Adware.Gexin.452

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) wb.110.ta####.com:80
TCP(HTTP/1.1) po####.jd.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) u####.v.qin####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) so####.a####.tvm.cn:9092
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) zhg.ali####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) i####.j####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) o####.jd.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) up####.tvmi####.com:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) a####.m.jd.com:80
TCP(HTTP/1.1) channel####.y####.tvm.cn:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) ope####.m.ta####.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) oth.up####.mdt.####.com:8080
TCP(TLS/1.0) nbsdk-b####.al####.com:443
TCP(TLS/1.0) ke####.jd.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) app-ro####.leanc####.cn:443
TCP(TLS/1.0) e####.y####.tvm.cn:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) keple####.jd.com:443
TCP(TLS/1.0) dev.s####.l####.net:443
TCP(TLS/1.0) u####.v.qin####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

Запросы DNS:

7j####.c####.z0.####.com
a####.m.jd.com
a####.u####.com
acs4bai####.m.ta####.com
ad####.m.ta####.com
ada####.m.ta####.com
ai7m####.s####.l####.net
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
app-ro####.leanc####.cn
c####.g####.ig####.com
c-h####.g####.com
channel####.y####.tvm.cn
e####.y####.tvm.cn
fp.fraudme####.cn
im####.y####.tvm.cn
imgc####.qq.com
ke####.jd.com
keple####.jd.com
l####.tbs.qq.com
mi.g####.qq.com
nbsdk-b####.al####.com
o####.jd.com
oth.up####.mdt.####.com
p####.ugd####.com
po####.jd.com
pub-####.qin####.com
res####.a####.com
s####.e.qq.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
so####.a####.tvm.cn
sto####.360bu####.com
thi####.q####.cn
up####.tvmi####.com
upd####.yao####.tvm.cn
wb.110.ta####.com
wx.q####.cn
y####.al####.com

Запросы HTTP GET:

ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
i####.j####.com/kepler-app/app_cart.3.224.1483500645938.zip
i####.j####.com/kepler-app/app_detail.2.316.1502272971980.zip
i####.j####.com/kepler-app/app_nav.1.13.1462514113396.zip
i####.j####.com/kepler-app/app_trade.1.277.1523601698719.zip
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
ope####.m.ta####.com/gw-open/mtop.taobao.tbk.sdk.config/1.0/?data=####
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
s####.tc.qq.com/gdt/0/transformer_14862517704951522510_1531940461_80.jpg...
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_Soq141
sni.c####.q####.####.net/tdata_vxj811
so####.a####.tvm.cn:9092/socket.io/?EIO=####&transport=####
thi####.q####.cn/mmopen/vi_32/7LDaL77dXC4gkxHHWSA5No9sEQQiaMwRZNgMl0Liax...
thi####.q####.cn/mmopen/vi_32/A01M7UXXGiczmic5U4wicpx7MLY9Pic6J6RuADWUib...
thi####.q####.cn/mmopen/vi_32/DYAIOgq83epVibo86CUJNY36jK9phJ2YCDxOaY5PDf...
thi####.q####.cn/mmopen/vi_32/DYAIOgq83erd8wNEHhQTvmqFV5KH9yYIfEKuUB5qW2...
thi####.q####.cn/mmopen/vi_32/DYAIOgq83erxNzrydoXDhrSgovH21KvAVia3ibicoK...
thi####.q####.cn/mmopen/vi_32/PiajxSqBRaEJgC2aX57jkQ21G28vJpIViaXYLffq9v...
thi####.q####.cn/mmopen/vi_32/VcqBZias6CbSvQJnB8gmOcricbWWsoibms4ticJGcC...
u####.v.qin####.com/2017-04-11/2017041121154466.jpg/64
u####.v.qin####.com/2017-05-16/201705161509490072627486.jpg/64
u####.v.qin####.com/2017-08-03/201708032328210057765893.jpg/64
u####.v.qin####.com/2017-09-04/201709040158370088848604.jpg/64
u####.v.qin####.com/2017-11-07/201711071342450041768852.jpg/64
u####.v.qin####.com/2018-01-16/201801161920430094277430.jpg/64
u####.v.qin####.com/2018-02-15/201802151202510048536606.jpg/64
u####.v.qin####.com/2018-02-25/201802250051520013155655.jpg/64
u####.v.qin####.com/2018-04-22/201804221737570080163494.jpg/64
u####.v.qin####.com/2018-06-17/201806171056070089835014.jpg/64
u####.v.qin####.com/2018-06-19/201806190901590068883131.jpg/64
u####.v.qin####.com/rts/2016/1224/cdde0ca5444084d0c4a5bfdd9e8e273f.jpg/64
u####.v.qin####.com/rts/2016/1224/e7ad2e2e4f84c77057af88dccce5c33d.jpg/64
u####.v.qin####.com/rts/2016/1224/eb669726b00ff5d90586ed6110739bfa.jpg/64
u####.v.qin####.com/rts/2016/1225/0b8f53dbd018662ef65e1e039b0fd9b2.jpg/64
u####.v.qin####.com/rts/2016/1227/6fc577b2b0742fd6506e675c2931efb7.jpg/64
u####.v.qin####.com/rts/2016/1231/2a8b4830b683c2a2e629df0e1d8a660e.jpg/64
u####.v.qin####.com/rts/2017/0107/200146e24d59481a0dc5cd56ca34c5a8.jpg/64
u####.v.qin####.com/rts/2017/0115/d758f7cb028b6a5eec640ce03873f00d.jpg/64
u####.v.qin####.com/rts/2017/0119/7a1813a576d89d4fbe5a52319a711a3b.jpg/64
u####.v.qin####.com/rts/2017/0125/7026c263ebd2d24aad54fc6f38da03a0.jpg/64
u####.v.qin####.com/rts/2017/0126/858777969892c6587bbdf92def6f6940.jpg/64
u####.v.qin####.com/rts/2017/0129/1bd44a87661179e1dfe2af7a0bab178e.jpg/64
u####.v.qin####.com/rts/2017/0129/b829dbf5f14bcb6685bf2ac007338d90.jpg/64
u####.v.qin####.com/rts/2017/0130/97e646f75604977e63c3cac284cf6e41.jpg/64
u####.v.qin####.com/rts/2017/0203/26ab6f3c94cd3f0a76abd3fbffe26476.jpg/64
u####.v.qin####.com/rts/2017/0203/94a84ff29fd4c6a9a6d52b2cc7e68822.jpg/64
u####.v.qin####.com/rts/2017/0205/ee52cf2035067e7c4dce2bb99bb57d79.jpg/64
u####.v.qin####.com/rts/2017/0209/4bab09c32c086ae3796dc1764e001efe.jpg/64
u####.v.qin####.com/rts/2017/0219/6ae414604e0b8fea973643c1e089ad18.jpg/64
u####.v.qin####.com/rts/2017/0302/94682f82c5b2174ba7982a9efe86ba88.jpg/64
u####.v.qin####.com/rts/2017/0316/683933b85977110a79ab395a3a75e58c.jpg/64
u####.v.qin####.com/rts/2017/0317/907281e4e7646afdc0dfc6a2a58ef866.jpg/64
u####.v.qin####.com/rts/2017/0323/e6e1dee8f45e9061fbd8b6f860194f00.jpg/64
u####.v.qin####.com/rts/2017/0603/4cf84c0606381a50290a128c71e79c0a.jpg/64
u####.v.qin####.com/rts/2017/0614/f59cf474cd3e03747de593564a86967c.jpg/64
u####.v.qin####.com/rts/2017/0618/189e5ecc76660e0ffbb336f61053155b.jpg/64
u####.v.qin####.com/rts/2017/0630/020ccd8635d0dad97a4387233dc636fe.jpg/64
u####.v.qin####.com/rts/2017/0630/47c459c5875f66ed1a07e4a92e93c504.jpg/64
u####.v.qin####.com/rts/2017/0701/3d8a324d3caa8f10271e3cc71ac3dbd9.jpg/64
u####.v.qin####.com/rts/2017/0709/8a5547445caf51455753c9fc07aa1c11.jpg/64
u####.v.qin####.com/rts/2017/0802/baecd717ebfc351aa5a4fc5cb666049d.jpg/64
u####.v.qin####.com/rts/2017/0816/d086494a0000a1dee3d5e6a7f2449074.jpg/64
u####.v.qin####.com/rts/2017/0816/e5eefd959d7b18d9fb33f491295899d6.jpg/64
u####.v.qin####.com/rts/2017/0830/a4be5b916ce00953b8037ce35e9aa679.jpg/64
u####.v.qin####.com/rts/2017/0908/35ac3eae507cb2bb9504839237276122.jpg/64
u####.v.qin####.com/rts/2017/1018/a3dd7e67eda4d8a4998e124e6e0e4a7c.jpg/64
u####.v.qin####.com/rts/2017/1019/4431a8258bbdec64883e2a265cd65f6d.jpg/64
u####.v.qin####.com/rts/2017/1020/2be61f3e6cabe406b276b7600d16f7aa.jpg/64
u####.v.qin####.com/rts/2017/1119/355cc9a1d89f3c05c4284949dfb56464.jpg/64
u####.v.qin####.com/rts/2017/1129/d4439e1a8bceabfa81c82a8ff6dc5bca.jpg/64
u####.v.qin####.com/rts/2017/1207/f2f92f92f6dff38b818a2667d5e84507.jpg/64
u####.v.qin####.com/rts/2018/0104/4e24d2ab0b8d7277ffa99e5d41968c7b.jpg/64
u####.v.qin####.com/rts/2018/0117/d2b6e6e1c49772823337f8c89077032b.jpg/64
u####.v.qin####.com/rts/2018/0118/f5920f0570025c794bd468c6c5c2d4f8.jpg/64
u####.v.qin####.com/rts/2018/0131/7a8e757902bc0a9655add9f97e9bc211.jpg/64
u####.v.qin####.com/rts/2018/0203/36fd8a3734bcce79551cfc7ed79ac163.jpg/64
u####.v.qin####.com/rts/2018/0604/a77893bb876d49727bc4aa80bb9e71e8.jpg/64
u####.v.qin####.com/rts/2018/0609/41b1878fbe6afcc19c269c57f9021825.jpg/64
u####.v.qin####.com/rts/2018/0623/00592448604a59a59fc6c01c662742f7.jpg/64
u####.v.qin####.com/rts/2018/0628/2d2ce7ffded884d294aff792f6c56435.jpg/64
u####.v.qin####.com/rts/2018/0702/9c311c96b4a304a7d4178c57c7839f0b.jpg/64
u####.v.qin####.com/rts/2018/0706/f9153dc4cffb4faa79df4c61ea9b4de7.jpg/64
u####.v.qin####.com/rts/2018/0709/6e7e389395ebc8575e1f604e0e395617.jpg/64
u####.v.qin####.com/rts/2018/0710/7b87d5d53e85073bd33ff9aa25d613ec.jpg/64
u####.v.qin####.com/rts/2018/0721/5397f0446719fcb706f9b8480589fac1.jpg/64
u####.v.qin####.com/rts/avatar/10.jpg/64
u####.v.qin####.com/rts/avatar/11.jpg/64
u####.v.qin####.com/rts/avatar/14.jpg/64
u####.v.qin####.com/rts/avatar/16.jpg/64
u####.v.qin####.com/rts/avatar/2.jpg/64
u####.v.qin####.com/rts/avatar/3.jpg/64
up####.tvmi####.com/SoftUpdateServer/update/update?device=####&product=#...

Запросы HTTP POST:

a####.m.jd.com/client.action?functionId=####&uuid=####&clientVersion=###...
a####.u####.com/app_logs
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
channel####.y####.tvm.cn/appChannelInfo.php
l####.tbs.qq.com/ajax?c=####&k=####
o####.jd.com/upload
oth.up####.mdt.####.com:8080/beacon/vercheck
po####.jd.com/m/log/v1
po####.jd.com/m/sys/v1
s####.e.qq.com/activate
s####.e.qq.com/msg
sdk.o####.p####.####.com/api.php?format=####&t=####
wb.110.ta####.com/api/update.do
zhg.ali####.com/saveWb.json

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1004
/data/data/####/1d77ea041509fe06.lock
/data/data/####/21c22f492aba3de8.lock
/data/data/####/42d95b5058a9e73f8aa992ff05f1d411.temp
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/AVOSCloud-SDK.xml
/data/data/####/AV_CLOUD_API_VERSION_KEY_ZONE.xml
/data/data/####/AlibcLinkPartner.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MultiDex.lock
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/aliTradeConfigSP.xml
/data/data/####/ap.Lock
/data/data/####/auth_sdk_device.xml
/data/data/####/auth_shared.xml
/data/data/####/b1598aef8eff836025e88152306fbb4c
/data/data/####/beacontsa_cover.xml
/data/data/####/beacontsa_cover_check.lock
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.avos.avoscloud.RequestStatisticsUtil.data.xml
/data/data/####/com.avos.avoscloud.analysis.xml
/data/data/####/com.avos.avoscloud.approuter.aI7m2nyNQFldtKEHH0...sz.xml
/data/data/####/com.tvmining.yao8_preferences.xml
/data/data/####/core_info
/data/data/####/crash_sp.xml
/data/data/####/crashrecord.xml
/data/data/####/db_fm.jar
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/device_id.xml.xml
/data/data/####/deviceid_prefs.xml
/data/data/####/direct_app_install_log.db
/data/data/####/direct_app_install_log.db-journal
/data/data/####/evernote_jobs.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fm_shared.xml
/data/data/####/gdaemon_20161017
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/installation
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libnfix.so
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/libsgsecuritybodyso-5.1.25.so.tmp
/data/data/####/libshella-2.10.7.1.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/lock.lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/save_ma_init_commoninfo.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/security_info
/data/data/####/sp.lock
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_vxj811
/data/data/####/tdata_vxj811.jar
/data/data/####/timestamp
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/update_lc
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/yao8.db-journal
/data/media/####/.nomedia
/data/media/####/.tvm_dev_id.txt
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_mod_hd_bar.s.min.css
/data/media/####/_mod_search_filter_layer.s.min.css
/data/media/####/_mod_search_panel_v2.s.min.css
/data/media/####/ajax.js
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/app_cart.3.224.1483500645938.zip
/data/media/####/app_detail.2.316.1502272971980.zip
/data/media/####/app_nav.1.13.1462514113396.zip
/data/media/####/app_trade.1.277.1523601698719.zip
/data/media/####/area_select.s.min.css
/data/media/####/backbone.js
/data/media/####/base.s.min.css
/data/media/####/buy.s.min.css
/data/media/####/cart.min.css
/data/media/####/cartStatic.html
/data/media/####/category.s.min.css
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.tvmining.yao8.bin
/data/media/####/com.tvmining.yao8.db
/data/media/####/common.js
/data/media/####/cookie.201505071822.js
/data/media/####/cookie.js
/data/media/####/date.js
/data/media/####/dd7893586a493dc3
/data/media/####/detail.s.min.css
/data/media/####/detail_v1_3.png
/data/media/####/fastclick-mping-monitor-iscroll-template.min.js
/data/media/####/fastclick.js
/data/media/####/feedback_tips.png
/data/media/####/formatJson.201505071823.js
/data/media/####/formatJson.js
/data/media/####/hid.dat
/data/media/####/icon_captcha.png
/data/media/####/icon_global.png
/data/media/####/icon_nav_v2.png
/data/media/####/icon_result.png
/data/media/####/icon_select.png
/data/media/####/icon_tips.png
/data/media/####/index_114009134.jpg
/data/media/####/inf.js
/data/media/####/init.png
/data/media/####/iscroll-mping-monitor.js
/data/media/####/iscroll.201505131224.js
/data/media/####/item.min.css
/data/media/####/itemStatic.html
/data/media/####/jd.address.201504241030.js
/data/media/####/jd.address.js
/data/media/####/jd.promotions.js
/data/media/####/jd.search.common.201510121131.js
/data/media/####/jd.searchV2.js
/data/media/####/jd.searchindexV2.js
/data/media/####/jd.smartbox.min.js
/data/media/####/jsapi.js
/data/media/####/loadJs.201505111110.js
/data/media/####/loadJs.js
/data/media/####/loading.gif
/data/media/####/login.js
/data/media/####/loopScroll.js
/data/media/####/m_close.png
/data/media/####/md5.js
/data/media/####/metadata.xml
/data/media/####/mod_aside.s.min.css
/data/media/####/mod_bar_download.s.min.css
/data/media/####/mod_nav_head.s.min.css
/data/media/####/monitor.js
/data/media/####/mping-monitor.min.js
/data/media/####/mqqStorage.201507151518.js
/data/media/####/myViewWithCache.js
/data/media/####/nav.html
/data/media/####/pay.js
/data/media/####/payutil.js
/data/media/####/q.js
/data/media/####/qqAddr.js
/data/media/####/qrcode.js
/data/media/####/report.201507281703.js
/data/media/####/report.js
/data/media/####/s_detail_loc.js
/data/media/####/scrollCtrl.js
/data/media/####/sea.js
/data/media/####/search.html
/data/media/####/search_v2.s.min.css
/data/media/####/select_loading.gif
/data/media/####/shakeTV_6.1.0_release.apk
/data/media/####/speedtime.201507091141.js
/data/media/####/sprites_v3.png
/data/media/####/swiper.min.js
/data/media/####/tdata_Soq141
/data/media/####/tdata_vxj811
/data/media/####/template.js
/data/media/####/test.log
/data/media/####/tpl_s_detail_loc.js
/data/media/####/tpl_wq.asset.js
/data/media/####/tpl_wq.confirm1.js
/data/media/####/tpl_wq.jdaddress.js
/data/media/####/trade.min.css
/data/media/####/tradeViewStatic.html
/data/media/####/ui.201507281615.js
/data/media/####/ui.js
/data/media/####/underscore.js
/data/media/####/underscore.min.js
/data/media/####/unionclick.js
/data/media/####/url.201505111643.js
/data/media/####/url.js
/data/media/####/util.201508201549.js
/data/media/####/util.js
/data/media/####/wg.addrctrl.js
/data/media/####/wg.addrctrl.view.js
/data/media/####/wg.countRd.js
/data/media/####/wg.itemV6.js
/data/media/####/wg.jdgift.view.js
/data/media/####/wg.jdpromote.js
/data/media/####/wg.jdshopcart.js
/data/media/####/wg.jdshopcart.model.js
/data/media/####/wg.mobilereport.min.js
/data/media/####/wg.mwfoot.min.js
/data/media/####/wg.qqapi.min.js
/data/media/####/wg.report.min.js
/data/media/####/wg.speedtime.js
/data/media/####/wg.storage.min.js
/data/media/####/wq.asset.js
/data/media/####/wq.confirm1.js
/data/media/####/wq.jdaddress.js
/data/media/####/wq.search.category.js
/data/media/####/zepto.201509161730.js
/data/media/####/zepto.js
/data/media/####/zepto.min.js

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.commons.components.service.GTPushService 24672 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.7.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop net.dns1
getprop net.dns2
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls -l /system/xbin/su

Загружает динамические библиотеки:

Bugly
getuiext2
libnfix
libshella-2.10.7.1
libufix
nativeHBSign
nfix
pl_droidsonroids_gif
sgmainso-5.1
sgsecuritybodyso-5.1
tongdun_db
ufix
ut_c_api

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней