Adware.Gexin.124

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) sdk.o####.amp.####.com:80
TCP(HTTP/1.1) up####.sdk.jig####.cn:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) 4####.89.76.73:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) idu####.qini####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 4####.89.76.10:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) cdn.a####.com:80
TCP(SSL/3.0) 4####.89.76.73:443
TCP(TLS/1.0) h####.qktou####.com:443
TCP(TLS/1.0) cdn.aicli####.com:443
TCP(TLS/1.0) idu####.qini####.com:443
TCP(TLS/1.0) 4####.89.76.73:443
TCP(TLS/1.0) api.a####.com:443
TCP(TLS/1.0) h####.qktou####.com.####.com:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) lo####.qutou####.net:443
TCP(TLS/1.0) 59.1####.123.81:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226
UDP 1####.168.62.1:137
TCP ope####.m.ta####.com:443

Запросы DNS:

7j####.c####.z0.####.com
a####.u####.com
ag####.m.ta####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.a####.com
cdn.aicli####.com
ddd.1####.com
h####.1####.com
h####.1####.com
h####.1####.com
h####.qktou####.com
h####.qktou####.com
h5####.1####.com
i####.1####.com
lo####.qutou####.net
log.1####.com
msg.umengc####.com
pub-####.qin####.com
qfy.innot####.com
recall-####.1####.com
res####.a####.com
sdk.c####.ig####.com
sdk.o####.amp.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.1####.com
umen####.m.ta####.com
up####.sdk.jig####.cn
upd####.a####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&OSVers...
api.1####.com/app/coldStart?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/eventConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getAdConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getConfig?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/getGuide?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/app/start?model=####&lon=####&OSVersion=####&deviceCode=##...
api.1####.com/content/getDefaultChannelList?lon=####&OSVersion=####&devi...
api.1####.com/qupwd/config?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/welfare/redbagconfig?lon=####&OSVersion=####&deviceCode=##...
api.a####.com/show?CAAQBA.####
api.a####.com/show?CAAQMA.####
cdn.a####.com//uploads/13f6650ed205af4dafa07f2683247bd1_1520475_225_150....
cdn.a####.com//uploads/508e7b7870db6b4610959e8d45da753f_1514438_225_150....
cdn.a####.com//uploads/7f8692ef3cbeb9ab6766c51156944dec_1514438_225_150....
cdn.a####.com//uploads/964336bb8a821f1b009e4166407740e9_1514438_225_150....
cdn.a####.com//uploads/d4378e52efa24b1be08878dd8d81da20_1520475_225_150....
cdn.a####.com//uploads/e4f2c0640da15889e526e4508430e7c6_1520475_225_150....
i####.1####.com/qukan_new2/dest/art2/read/art2/template.html
i####.1####.com/qukan_new2/dest/art2/read/art2/template.html.md5
idu####.qini####.com/image/sp/2018/04/12/148a91e973f72c57e313f0fe52b008e...
idu####.qini####.com/image/sp/2018/04/24/d924bb0a82c950831205052271f531d...
idu####.qini####.com/qupost/image/sp/2018/07/05/1530798706187.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/05/1530798706581.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/05/15307987069.jpeg?imageVi...
idu####.qini####.com/qupost/image/sp/2018/07/08/1531025750627.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/08/153102575622.jpeg?imageV...
idu####.qini####.com/qupost/image/sp/2018/07/08/1531025761327.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/12/1531365530661.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/12/1531365531810.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/12/1531365531920.jpeg?image...
log.1####.com/a.gif?lon=####&OSVersion=####&deviceCode=####&error_code=#...
log.1####.com/a.gif?lon=####&index=####&op=####&OSVersion=####&deviceCod...
sdk.o####.amp.####.com/api.htm?format=####&t=####
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_BAI450
sni.c####.q####.####.net/tdata_Fus136
sni.c####.q####.####.net/tdata_YJA893
t####.c####.q####.####.com/tdata_EDT356

Запросы HTTP POST:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.1####.com/member/isDeviceReport
api.a####.com/v3/json
c-h####.g####.com/api.php?format=####&t=####
ddd.1####.com/report
sdk.o####.p####.####.com/api.php?format=####&t=####
up####.sdk.jig####.cn/v1/push/sdk/postlist

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/3786484d287ac7663589cd229293bbae9ee029c9b1debcd....0.tmp
/data/data/####/458a236eeb48e33e5fe093446511164a65299c00f8aa6cd....0.tmp
/data/data/####/4e8cb8645b4809ca8bb7510a2a9532ddd843e3e873987d4....0.tmp
/data/data/####/5914a8d7ac14eec5cdc43f91fa59c46e811cd4adda1b972....0.tmp
/data/data/####/5f57573c26cab1989e06d99464aebf7816267b4303b5e95....0.tmp
/data/data/####/68f40f52c5a9baa281ccb4e02bd44aa0c885ac4440bc251....0.tmp
/data/data/####/7c96c2aad83f079a3072a99904dcc1976802de82804992a....0.tmp
/data/data/####/7fa38db1a434b8003194dc1fa324053ab03d5248c72c241....0.tmp
/data/data/####/ACCS_BINDumeng;57578e4d67e58e4c810000d2.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK.xml (deleted)
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/RA8dMkvQTEOXkRcpxRgJke3K
/data/data/####/RD74ZJjKlkJxkNthcYJJJoJb
/data/data/####/REJDzvaqk0bsr_rWHg3khuSM
/data/data/####/REONrJrCb07hk4WCg_XTgviV
/data/data/####/REtCtuvam0s3stPJg5fNdVNi
/data/data/####/RFk8MH-4PkJXhvZ1pVQZt_PZ
/data/data/####/RGWxAZP5ckSbo4Lbzg-9m-HG
/data/data/####/RGdG96-6DU4Bmk5RDQeB0YQO
/data/data/####/RITq6qLvzEcepqZCBCuuHLAD
/data/data/####/RKJqrG72HkTNlZ1DlC5-7bi4
/data/data/####/RKt-hRma309ajzcdgfqcyF0x
/data/data/####/RLnmgZ4YikSyiMA11Ly8NvAD
/data/data/####/RLnnibYFZkfhpFQBTWJW3r4L
/data/data/####/RO_u1YimQU7wqlVNu1pZRx80
/data/data/####/ROjEuZBlXEjRpTwZCGeKYBOi
/data/data/####/RPloiPO5skGxlovzKtsXNqG9
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_download_1531538771
/data/data/####/accs.db-journal
/data/data/####/ad682ad31c2fdb9893d669cc67d48af208f72f9a6dbab33....0.tmp
/data/data/####/agoo.pid
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/ce5fbfbfc2a3a969ccd4bc1d45a6a2737941ae301bca34c....0.tmp
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.jifen.qukan-journal
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan.xml.bak
/data/data/####/com.jifen.qukan.xml.bak (deleted)
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/crashrecord.xml
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db288d15af70
/data/data/####/e46e7c9dde67c2fcd88338be9f217af97045e92ddbf98b5....0.tmp
/data/data/####/e7df78e0b158a054b9bc78db63acb14eff07ea8ae7f69a5....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/libjiagu-1385524905.so
/data/data/####/libwgs2gcj.so
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/secid
/data/data/####/security_info
/data/data/####/sensorsdata.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_Fus136
/data/data/####/tdata_Fus136.jar
/data/data/####/tdata_YJA893
/data/data/####/tdata_YJA893.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.acid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.acid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.74f9af2a1233161067ccef0ab406443a.cuid
/data/media/####/.79594990e265ac60591761aa24fbd681.acid
/data/media/####/.79594990e265ac60591761aa24fbd681.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.919166631283dc3099cc3b24dc440014.acid
/data/media/####/.919166631283dc3099cc3b24dc440014.cuid
/data/media/####/.953c80ff9827cbb183369e675c974bc1.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.aio.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.acid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.f4e8fb1b9b24e8d4a8e49c675baf05db.cuid
/data/media/####/.nomedia
/data/media/####/1e9e8d2176a1caf557b50677f5a7c903
/data/media/####/78e033c3c32036074d3703e86bdd71be
/data/media/####/82d9013b9bd0a047404e1c4056f16fe6
/data/media/####/8b0975e7edf6a977cfaa206112657326
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a91bc0ba77fe4a3b816a39bae64d8881
/data/media/####/aacout
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/b2cb38053bda7f003ede73700c692e60
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/deviceToken
/data/media/####/fbf601216417a676bb0bc14716821449
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/qtac
/data/media/####/red_dot_navigationSelected.png
/data/media/####/red_dot_navigationUnSelected.png
/data/media/####/systemccu
/data/media/####/systtk
/data/media/####/tabtkae
/data/media/####/tdata_BAI450
/data/media/####/tdata_Fus136
/data/media/####/tdata_YJA893
/data/media/####/template.html
/data/media/####/test.log
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac
/data/media/####/wxtoatk

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57578e4d67e58e4c810000d2","utdid":"W0ltSitV9OwDAGdzx1H6mOOD","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.service.GTCoreService 24479 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/app_bin/daemon
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu-1385524905.so
date
df
getprop
getprop net.hostname
getprop ro.boot.bootloader
getprop ro.build.date.utc
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
id
ls -l
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
service call iphonesubinfo 1
sh
sh -c cat /proc/devices
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /system && stat app
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh -c echo NjZFODMyMjA3N0UxMjYzODlBRjlBMDQyQTMxRkYzQUU4OEMyRjM6RjBENEYxOkUxMUIyQg== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo NjZFODMyMjA3N0UxMjYzODlBRjlBMDQyQTMxRkYzQUU4OEMyRjM6RjBENEYxOkUxMUIyQg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QkRFNjUxNTEwQjdBQkFGQjI2QjlGQTFDNEZBQzZGMjUxNTMxNTM4Nzcy > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo QkRFNjUxNTEwQjdBQkFGQjI2QjlGQTFDNEZBQzZGMjUxNTMxNTM4Nzcy > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c echo RDRBRUMwODE4QUE0Qzg2MThFMTM4RTlGRkQwNjA3ODUzQTY4Q0M6QkY4MTE3OjREMDVFQg== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo RDRBRUMwODE4QUE0Qzg2MThFMTM4RTlGRkQwNjA3ODUzQTY4Q0M6QkY4MTE3OjREMDVFQg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh <Package Folder>/files/RD74ZJjKlkJxkNthcYJJJoJb
sh <Package Folder>/files/REJDzvaqk0bsr_rWHg3khuSM
sh <Package Folder>/files/REONrJrCb07hk4WCg_XTgviV
sh <Package Folder>/files/REtCtuvam0s3stPJg5fNdVNi
sh <Package Folder>/files/RFk8MH-4PkJXhvZ1pVQZt_PZ
sh <Package Folder>/files/RGdG96-6DU4Bmk5RDQeB0YQO
sh <Package Folder>/files/RITq6qLvzEcepqZCBCuuHLAD
sh <Package Folder>/files/RKJqrG72HkTNlZ1DlC5-7bi4
sh <Package Folder>/files/RLnmgZ4YikSyiMA11Ly8NvAD
sh <Package Folder>/files/ROjEuZBlXEjRpTwZCGeKYBOi
sh <Package Folder>/files/RPloiPO5skGxlovzKtsXNqG9
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.service.GTCoreService 24479 300 0
stat app
stat cat

Загружает динамические библиотеки:

Bugly
InnoSecure
InnoSo
NativeExample
du
getuiext2
jcore118
libjiagu-1385524905
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней