Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) res.qhup####.com:80
- TCP(HTTP/1.1) t####.me####.com:80
- TCP(HTTP/1.1) sh####.360t####.com:80
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) p6.q####.com:80
- TCP(HTTP/1.1) qos.l####.360.cn:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) m3.s.3####.cn:80
- TCP(HTTP/1.1) api.k.36####.com:80
- TCP(HTTP/1.1) dsp.tou####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) p7.q####.com:80
- TCP(HTTP/1.1) app.v.k.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) s####.s.360.cn:80
- TCP(HTTP/1.1) p1.q####.com:80
- TCP(HTTP/1.1) u.api.l####.####.cn:80
- TCP(HTTP/1.1) ab####.m.s.####.cn:80
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) sdk.l####.360.cn:80
- TCP(HTTP/1.1) p.s.3####.cn:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) s####.l####.360.####.com:80
- TCP(HTTP/1.1) k####.36####.com:80
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP(TLS/1.0) t####.me####.com:443
- TCP(TLS/1.0) app.k.36####.com:443
- TCP(TLS/1.0) mdm.ope####.360.cn:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) s####.tf.360.cn:443
- TCP(TLS/1.0) sdkc####.e.360.cn:443
- TCP(TLS/1.0) cc.p####.dc.####.cn:443
- TCP(TLS/1.0) api####.me####.com:443
- TCP(TLS/1.0) s####.j####.cn:443
- TCP c####.g####.ig####.com:5227
- TCP 1####.163.230.182:80
- TCP umengj####.m.ta####.com:80
- TCP 1####.121.49.81:7000
- UDP s.j####.cn:19000
- TCP sdk.o####.t####.####.com:5224
- TCP ope####.m.ta####.com:443
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.man.aliy####.com
- ab####.m.s.####.cn
- ag####.m.ta####.com
- amdc####.m.ta####.com
- api####.me####.com
- api.k.36####.com
- app.k.36####.com
- app.v.k.####.com
- c####.g####.ig####.com
- c-h####.g####.com
- cc.p####.dc.####.cn
- dsp.tou####.com
- k####.36####.com
- m####.me####.com
- m3.s.3####.cn
- mdm.ope####.360.cn
- msg.umengc####.com
- p.s.3####.cn
- p0.q####.com
- p1.q####.com
- p10.qhi####.com
- p2.q####.com
- p3.q####.com
- p4.q####.com
- p5.q####.com
- p6.q####.com
- p7.q####.com
- p8.q####.com
- p9.q####.com
- plb####.u####.com
- pub-####.qin####.com
- qos.l####.360.cn
- res.qhup####.com
- s####.j####.cn
- s####.l####.360.cn
- s####.s.360.cn
- s####.tf.360.cn
- s.j####.cn
- s3m.me####.com
- sdk.c####.ig####.com
- sdk.l####.360.cn
- sdk.l####.360.cn
- sdk.me####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sdkc####.e.360.cn
- sf1-ttc####.ps####.com
- sh####.360t####.com
- sh####.me####.com
- t####.me####.com
- u####.u####.com
- u.api.l####.####.cn
- umen####.m.ta####.com
- umengj####.m.ta####.com
- up####.sdk.jig####.cn
Запросы HTTP GET:
- ab####.m.s.####.cn/abtest/cloud.so?appkey=####&dt=####&os=####&ov=####&m...
- app.v.k.####.com/vod-xinxiliu-tv-q3-bj/39908398_0ea5a6f62-5c7d-48ae-943c...
- dsp.tou####.com/api/max/ads/show?extra=8####&price=####
- k####.36####.com//k2/appconfig/getjar?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/hotrizon2/appConfig?os=####&use_gear=####&time=####&sys...
- k####.36####.com/hotrizon2/author/videos?needAuthor=####&sys=####&m2=###...
- k####.36####.com/hotrizon2/authorlist?pageSize=####&appid=####&curQid=##...
- k####.36####.com/hotrizon2/channelnew?m2=####&appid=####&m=####&ch=####&...
- k####.36####.com/hotrizon2/detail?os=####&requestNum=####&sys=####&m2=##...
- k####.36####.com/hotrizon2/list?svc=####&kw=####&os=####&ckw=####&sys=##...
- k####.36####.com/hotrizon2/list?svc=####&os=####&sys=####&direction=####...
- k####.36####.com/hotrizon2/myfollower?appid=####&maxOffset=####&m=####&m...
- k####.36####.com/hotrizon2/play?id=####&appid=####&userclick=####&m=####...
- k####.36####.com/hotrizon2/play?id=####&m2=####&strategy=####&appid=####...
- k####.36####.com/hotrizon2/relate?os=####&sys=####&columns=####&m2=####&...
- k####.36####.com/hotrizon2/timeline?os=####&direction=####&sys=####&m2=#...
- k####.36####.com/hotrizon2/topic/detail?id=####&appid=####&cdn_url=####&...
- k####.36####.com/hotrizon2/topic/detail?topic_id=####&appid=####&cdn_url...
- k####.36####.com/k2/api/privacy/config?appid=####&m=####&m2=####&ch=####...
- k####.36####.com/k2/appconfig/getAbRole?os=####&time=####&sys=####&m2=##...
- k####.36####.com/k2/appconfig/getNewinfo?appid=####&m=####&m2=####&ch=##...
- k####.36####.com/k2/appconfig/getRedpackPop?appid=####&m=####&m2=####&ch...
- k####.36####.com/k2/appconfig/getplugin?appid=####&m=####&m2=####&ch=###...
- k####.36####.com/k2/appconfig/getpopup?appid=####&m=####&m2=####&ch=####...
- k####.36####.com/k2/hotrizon2/aconfig?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/k2/hotrizon2/gettime?os=####&sys=####&m2=####&appid=###...
- p1.q####.com/dr/_100_70/t01475df732fe70d335.png
- p1.q####.com/t01153c265593f3258e.jpg
- p1.q####.com/t013db82533aa9e5a9a.jpg
- p1.q####.com/t01528681e80671b045.jpg
- p1.q####.com/t01841600f4fef1f561.png
- p1.q####.com/t018a091efca6865662.jpg
- p1.q####.com/t01c1ff533a19145140.jpg
- p1.q####.com/video/568_320_70/t0185e68cb3e4b97171.webp
- p6.q####.com/dr/_100_70/t0106f423ce3e57e63f.jpg
- p6.q####.com/dr/_100_70/t01316bee53beb871a4.jpg
- p6.q####.com/dr/_100_70/t01880e5d9069476645.png
- p6.q####.com/dr/_100_70/t018f06e3ff3d37849c.jpg
- p6.q####.com/dr/_100_70/t01b3729d5cd4a9d924.png
- p6.q####.com/dr/_100_70/t01e317c30e4e9d1c96.jpg
- p6.q####.com/dr/_100_70/t01e5f6ae0812ac5855.jpg
- p6.q####.com/dr/_100_70/t01e788d03e535c3540.png
- p6.q####.com/dr/_100_70/t01fbfebb1ce15f5686.jpg
- p6.q####.com/dr/_280_50/t0139daef573e9eb4c5.webp
- p6.q####.com/dr/_280_50/t01577442b2c5f9ffdf.webp
- p6.q####.com/dr/_280_50/t01cc1b352cda2992f2.webp
- p6.q####.com/dr/_280_50/t01d3b8cda642e5098a.webp
- p6.q####.com/t0147eeb331a280d627.jpg
- p6.q####.com/t0178bccfe750f110a1.jpg
- p6.q####.com/t019f6478307ad0eea6.jpg
- p6.q####.com/video/568_320_70/t01092029eba5854eff.webp
- p6.q####.com/video/568_320_70/t01101203a3ec9a1b09.webp
- p6.q####.com/video/568_320_70/t0118271ea098c1ab98.webp
- p6.q####.com/video/568_320_70/t0122bfb8e4b2a086f9.webp
- p6.q####.com/video/568_320_70/t01271b769acaa661d2.webp
- p6.q####.com/video/568_320_70/t0139daef573e9eb4c5.webp
- p6.q####.com/video/568_320_70/t01468cf82eeafc95ec.webp
- p6.q####.com/video/568_320_70/t0166927e6619d84363.webp
- p6.q####.com/video/568_320_70/t0168acc614d183f15d.webp
- p6.q####.com/video/568_320_70/t016944014d8fe93c52.webp
- p6.q####.com/video/568_320_70/t017a69aa7558eb8577.webp
- p6.q####.com/video/568_320_70/t017ced6fccaded4746.webp
- p6.q####.com/video/568_320_70/t01a02c51c4025df926.webp
- p6.q####.com/video/568_320_70/t01a7ae2a6cb975a38f.webp
- p6.q####.com/video/568_320_70/t01a859976cf955663e.webp
- p6.q####.com/video/568_320_70/t01a8c48c514cabd3a5.webp
- p6.q####.com/video/568_320_70/t01a8f336df7b8b382b.webp
- p6.q####.com/video/568_320_70/t01ad6c257411c8fc07.webp
- p6.q####.com/video/568_320_70/t01bd9053afb004807e.webp
- p6.q####.com/video/568_320_70/t01c54d934f712a4b71.webp
- p6.q####.com/video/568_320_70/t01c997eee8d226c312.webp
- p6.q####.com/video/568_320_70/t01d1b4e61e55092fc0.webp
- p6.q####.com/video/568_320_70/t01d3b8cda642e5098a.webp
- p7.q####.com/dr/_100_70/t0106369282ad0471f9.png
- p7.q####.com/dr/_100_70/t011b248cbf49dbd131.jpg
- p7.q####.com/dr/_100_70/t01212f5d320ab949bd.jpg
- p7.q####.com/dr/_100_70/t01255bbb643ca53b85.jpg
- p7.q####.com/dr/_100_70/t01280b1e8a467d5bfc.jpg
- p7.q####.com/dr/_100_70/t01326589796ae8d615.jpg
- p7.q####.com/dr/_100_70/t01326589796ae8d615.png
- p7.q####.com/dr/_100_70/t0154941c5c1365d426.jpg
- p7.q####.com/dr/_100_70/t015e7af6fedbb584bd.jpg
- p7.q####.com/dr/_100_70/t01610ce907f6555ab4.jpg
- p7.q####.com/dr/_100_70/t01703eb3ac6cef6f3c.jpg
- p7.q####.com/dr/_100_70/t018eab0ddb57f4d537.png
- p7.q####.com/dr/_100_70/t01a913c3ff9900a256.png
- p7.q####.com/dr/_100_70/t01b8fadca86958cc28.png
- p7.q####.com/dr/_100_70/t01dfcc7b2120f3a37c.jpg
- p7.q####.com/dr/_100_70/t01edd6f2b2bc141f5d.jpg
- p7.q####.com/dr/_100_70/t01ee7582648ae7e325.jpg
- p7.q####.com/dr/_100_70/t01f5569970403903b0.png
- p7.q####.com/dr/_100_70/t01f7dfa9a24befb325.png
- p7.q####.com/dr/_200_100/t01326589796ae8d615.jpg
- p7.q####.com/t01486f677d858b956a.png
- p7.q####.com/t015c168d5a936393f8.png
- p7.q####.com/t01ae70f3f6372b712d.jpg
- p7.q####.com/t01aff0ffb7213be2b1.png
- p7.q####.com/t01bd04e3789e7e7eda.png
- p7.q####.com/t01c284e24d09f6b14d.jpg
- p7.q####.com/t01d324ec7e7ecc0948.png
- p7.q####.com/t01e69681fa8d4220ab.jpg
- p7.q####.com/t01f69aabfd118a9658.png
- p7.q####.com/t01f9458c7931fe73bc.jpg
- p7.q####.com/t01fef189e19456f75b.png
- p7.q####.com/video/568_320_70/t01103c04ad339e235d.webp
- p7.q####.com/video/568_320_70/t011f0a5e168aaa7919.webp
- p7.q####.com/video/568_320_70/t0125a1aab136e0e9e6.webp
- p7.q####.com/video/568_320_70/t01276a55ad6b660699.webp
- p7.q####.com/video/568_320_70/t0128d24ea4213765c3.webp
- p7.q####.com/video/568_320_70/t012e9a3870634d7720.webp
- p7.q####.com/video/568_320_70/t013012a6b3a4d63317.webp
- p7.q####.com/video/568_320_70/t014efea687f721dcee.webp
- p7.q####.com/video/568_320_70/t01577442b2c5f9ffdf.webp
- p7.q####.com/video/568_320_70/t015dc1d7fabe320608.webp
- p7.q####.com/video/568_320_70/t01679bd2e5516ddf68.webp
- p7.q####.com/video/568_320_70/t016b8cd736867ab11c.webp
- p7.q####.com/video/568_320_70/t016d267b013f6ffda8.webp
- p7.q####.com/video/568_320_70/t016e99855caca4960c.webp
- p7.q####.com/video/568_320_70/t016f34185496da65ad.webp
- p7.q####.com/video/568_320_70/t0174720edb86181158.webp
- p7.q####.com/video/568_320_70/t0174ac7ad68dc0a089.webp
- p7.q####.com/video/568_320_70/t018eaa07d48bdc43db.webp
- p7.q####.com/video/568_320_70/t018f2e3fbe56dfc1e7.webp
- p7.q####.com/video/568_320_70/t019649a4263a73d918.webp
- p7.q####.com/video/568_320_70/t019b827bf9ac40c30d.webp
- p7.q####.com/video/568_320_70/t019e3eedba78a4eb2a.webp
- p7.q####.com/video/568_320_70/t019fb7bc1a6f586061.webp
- p7.q####.com/video/568_320_70/t01a0d212cf09ff40ba.webp
- p7.q####.com/video/568_320_70/t01aa03a85bdefa51e1.webp
- p7.q####.com/video/568_320_70/t01af296b3c7369e862.webp
- p7.q####.com/video/568_320_70/t01b1222b41d4bca97e.webp
- p7.q####.com/video/568_320_70/t01ba1e5f219dcfed24.webp
- p7.q####.com/video/568_320_70/t01c175fa6591e8e5ce.webp
- p7.q####.com/video/568_320_70/t01c6bd3fb8f80b7734.webp
- p7.q####.com/video/568_320_70/t01c85f5e31e1fa89a1.webp
- p7.q####.com/video/568_320_70/t01cc1b352cda2992f2.webp
- p7.q####.com/video/568_320_70/t01cf6e0940557230b9.webp
- p7.q####.com/video/568_320_70/t01dc1abd058340a29f.webp
- p7.q####.com/video/568_320_70/t01de6446d111041254.webp
- p7.q####.com/video/568_320_70/t01e3cbd18f75343889.webp
- p7.q####.com/video/568_320_70/t01eb3a190b9e583eba.webp
- qos.l####.360.cn/vc.gif?&bid=####&pid=####&ver=####&c_ver=####&os=####&m...
- res.qhup####.com/360reader/disp.gif?uid=411b8e6b4e089d595f860e0777223956...
- s####.l####.360.####.com/Object.getFile/livecloudsdk/YW5kcm9pZF9wbHVnaW5...
- s####.l####.360.####.com/Object.getFile/livecloudsdk/cGx1Z2luX3lmX3AycF8...
- s####.s.360.cn/ak/6766aa2750c19aad2fa1b32f36ed4aee.html?m2=####
- s####.s.360.cn/galileo/104020_dspsourcelogo_66082d97b040fe088704e7919be8...
- s####.s.360.cn/su/index.php?k=####&av=####&slv=####&sv=####&be=####&cv=#...
- sdk.l####.360.cn/codec?os=####&tm=####&model=####&r=####&package=####&pi...
- sdk.l####.360.cn/rtc?os=####&tm=####&model=####&r=####&package=####&pid=...
- sdk.l####.360.cn/sdkconf/videoplace?sign=####&u=####&version=####&sdk_ve...
- sdk.l####.360.cn/xinxiliu_tv_android_10228.conf?os=####&tm=####&r=####&p...
- sf1-ttc####.ps####.com/obj/ad.union.api/e1328899603a64007825a2f449f7d17c
- sh####.360t####.com/171122/c867c6e2f627a813302a3a0d0d891203/FZLTHK.TTF
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_jVg168
- sni.c####.q####.####.net/tdata_pSF696
- t####.c####.q####.####.com/tdata_EDT356
- t####.me####.com/rtb?type=####&d=####&b=####&p=####&l=####&s=####&m=####...
- u.api.l####.####.cn/comment/hot?client_id=####&url=####&page_key=####&fr...
- u.api.l####.####.cn/comment/lists?client_id=####&url=####&type=####&star...
Запросы HTTP POST:
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- api.k.36####.com/k2/api/lockscreen/config?os=####&time=####&sys=####&m2=...
- c-h####.g####.com/api.php?format=####&t=####
- k####.36####.com/hotrizon2/report2?os=####&time=####&sys=####&m2=####&ap...
- k####.36####.com/k2/appconfig/getjarlist?appid=####&curEnv=####&m=####&m...
- k####.36####.com/k2/hotrizon2/getSInfo?os=####&sys=####&psw2=U-####&m2=#...
- m3.s.3####.cn/api/v1/newid
- p.s.3####.cn/pstat/plog.php
- p.s.3####.cn/update/update.php?p=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- t####.me####.com/adsdk?pver=####&skey=Ey####
- u.api.l####.####.cn/comment/lists
- up####.sdk.jig####.cn/v1/push/sdk/postlist
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/01aeebdb6aaefc918b5632e8cf8be4e584x
- /data/data/####/01b93ffdc4e258f1aa1a3d1036b5400e08x
- /data/data/####/0228bb81-ceb6-4ae3-b858-2f1c776fe6b3
- /data/data/####/2033145970-602345128
- /data/data/####/2289E276CADF4B0EFDC814915ACD4CDE.png
- /data/data/####/23fabbee-79b1-498e-a756-1921e67da33b
- /data/data/####/36b3abf9-1ad2-41f9-be30-6492fb61301c
- /data/data/####/3c2e3502-39b3-4f11-a041-681901526375
- /data/data/####/466f2e41-0e14-45a7-aea8-aa3133ae2773
- /data/data/####/76c6be41-f1a9-4c71-bf5d-5d07907adc5e
- /data/data/####/7c79e08b-f068-4543-9ee6-2f9a4e35f3b6
- /data/data/####/8c87839ccb4b
- /data/data/####/ACCS_BINDumeng;5a56c9198f4a9d0c2f0001a8.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alliance.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/FZ.TTF
- /data/data/####/JPushSA_Config.xml
- /data/data/####/MENU_CACHE.xml
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/PendantConfig.xml
- /data/data/####/QHA_JSON_PERSISTER_42998cf32d552343bc8e460416382dca
- /data/data/####/QHDeviceFile
- /data/data/####/QHDeviceID.lock
- /data/data/####/QH_DeviceSDK.xml
- /data/data/####/QH_SDK_M2.xml
- /data/data/####/QH_SDK_UserData42998cf32d552343bc8e460416382dca.xml
- /data/data/####/QH_SDK_UserData6766aa2750c19aad2fa1b32f36ed4aee.xml
- /data/data/####/QH_SDK_sessionID42998cf32d552343bc8e460416382dca.xml
- /data/data/####/TAB_CACHE.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/Y29tLmxpZ2h0c2t5LnZpZGVv.tick.lock
- /data/data/####/ab_test_config.xml
- /data/data/####/abtest_base_sp_filename42998cf32d552343bc8e4604...ca.xml
- /data/data/####/accs.db-journal
- /data/data/####/ad_config_file.xml
- /data/data/####/agoo.pid
- /data/data/####/android_player_20180716_112238_000.log_0
- /data/data/####/appPackageNames_v2
- /data/data/####/app_globel_config_file.xml
- /data/data/####/auth_guide_config_sdk.xml
- /data/data/####/b45ee5c7-9d22-45f1-854c-7e847e1c4707
- /data/data/####/b70f4a1a-0608-45ec-897b-945e89cb8e80
- /data/data/####/banner.db-journal
- /data/data/####/c43f85eb-3463-4d76-952a-5a6047c4f70f
- /data/data/####/cache.ttf
- /data/data/####/channel_webview.db-journal
- /data/data/####/cloud_config_file.xml
- /data/data/####/cloud_push_config_file.xml
- /data/data/####/cloud_switch_cache
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.rid.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/cn.jpush.preferences.v2.xml.bak (deleted)
- /data/data/####/com.qihoo.livecloud.settings.GPWebrtcSettings.pref.xml
- /data/data/####/core_update
- /data/data/####/core_update_locker
- /data/data/####/critical_service_config.xml
- /data/data/####/daemon_webview.db-journal
- /data/data/####/dbfocus-journal
- /data/data/####/device_collector
- /data/data/####/device_collector_locker
- /data/data/####/download-journal
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/ecd8e3e5-52c2-4990-b696-539e613b273d
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/finalcore.jar
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/hotrizon_sharepref.xml
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/i==1.2.0&&1.2.28_1531740131197_envelope.log
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_local_notification.db-wal
- /data/data/####/jpush_stat_cache.json
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/jpush_statistics.db-shm (deleted)
- /data/data/####/jpush_statistics.db-wal
- /data/data/####/jpushservice_webview.db-journal
- /data/data/####/libdvrender.so.tmp
- /data/data/####/libjiagu-71411075.so
- /data/data/####/libjplayer.so.tmp
- /data/data/####/liblocalserver.so.tmp
- /data/data/####/libmyssl.so.1.1.tmp
- /data/data/####/libtranscore.so.tmp
- /data/data/####/libviewer.so.tmp
- /data/data/####/light_sky_avast.xml
- /data/data/####/localserver_2.0.3.18042602.zip
- /data/data/####/locker
- /data/data/####/log_reupload_task
- /data/data/####/log_reupload_task_locker
- /data/data/####/message.db-journal
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/msg_queue
- /data/data/####/msplugin_ksp.xml
- /data/data/####/multidex.version.xml
- /data/data/####/p.l
- /data/data/####/player_20180716_112302_000.log_0
- /data/data/####/player_record_2.0.3.18051401.zip
- /data/data/####/privacy_config_file.xml
- /data/data/####/profile_task
- /data/data/####/profile_task_locker
- /data/data/####/profile_torch_platform
- /data/data/####/push.db-journal
- /data/data/####/push.pid
- /data/data/####/push_share.xml
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qhvc_plugin.xml
- /data/data/####/qpush_msg.xml
- /data/data/####/run.pid
- /data/data/####/safe_user_info_file.xml
- /data/data/####/screen_conf.xml
- /data/data/####/session_base_sp_filename42998cf32d552343bc8e460...ca.xml
- /data/data/####/session_base_sp_filenameandroidID.xml
- /data/data/####/share_data.xml
- /data/data/####/shortcut_badger_sharepref.xml
- /data/data/####/sp.livecloud.database.xml
- /data/data/####/sp_file_recommend_upload.xml
- /data/data/####/tab_request_name.xml
- /data/data/####/tdata_jVg168
- /data/data/####/tdata_jVg168.jar
- /data/data/####/tdata_pSF696
- /data/data/####/tdata_pSF696.jar
- /data/data/####/tools_2.0.3.18051401.zip
- /data/data/####/torch_sdk_config.xml
- /data/data/####/trans_20180716_112302_000.log_0
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/umeng_message_state.xml (deleted)
- /data/data/####/uninstall_apk
- /data/data/####/uninstall_apk_locker
- /data/data/####/universalPopup.xml
- /data/data/####/videolist.db-journal
- /data/data/####/waitingDown
- /data/data/####/waitingDown_locker
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/yf_p2p_201804191558.zip
- /data/media/####/-BewDF2EWCT0TxLG8dSPIjaJ0x0.898812373.tmp
- /data/media/####/-Qeyg8Lci38kCoN10PpjFRJYuJQ.-1891554884.tmp
- /data/media/####/-o3Zq5F0ndjHmVQ7jjp95MO4wPs.-1836786295.tmp
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.deviceId
- /data/media/####/.iddata
- /data/media/####/.nomedia
- /data/media/####/.push_deviceid
- /data/media/####/.sfp
- /data/media/####/.testf
- /data/media/####/.umm.dat
- /data/media/####/032rQGExBQpn7rJz7p6NZIwaqFI.-396632595.tmp
- /data/media/####/09hbxydn11zTCWVf0twAnvJAWj0.-1692057805.tmp
- /data/media/####/0CtBi_wJhxABjmJ_7aWs_Ytx534.330673237.tmp
- /data/media/####/1ylBpI9vHMBrpdsCTtXA-yuI3bY.-1140115982.tmp
- /data/media/####/3rDSsSlJx0c-iGLIulIcgAZFs5g.-560928624.tmp
- /data/media/####/42998cf32d552343bc8e460416382dca
- /data/media/####/47b14395b4ed41308ce557014815262d
- /data/media/####/4Dh0SCuYX9aJ6q1ZURawlGpMUa8.-2142498964.tmp
- /data/media/####/4TWlUphCCjb2Rh5QVAGGCJZ5IhA.1673888017.tmp
- /data/media/####/4h46S8Hg8uvOu-8CNee2MNViX8k.2136389092.tmp
- /data/media/####/561YZbwXiRX-p_Ilnv5d80wTVCw.864521548.tmp
- /data/media/####/5RqaoSa5o2wur7rntpxzrMQe4yU.-118419863.tmp
- /data/media/####/5UR91GU6P5kJZI0r34fctFGM9hw.1475238917.tmp
- /data/media/####/5dAtg-Xi9LSM7xhnvpUSSMZ8M5g.-1500879347.tmp
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee (deleted)
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee.tmp
- /data/media/####/6VzzC07JSEQODUKPvcU_1em1xjk.1305041744.tmp
- /data/media/####/7B_J1ItGz0rS66yV5BW1ynBT2P0.-1230707757.tmp
- /data/media/####/8PmL2Q86d3q31qUd8CL2MMzJlbA.-1172802839.tmp
- /data/media/####/8Qj8X3mybgmyWofsKohd0eOAZLE.-1131528996.tmp
- /data/media/####/9ES
- /data/media/####/9ES (deleted)
- /data/media/####/9pHiuwhbP-shVBrfJOTudth6CRw.788296031.tmp
- /data/media/####/9tzHwxnB6BFvZPyNRrLG_rJI49A.1841625792.tmp
- /data/media/####/AEAX0kj6L-9NYcoaxeUvt6-HnzY.2002013095.tmp
- /data/media/####/AjY
- /data/media/####/AjY (deleted)
- /data/media/####/Alvin2.xml
- /data/media/####/AsIREssTLlUtco5FycOvdWxaJYo.-1066336302.tmp
- /data/media/####/C4m0ogxRuYkzFMm93G_ASNS1Stg.1286226324.tmp
- /data/media/####/ContextData.xml
- /data/media/####/DtpcbFW1qgXvSTjOj_wiWejpC_U.2060615655.tmp
- /data/media/####/F2t
- /data/media/####/F2t (deleted)
- /data/media/####/FO7f6eSx36b78bZHOhApDDjjJVo.1298926859.tmp
- /data/media/####/FXrnQhKYdSQ8eil8dh7rwnVG6QU.-312912774.tmp
- /data/media/####/Ficezr7yq-agOeSBJ42IvgD3NUo.2022188232.tmp
- /data/media/####/GODP-ro-RDf4aLQroJFTzeqkDKE.-144070722.tmp
- /data/media/####/Gftg2EbHCT1JdKvOHjyraSz8LlQ.1281331797.tmp
- /data/media/####/Gi237f0nHbG7g4WiRB3nDuAgYcE.-207743722.tmp
- /data/media/####/GuaETviUGJkVkVKLEywuE_1VXIQ.1200042323.tmp
- /data/media/####/Gxs8BzafaMrD5Nx7y104bfGqAuk.270945523.tmp
- /data/media/####/Gxx
- /data/media/####/Gxx (deleted)
- /data/media/####/IVkesqmdY0mj3FLhguru3PL0eCw.564135725.tmp
- /data/media/####/JJkPsYNIRgDY8cNbkp6uDU43dRg.-293416256.tmp
- /data/media/####/L8x-eS889DpZbhvXNnQwVlV_Oq8.2131300956.tmp
- /data/media/####/LCEMblnzAdUUvpzEWoNB3hoRDr0.-2087128933.tmp
- /data/media/####/LhbHkOGDadSEb6wVsMTS9g5ePd0.795721525.tmp
- /data/media/####/LkUUKhlO3HiCsc_52aFRiCGiXkI.cnt
- /data/media/####/LpXvwqyxcWqoNXvOX2VWb-weZpo.-583116377.tmp
- /data/media/####/M-RMSwlevmfyri1cU3kVTcRZ2BY.-1674487765.tmp
- /data/media/####/M2mUlF-Sf3hXrNdZ76a-bYNqxm0.-979823064.tmp
- /data/media/####/MdzkIMMnw-Pqb_s9BIRWUNs4v1g.-534069700.tmp
- /data/media/####/OBsFdNaPqU7Efx_jWRsSbOorSBk.772390124.tmp
- /data/media/####/O_OUSt9m6yX1AvU7cXvcqKKH_4w.972471632.tmp
- /data/media/####/QNjVz_340M-1wk-bwHY7DO5xi-k.329263799.tmp
- /data/media/####/QYpq2mmdWgMNnjROyEgY-Ey9VYE.1110225784.tmp
- /data/media/####/QjGFQphNT7rPODIud0PoSj-AVcE.-378288404.tmp
- /data/media/####/Qt6RAt3fQzVpYav-E6MTKs3Jwo8.-1238769516.tmp
- /data/media/####/SHRjAj7FzXgbNOd4cox29E-jeMQ.869653566.tmp
- /data/media/####/T4K43zsSdFvsSoeKAkZnS3-ojfw.792969256.tmp
- /data/media/####/TZMieXT6bagcZWie5HjZbKbhDqc.999076179.tmp
- /data/media/####/UUKXlv4yovHRNe5hBBJtHT75RmQ.2006120374.tmp
- /data/media/####/Uel4yBV2Z5pCUGWLdecCNce5kiM.-92547609.tmp
- /data/media/####/UtXKVc_wYE49MAZDaxoIHStCoio.1518934124.tmp
- /data/media/####/UyLajEMPjQsIc0wyZ5gDR-Xemqc.-716772688.tmp
- /data/media/####/V4AnyTCzy7YRCMtD4dgPhBjyZWs.-97298934.tmp
- /data/media/####/VVE6oN4OggNpl7Klr6BcacCg87k.1710782.tmp
- /data/media/####/VjODN5kVikVGRrjoZZsIYcQmBxo.1442302039.tmp
- /data/media/####/WYyIhksfybSdr2grMzvle2mm4Y8.1152677276.tmp
- /data/media/####/WhmtwycCuuleegbuzrvz6KsM3A8.1227611885.tmp
- /data/media/####/XCtfMVMuIW1qC_Jz0ybWTpXZ0YA.2072656572.tmp
- /data/media/####/XJTXitFLNrm9pZ7WnhnkHwIhZ_c.1358017598.tmp
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv (deleted)
- /data/media/####/Y770WWur9qBr3o0CPq2ZzLp4x-8.-1404418375.tmp
- /data/media/####/YKHE9BTguRMVPPS3wVDxYuI3jt4.1926388450.tmp
- /data/media/####/Ydkyc7kJ5LBco8bt8dY7XV3k9J4.-1372285994.tmp
- /data/media/####/_5V9MEPpyXWv_dFNrAASoEtKwHs.1247039168.tmp
- /data/media/####/__VERSION__
- /data/media/####/_xDPCVrDR2csQkVMS5nHC9tv58w.986744813.tmp
- /data/media/####/aXif73092xwOeywFlinlYgjMpSU.924992316.tmp
- /data/media/####/aju5WGRxAbuA3jPeD4nfSVj9seQ.-2077326537.tmp
- /data/media/####/app.db
- /data/media/####/avE0WPNtnRJlZRxPHmSnFdfYzhM.-918548742.tmp
- /data/media/####/avast_done
- /data/media/####/b05ce39c1fe9e72dc1df70989e7e6d14
- /data/media/####/bWx7_PVMij7AcdNAXWtEIX8_Gkc.-1676120900.tmp
- /data/media/####/bx5nqXdcV6TkNAzIrI5luq9QwUM.-1043408156.tmp
- /data/media/####/cVijljXJGfsDo4f1FPn3-3pa450.1037687188.tmp
- /data/media/####/ce0ec3a0ef004f7aae0e7708b61a294b
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.lightsky.video.bin
- /data/media/####/com.lightsky.video.db
- /data/media/####/d2zXWvrBj65wf8pv3xG3N3kvS3E.1016917280.tmp
- /data/media/####/dHxTLuxQ7ZotAiXpSz9Iifkwnr4.-1709491574.tmp
- /data/media/####/data.lock
- /data/media/####/deviceToken
- /data/media/####/eF_qtMr5YcqVttWfmUilPjbWjg0.-703769333.tmp
- /data/media/####/ekr6TsWCKekxB_K_xY2V4u3kLrI.-1069524600.tmp
- /data/media/####/ez-8VepKs7c49eVM48uUUjfint0.-2486943.tmp
- /data/media/####/f36500da465e4be7970eda141dbf51bf
- /data/media/####/f66e9030220a46cb9917c1da8de9e62c
- /data/media/####/f73wAQMtdKatC-RWpS4ow4_UDZI.1059557965.tmp
- /data/media/####/fGuhgGgtuaVV-Ji5EJOR0hT0I8w.393746674.tmp
- /data/media/####/gjDLavW8jDhfTOF03cmAO1JaW_g.298982326.tmp
- /data/media/####/hgcko_Q4Y__ZBGKuhPRleDOOBQ8.771679085.tmp
- /data/media/####/hyYG2QC3UE_vCpGft5n1UYM-wWY.-525339905.tmp
- /data/media/####/ii6GO6SrFnJAYAALHg2dAcyFsM0.541628242.tmp
- /data/media/####/in0cDjFHGYDe5VWwMny9OKljEgo.98949193.tmp
- /data/media/####/j3hlYyBgBKneRthCLgIg-xpvRvU.-1876191452.tmp
- /data/media/####/jcSAOr9jGZwkhQZMXMgqUBAFH0c.1425414218.tmp
- /data/media/####/jei
- /data/media/####/jei (deleted)
- /data/media/####/m4rRiHyWcYsjs96_UEW7ZrZUm9w.-365914617.tmp
- /data/media/####/mWCHu6hgE_6f9PaQZr5-KTB0yss.1608200667.tmp
- /data/media/####/mo1kboZee_dXVswb6NOO7HKPpM4.-1096550166.tmp
- /data/media/####/mrCrayN3u8w1PC7g3qUa167yH1Q.-35614314.tmp
- /data/media/####/n8GQX76CBa1pUwa8VBJCTd-t7zQ.-475138660.tmp
- /data/media/####/nH-WGTqdr4j1L7oGqEMMPSP2rEU.1672231423.tmp
- /data/media/####/ntV8mj--BS1KxvSI6kVMu30MuY8.-1536183161.tmp
- /data/media/####/pKhN0Yz-jCwT013O7fvmJto8Rjg.1636448799.tmp
- /data/media/####/pXOf3IowV5EN2JGxe9kARyA4j5Y.1888249645.tmp
- /data/media/####/pY7J1p94Q-ip6zCMwUfOo0ERpEo.-424618422.tmp
- /data/media/####/pc74gGTiT5AB2p2iisjRB2NW1NU.-1448476317.tmp
- /data/media/####/pkaF-MIbQxSDKhPjWQI8GFiT6wY.-702216221.tmp
- /data/media/####/qB9-qe_YgYo6OcIJM7JfE2RGNRs.873539030.tmp
- /data/media/####/rD5qnwViQB-hQ7xkbbsMmLUhUuw.1195374169.tmp
- /data/media/####/report.lock
- /data/media/####/s48VcZs3Rg4faB1xO39TgYPsxUA.-2112175363.tmp
- /data/media/####/tdata_jVg168
- /data/media/####/tdata_pSF696
- /data/media/####/test.log
- /data/media/####/tiethLIcLZtYHrN36vnqArTwE9Q.-27950946.tmp
- /data/media/####/ubyICPX7iEdmf6BqoFZ7ZJMlcgw.852327316.tmp
- /data/media/####/uninstall_apk_list
- /data/media/####/uyH6VouJFfAcQAxC-qMk-5DfRTk.1268149398.tmp
- /data/media/####/v8OohRAVp88UOAJXl3AqSqEre44.1257100667.tmp
- /data/media/####/vPHiWRgiWbANoJ_K9XfZ0Qi3vvo.-454530546.tmp
- /data/media/####/vdjokEYPNyLVqNrrdj5WFmFckio.1711515465.tmp
- /data/media/####/w7dKLXYP_O4S_5oKv5hovODGivs.1981099133.tmp
- /data/media/####/wT-qe2aTUi_BtRH5h38YHJd5izo.-668555594.tmp
- /data/media/####/xUm-uHLZseen7-xzU1dB1QKFots.976935488.tmp
- /data/media/####/xyV0qVftdERM_tV6-5VTbVYQTBY.-1050389216.tmp
- /data/media/####/yiDEbnuRI0nmWDX1xnqwPzJ32k0.570030894.tmp
- /data/media/####/z4Y81MGydDIuni5gm0FEFmCWzoY.-1458051236.tmp
- /data/media/####/zx8XwF7QZI9aB1w_Z8EBWwX7Gps.-1697953857.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/xbin/which su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a56c9198f4a9d0c2f0001a8","utdid":"W0x/4ZPFPoADAGdzx1F8M8JJ","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0
- cat /proc/version
- cat /sys/class/net/wlan0/address
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-71411075.so
- ls /
- ls /sys/class/thermal
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0
Загружает динамические библиотеки:
- GPBreakpad
- getuiext2
- jcore120
- libdvrender
- libimagepipeline
- libjiagu-71411075
- libjplayer
- liblocalserver
- libtranscore
- libviewer
- tnet-3.1
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- DES
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- DES
Использует повышенные привилегии.
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
