Adware.Gexin.571

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) up####.sdk.jig####.cn:80
TCP(HTTP/1.1) sdk.o####.amp.####.com:80
TCP(HTTP/1.1) www.ta####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) idu####.qini####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) cdn.a####.com:80
TCP(HTTP/1.1) m.ta####.com:80
TCP(TLS/1.0) h####.qktou####.com:443
TCP(TLS/1.0) cdn.aicli####.com:443
TCP(TLS/1.0) idu####.qini####.com:443
TCP(TLS/1.0) h####.qktou####.com.####.com:443
TCP(TLS/1.0) api.a####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) lo####.qutou####.net:443
TCP(TLS/1.0) h5####.1####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) m.ta####.com:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) a####.a####.m.####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP c####.g####.ig####.com:5227
TCP ope####.m.ta####.com:443
UDP 1####.168.77.1:137
TCP umengj####.m.ta####.com:80
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
a####.m.ta####.com
a####.u####.com
adser####.go####.com
ag####.m.ta####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
c####.g####.ig####.com
c####.mm####.com
c-h####.g####.com
c.c####.com
cdn.a####.com
cdn.aicli####.com
cfg.a####.com
ddd.1####.com
h####.1####.com
h####.1####.com
h####.1####.com
h####.qktou####.com
h####.qktou####.com
h5####.1####.com
h5.m.ta####.com
i####.1####.com
lo####.qutou####.net
log.1####.com
m.ta####.com
msg.umengc####.com
qfy.innot####.com
rcv.a####.com
recall-####.1####.com
res####.a####.com
s11.c####.com
sdk.c####.ig####.com
sdk.o####.amp.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
ssl.gst####.com
st####.1####.com
umen####.m.ta####.com
umengj####.m.ta####.com
up####.sdk.jig####.cn
upd####.a####.com
www.go####.com
www.go####.nl
www.gst####.com
www.ta####.com
z13.c####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&OSVers...
api.1####.com/app/coldStart?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/eventConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getAdConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getConfig?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/getGuide?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/app/getPatch?versionName=####&dtu=####
api.1####.com/app/start?model=####&lon=####&OSVersion=####&deviceCode=##...
api.1####.com/content/getDefaultChannelList?lon=####&OSVersion=####&devi...
api.1####.com/qupwd/config?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/welfare/redbagconfig?lon=####&OSVersion=####&deviceCode=##...
api.a####.com/reqMotPkgLst
api.a####.com/show?CAAQKw.####
api.a####.com/show?CAAQOA.####
api.a####.com/trace?iclicashsid=####&op3=####&opt_androidid=####&opt_bra...
cdn.a####.com//uploads/1e40cd90e0d8b80f34ea9bafae75f07e_1516146_225_150....
cdn.a####.com//uploads/32b15614116bb1a84a82ce8f4ce5ad69_1525885_225_150....
cdn.a####.com//uploads/42885fbfee44dfb12aa9f643c069982c_1516146_225_150....
cdn.a####.com//uploads/553e3a3d35cfb69ce27a051006ddc347_1525885_225_150....
cdn.a####.com//uploads/729313c16bf7ce14cacb5661c630dea9_1525885_225_150....
cdn.a####.com//uploads/f3d707bd5c6469976dfb0bd889bcf982_1516146_225_150....
i####.1####.com/qukan_new2/dest/art2/read/art2/template.html
i####.1####.com/qukan_new2/dest/art2/read/art2/template.html.md5
idu####.qini####.com/image/sp/2018/04/12/148a91e973f72c57e313f0fe52b008e...
idu####.qini####.com/image/sp/2018/04/24/d924bb0a82c950831205052271f531d...
idu####.qini####.com/lw/img/2018/07/25/01049e093ffaabadd0805a98cfc64757?...
idu####.qini####.com/lw/img/2018/07/25/88c27a64d9c810dce96bd867ebce479d?...
idu####.qini####.com/lw/img/2018/07/25/922a61b48ce45fd939f099882a2430d6?...
idu####.qini####.com/qupost/image/sp/2018/07/25/1532488238198.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/25/1532488238474.jpeg?image...
idu####.qini####.com/qupost/image/sp/2018/07/25/1532488238840.jpeg?image...
log.1####.com/a.gif?lon=####&OSVersion=####&deviceCode=####&error_code=#...
log.1####.com/a.gif?lon=####&index=####&op=####&OSVersion=####&deviceCod...
log.1####.com/a.gif?lon=0.0&cdn_e_count=0&OSVersion=4.3.1&deviceCode=<IM...
log.1####.com/a.gif?os=android&lon=0.0&cache=2&OSVersion=4.3.1&deviceCod...
m.ta####.com/?sprefer=####
sdk.o####.amp.####.com/api.htm?format=####&t=####
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_BAI450
sni.c####.q####.####.net/tdata_Fus136
sni.c####.q####.####.net/tdata_YJA893
www.ta####.com/

Запросы HTTP POST:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.a####.com/v3/json
c-h####.g####.com/api.php?format=####&t=####
ddd.1####.com/report
sdk.o####.p####.####.com/api.php?format=####&t=####
up####.sdk.jig####.cn/v1/push/sdk/postlist

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/3112fa14263ec7657a07d9394c3c908ec1071905c74191e....0.tmp
/data/data/####/316b1c6c4a8ae283f18c6be058f48fdba8d5654545dee9a....0.tmp
/data/data/####/3f8d6ef5800f4365977168761bbebef2c6da5ff5c999db3....0.tmp
/data/data/####/6345bc02ad50c72f7eb1ae7e0e69b5d846a5bc9258ebea9....0.tmp
/data/data/####/732f1227ffd001b5c7fa70195d797049316972b9e1e167e....0.tmp
/data/data/####/744ff94712a5ddac93b916cbfcc20572cc308e3f657b0a8....0.tmp
/data/data/####/7c96c2aad83f079a3072a99904dcc1976802de82804992a....0.tmp
/data/data/####/8da8fdc7dc009a88a9b3161e7db47003313440bd5b54502....0.tmp
/data/data/####/ACCS_BINDumeng;57578e4d67e58e4c810000d2.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/JPushSA_Config.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/RAUdZO0Pz0d2hfsbtE7PfG4n
/data/data/####/RBQAVanfy05zrrlJGLMOl0Nx
/data/data/####/RC1dPz1sH0peo6kAwCyRqulW
/data/data/####/RCmE6erUZUmZlKT6dKaEOITs
/data/data/####/RDm9HTmgKE6WpPL7NSjwUrES
/data/data/####/RE4l0lxqUk0LjruodcigcjCa
/data/data/####/REK2lEs63EktjVIowx2eJ6YX
/data/data/####/RGmRMwGf8UNdvhs0Svg2GAay
/data/data/####/RJ_Cs1I9h0HQtDHZEqaYwIwV
/data/data/####/RJqdtUVDd0kMqnXm2UEyMC7g
/data/data/####/RM1M9jEdr0B6vKT8yzQfTu8B
/data/data/####/RMtUDyVDnEeumaYW-AJAXDVe
/data/data/####/RNJ491VxKEfGkXtvX5KJE_Qw
/data/data/####/ROFeuVCiMUO1sAcBGwk2gUJo
/data/data/####/ROG27oL14Ui5q2m_lEfnw31K
/data/data/####/RPylYkYB9U1zh22wiLbBLyD8
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_download_1532501926
/data/data/####/accs.db-journal
/data/data/####/ad682ad31c2fdb9893d669cc67d48af208f72f9a6dbab33....0.tmp
/data/data/####/agoo.pid
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.android.user.profile.xml (deleted)
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.jifen.qukan-journal
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.jifen.qukan_prefs.xml.bak
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/crashrecord.xml
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/e0b90824ff4a84de27ebaceb7a00f2d9d6b166f598d08d3....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/fe3d3c028e9813a7247cb0132ab3fa6695df43838a378e8....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/libjiagu-1385524905.so
/data/data/####/local_crash_lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/secid
/data/data/####/security_info
/data/data/####/sensorsdata.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_Fus136
/data/data/####/tdata_Fus136.jar
/data/data/####/tdata_YJA893
/data/data/####/tdata_YJA893.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.acid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.acid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.74f9af2a1233161067ccef0ab406443a.cuid
/data/media/####/.79594990e265ac60591761aa24fbd681.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.919166631283dc3099cc3b24dc440014.acid
/data/media/####/.919166631283dc3099cc3b24dc440014.cuid
/data/media/####/.953c80ff9827cbb183369e675c974bc1.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.aio.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.acid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.f4e8fb1b9b24e8d4a8e49c675baf05db.cuid
/data/media/####/.nomedia
/data/media/####/46f98fb89e2a43ae339708eeb926c9f1
/data/media/####/5a0ed5cff74007b91adfff15b70835c4
/data/media/####/5ec136730b25fafba2acd73816c16eef
/data/media/####/675a08a8e6064d6a1bc8641149352d5f
/data/media/####/8f37d20ae1520007fd70022d64ba7db1
/data/media/####/94af1268f3654dad8b6022f761680bcb
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/aacout
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/deviceToken
/data/media/####/e1730606076e4b59a126f476619a43a1
/data/media/####/f2fca13f8df0fa7cb20bc6f93b85df79
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/qtac
/data/media/####/red_dot_navigationSelected.png
/data/media/####/red_dot_navigationUnSelected.png
/data/media/####/systemccu
/data/media/####/systtk
/data/media/####/tabtkae
/data/media/####/tdata_BAI450
/data/media/####/tdata_Fus136
/data/media/####/tdata_YJA893
/data/media/####/template.html
/data/media/####/test.log
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac
/data/media/####/wxtoatk

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57578e4d67e58e4c810000d2","utdid":"W1gfn2ozDLwDAGdzx1E2u22f","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.service.GTCoreService 24479 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/app_bin/daemon
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu-1385524905.so
date
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
id
ls /system/fonts
mkdir -p <SD-Card> .. .. .. .. .. .. sdcard Android Data System local/
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
service call iphonesubinfo 1
sh
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c echo NjA5QkIyREI1MzA5NTBFQzJDQ0FCQ0QzM0Q0Q0NGMTIxNTMyNTAxOTI3 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo NjA5QkIyREI1MzA5NTBFQzJDQ0FCQ0QzM0Q0Q0NGMTIxNTMyNTAxOTI3 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c echo OUM3MTNBRkZGMDdDQThEMDNGNzVCQTI5NzAwMDcyQjYzMUE3NjI6MENDMTFCOkE5OUIxOQ== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo OUM3MTNBRkZGMDdDQThEMDNGNzVCQTI5NzAwMDcyQjYzMUE3NjI6MENDMTFCOkE5OUIxOQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RDRBRUMwODE4QUE0Qzg2MThFMTM4RTlGRkQwNjA3ODUzQTY4Q0M6QkY4MTE3OjREMDVFQg== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo RDRBRUMwODE4QUE0Qzg2MThFMTM4RTlGRkQwNjA3ODUzQTY4Q0M6QkY4MTE3OjREMDVFQg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh <Package Folder>/files/RAUdZO0Pz0d2hfsbtE7PfG4n
sh <Package Folder>/files/RBQAVanfy05zrrlJGLMOl0Nx
sh <Package Folder>/files/RC1dPz1sH0peo6kAwCyRqulW
sh <Package Folder>/files/RCmE6erUZUmZlKT6dKaEOITs
sh <Package Folder>/files/RDm9HTmgKE6WpPL7NSjwUrES
sh <Package Folder>/files/RE4l0lxqUk0LjruodcigcjCa
sh <Package Folder>/files/REK2lEs63EktjVIowx2eJ6YX
sh <Package Folder>/files/RGmRMwGf8UNdvhs0Svg2GAay
sh <Package Folder>/files/RJ_Cs1I9h0HQtDHZEqaYwIwV
sh <Package Folder>/files/RJqdtUVDd0kMqnXm2UEyMC7g
sh <Package Folder>/files/RM1M9jEdr0B6vKT8yzQfTu8B
sh <Package Folder>/files/RMtUDyVDnEeumaYW-AJAXDVe
sh <Package Folder>/files/RNJ491VxKEfGkXtvX5KJE_Qw
sh <Package Folder>/files/ROFeuVCiMUO1sAcBGwk2gUJo
sh <Package Folder>/files/ROG27oL14Ui5q2m_lEfnw31K
sh <Package Folder>/files/RPylYkYB9U1zh22wiLbBLyD8
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.service.GTCoreService 24479 300 0

Загружает динамические библиотеки:

Bugly
InnoSecure
InnoSo
NativeExample
du
getuiext2
jcore118
libjiagu-1385524905
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней