####.com/e/i.html
- api.ila####.com/e/i.js
- api.ila####.com/update_ch/common/core.jar
- api.ila####.com/update_ch/common/coreconfig.jar
- apk.91h####.com/apk/p_le_16.png
- apk.91h####.com/apk/urlparse_66275_a.zip
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/z_stat.php?id=####&web_id=####
- cdn.1####.wang/sc_151_3
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?987221d####
- m.jis####.com/
- m.jis####.com/main.js
- mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
- mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
- mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7051.jar
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1529819938778=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1529819938795=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1529819938797=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1529819938799=####
- n.3####.com/Clickad/hbtest?s=####&u=####&aaid=####&prid=####&wkid=####&r...
- p####.q####.cn.####.net/vcover_hz_pic/0/hn8yue62el9kwxr1529770138/498
- p####.tc.qq.com/qzone/biz/res/tmpl/js/finger.js
- p.rqco####.com:8806/c/1529819955222
- pag####.googles####.com/pagead/gen_204?id=####&scrl=####&adk=####&adf=##...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20180618/r20180604/show_ads_impl.js
- rcv.ila####.com/report2?t=####&h1=####&c=####&v=####&op1=####&op2=####&n...
- sh.wagbr####.alibaba####.com/bar/get/55a51a9867e58e7eb10055b7/?ud_get=####
- weiboi####.g####.sina####.com/large/005tPktsly1fsjxt9fmoog30b4069he9.gif
- weiboi####.g####.sina####.com/large/681ab3edgy1fsgge7h45ug20b40691kx.gif
- weiboi####.g####.sina####.com/mw690/006qOKOtgy1fpdqti1045j30m80cqn3s.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1fshnzq15yvj30mn0dl1b8.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1fsimbo7qohj30po0frh9t.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1fsjqftnp2fj30q70g24qp.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1fsk1i1830bj30qe0g7156.jpg
- weiboi####.g####.sina####.com/mw690/006zfkKAgy1fslji73db0j30o20egn9z.jpg
- weiboi####.g####.sina####.com/small/006qOKOtgy1fjsgasqnj0g30460463ya.gif
- www.a.sh####.com/error.html
- www.a.sh####.com/search/error.html
- yun.tui####.com.####.com/cnzz_yxs061.html
- yun.tui####.com.####.com/data/materiel/20180514112707.jpg
- yun.tui####.com.####.com/images/close_green.png
- yun.tui####.com.####.com/images/sign-ad.png
- yun.tui####.com.####.com/init/index.html
- yun.tui####.com.####.com/js/fingerprint2.min.js
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- a####.u####.com/app_logs
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- and####.b####.qq.com/rqd/async
- and####.b####.qq.com/rqd/async?aid=####
- api.con####.kyli####.com:666/v1/config
- api.map.b####.com/iplookup/iplookup.php?format=####&s=####&nt=####&n=###...
- beacon####.aliy####.com/beacon/fetch/config/byappkey
- d####.wos####.com/upload/longheartbeat.jsp
- d####.wos####.com/upload/sdklongheartbeat.jsp
- dl.api.kyli####.com/v2/load/mobile
- hjq.91h####.com/hjq/ip/getarea?s=####&nt=####&n=####&o=####&v=####&c=###...
- l####.tbs.qq.com/ajax?c=####&k=####
- loc.map.b####.com/sdk.php
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- p.icap####.com:6088/s/
- p.rqco####.com:8806/p/1529819955883
- s####.e.qq.com/activate
- sdk.c####.com/versiontapi.php?v=####&type=####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- tt.kyli####.com/v1/task/mobile
- ubv.91####.com/uav/ac.do
- ubv.91####.com/uav/as.do
- ubv.91####.com/ubv/col/app.do
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/03751BCA345F56C07CFA4B3FF24986DC.jar
- /data/data/####/03751BCA345F56C07CFA4B3FF24986DC.tmp
- /data/data/####/0eec63f487f3ce3e61c83c53ce955676d9366da6ad7c3cc....0.tmp
- /data/data/####/1002
- /data/data/####/1004
- /data/data/####/1529819936031.log
- /data/data/####/1529819936031.log.bak
- /data/data/####/2aaf83c3ae139a1d7f4d536bd1308ff5.0.tmp
- /data/data/####/2aaf83c3ae139a1d7f4d536bd1308ff5.1.tmp
- /data/data/####/2f73afe84fbf53b4f2ba3f30bdcf33828bcf7a48f205936....0.tmp
- /data/data/####/2fd6e23610af5bd3ca16ab29eac152d9170ab17e2e735f9....0.tmp
- /data/data/####/42678220e860a37a001a4cc991c189c3a15f4c1fc7d4851....0.tmp
- /data/data/####/471397940.dex
- /data/data/####/471397940.jar
- /data/data/####/5ce86bbaef78b70ca84620333c7227dedba8d455837a7a5....0.tmp
- /data/data/####/5ecf620504e01259ce6e9a293d1f4d1e.0.tmp
- /data/data/####/5ecf620504e01259ce6e9a293d1f4d1e.1.tmp
- /data/data/####/6a13c1f0100bc3f9258685d958c840d6193a9cb3e2a9adf....0.tmp
- /data/data/####/9fd0d0c4bb8210214f362f7e67bce453.0.tmp
- /data/data/####/9fd0d0c4bb8210214f362f7e67bce453.1.tmp
- /data/data/####/ACCS_BINDumeng;55a51a9867e58e7eb10055b7.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml.bak (deleted)
- /data/data/####/AGOO_BIND.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/RSS_PL_COUNTLY_STORE.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/UTCommon.xml
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__2540d991-e14b-49c0-9b9...00.jar
- /data/data/####/__xadsdk__remote__final__9ea7c67e-f4d8-4df1-abc...74.jar
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/__xadsdk__remote__final__builtinversion__.jar
- /data/data/####/__xadsdk__remote__final__running__.jar
- /data/data/####/__xadsdk_downloaded__version__.xml
- /data/data/####/accs.db-journal
- /data/data/####/agoo.pid
- /data/data/####/android-util.ttf
- /data/data/####/android-util.zip
- /data/data/####/ap.Lock
- /data/data/####/app_spf_scli.xml
- /data/data/####/authStatus_org.keke.tv.vod;remote.xml
- /data/data/####/ax_c.xml
- /data/data/####/b82400f5dea49cda33c3c80ff06a772ba9baeec4d7d8558....0.tmp
- /data/data/####/bdd68e1ab5097f8eda4ebe1381d5680741cbc043264a4a1....0.tmp
- /data/data/####/bugly_db_-journal
- /data/data/####/bugly_db_legu-journal
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
- /data/data/####/core.jar.tm
- /data/data/####/core_info
- /data/data/####/coreconfig.jar.tm
- /data/data/####/corelib.tmp.jar
- /data/data/####/crashrecord.xml
- /data/data/####/d4f4331afdaeb6c44998dc76baaa745f89c63a718bfa04b....0.tmp
- /data/data/####/d8e8812a7f4aaf00af60aaa53388df3688cd32d1610f651....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/default.xml
- /data/data/####/defaultpref1.xml
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/diary.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/file_multithreading_info.db-journal
- /data/data/####/firll.dat
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_suid
- /data/data/####/hh_9.0.dex
- /data/data/####/hst.db
- /data/data/####/hst.db-journal
- /data/data/####/http_api.ilabtap.com_0.localstorage-journal
- /data/data/####/http_c.080644.com_0.localstorage-journal
- /data/data/####/http_m.jisuanq.com_0.localstorage-journal
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/i==1.2.0&&4.4.3_1529819936270_envelope.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/install_sent.xml
- /data/data/####/journal.tmp
- /data/data/####/kk_spf.xml
- /data/data/####/libcuid.so
- /data/data/####/libshahe.so
- /data/data/####/libshella-2.8.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mc_cache.xml
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/odddk.xml
- /data/data/####/oglfvj
- /data/data/####/onlineconfig_agent_online_setting_org.keke.tv.vod.xml
- /data/data/####/org.keke.tv.vod.BETA_VALUES.xml
- /data/data/####/org.keke.tv.vod_preferences.xml
- /data/data/####/p.l
- /data/data/####/pl_sp.xml
- /data/data/####/plugin_v3_471397940.jar.lock
- /data/data/####/plugins.xml
- /data/data/####/rdata_@apkloader-unique.pkgname@.new
- /data/data/####/rws_sp.xml
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/security_info
- /data/data/####/sp_config.xml
- /data/data/####/sp_rvp.xml
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_config.xml.bak
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/umeng_socialize.xml
- /data/data/####/update_lc
- /data/data/####/ut.db
- /data/data/####/ut.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/xconfig.xml
- /data/data/####/xsdk_preference.xml
- /data/data/####/xsdk_preference.xml.bak (deleted)
- /data/data/####/ysdq.xml
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.jsDex.apk
- /data/media/####/.nomedia
- /data/media/####/.umm.dat
- /data/media/####/.urlparse.zip
- /data/media/####/790435b71a3e49f6a5705121e9f6b1d2
- /data/media/####/9030c496c07e47f9804e82a1a5465236
- /data/media/####/9a70670752714a7885d5f89fb0472540
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/adv
- /data/media/####/config
- /data/media/####/deviceId
- /data/media/####/deviceToken
- /data/media/####/f8b4a5566226425cb9f0d7b2709f188b
- /data/media/####/master
- /data/media/####/master.lock
- /data/media/####/urlparse.js
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:55a51a9867e58e7eb10055b7","utdid":"Wy8zH48Dz+gDAGdzx1H7lYNt","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- cat /proc/cpuinfo
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 /data/user/0/<Package>/tx_shell/libnfix.so
- chmod 700 /data/user/0/<Package>/tx_shell/libshella-2.8.so
- chmod 700 /data/user/0/<Package>/tx_shell/libufix.so
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- ls /
- ls /sys/class/thermal
- sh
Загружает динамические библиотеки:
- Bugly
- libnfix
- libshahe
- libshella-2.8
- libufix
- locSDK7a
- nfix
- tnet-3.1
- ufix
- ut_c_api
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
