Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sh####.360t####.com:80
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) qos.l####.360.cn:80
- TCP(HTTP/1.1) p3.q####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) m3.s.3####.cn:80
- TCP(HTTP/1.1) api.k.36####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) app.v.k.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) s####.s.360.cn:80
- TCP(HTTP/1.1) p1.q####.com:80
- TCP(HTTP/1.1) u.api.l####.####.cn:80
- TCP(HTTP/1.1) ab####.m.s.####.cn:80
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) p8.q####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) sdk.l####.360.cn:80
- TCP(HTTP/1.1) p.s.3####.cn:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) s####.l####.360.####.com:80
- TCP(HTTP/1.1) k####.36####.com:80
- TCP(HTTP/1.1) res.qhup####.com:80
- TCP(TLS/1.0) sdkc####.e.360.cn:443
- TCP(TLS/1.0) s####.l####.360.####.com:443
- TCP(TLS/1.0) t####.me####.com:443
- TCP(TLS/1.0) 36.1####.213.225:443
- TCP(TLS/1.0) 1####.217.17.142:443
- TCP(TLS/1.0) mdm.ope####.360.cn:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) cc.p####.dc.####.cn:443
- TCP(TLS/1.0) api####.me####.com:443
- TCP(TLS/1.0) s####.j####.cn:443
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP c####.g####.ig####.com:5224
- TCP sdk.o####.t####.####.com:5224
- TCP 1####.198.120.239:7006
- TCP umengj####.m.ta####.com:80
- UDP s.j####.cn:19000
- TCP 1####.163.230.186:80
- TCP ope####.m.ta####.com:443
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.man.aliy####.com
- ab####.m.s.####.cn
- ag####.m.ta####.com
- amdc####.m.ta####.com
- api####.me####.com
- api.k.36####.com
- app.k.36####.com
- app.v.k.####.com
- c####.g####.ig####.com
- c-h####.g####.com
- cc.p####.dc.####.cn
- k####.36####.com
- k####.36####.com
- m3.s.3####.cn
- mdm.ope####.360.cn
- msg.umengc####.com
- p.s.3####.cn
- p0.q####.com
- p1.q####.com
- p10.qhi####.com
- p2.q####.com
- p3.q####.com
- p4.q####.com
- p5.q####.com
- p6.q####.com
- p7.q####.com
- p8.q####.com
- p9.q####.com
- plb####.u####.com
- pub-####.qin####.com
- qos.l####.360.cn
- res.qhup####.com
- s####.j####.cn
- s####.l####.360.cn
- s####.s.360.cn
- s.j####.cn
- sdk####.l####.360.cn
- sdk.c####.ig####.com
- sdk.l####.360.cn
- sdk.l####.360.cn
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sdkc####.e.360.cn
- sh####.360t####.com
- sis.j####.io
- t####.me####.com
- u####.u####.com
- u.api.l####.####.cn
- umen####.m.ta####.com
- umengj####.m.ta####.com
- up####.sdk.jig####.cn
Запросы HTTP GET:
- ab####.m.s.####.cn/abtest/cloud.so?appkey=####&dt=####&os=####&ov=####&m...
- app.v.k.####.com/vod-xinxiliu-tv-q2-bj/92742674_1-1517814709-b33dd282-27...
- app.v.k.####.com/vod-xinxiliu-tv-q3-bj/122237880_1-1525946623-fc2a5555-c...
- k####.36####.com//k2/appconfig/getjar?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/hotrizon2/appConfig?os=####&use_gear=####&time=####&sys...
- k####.36####.com/hotrizon2/channelnew?m2=####&appid=####&m=####&ch=####&...
- k####.36####.com/hotrizon2/list?svc=####&kw=####&os=####&ckw=####&sys=##...
- k####.36####.com/hotrizon2/list?svc=####&os=####&direction=####&sys=####...
- k####.36####.com/hotrizon2/list?svc=####&os=####&sys=####&direction=####...
- k####.36####.com/hotrizon2/play?id=####&m2=####&appid=####&strategy=####...
- k####.36####.com/hotrizon2/play?id=####&m2=####&strategy=####&appid=####...
- k####.36####.com/hotrizon2/share/do?id=####&os=####&time=####&sys=####&m...
- k####.36####.com/k2/api/privacy/config?appid=####&m=####&m2=####&ch=####...
- k####.36####.com/k2/appconfig/getAbRole?os=####&time=####&sys=####&m2=##...
- k####.36####.com/k2/appconfig/getNewinfo?appid=####&m=####&m2=####&ch=##...
- k####.36####.com/k2/appconfig/getRedpackPop?appid=####&m=####&m2=####&ch...
- k####.36####.com/k2/appconfig/getplugin?appid=####&m=####&m2=####&ch=###...
- k####.36####.com/k2/appconfig/getpopup?appid=####&m=####&m2=####&ch=####...
- k####.36####.com/k2/hotrizon2/aconfig?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/k2/hotrizon2/gettime?os=####&sys=####&m2=####&appid=###...
- p1.q####.com/dr/_100_70/t0107d1aba8d0ae34f9.jpg
- p1.q####.com/dr/_100_70/t012fa7c5b9faadaf76.jpg
- p1.q####.com/dr/_100_70/t01316bee53beb871a4.jpg
- p1.q####.com/dr/_100_70/t01522dda551ccd5630.jpg
- p1.q####.com/dr/_100_70/t018a6bb42a8b0f145f.jpg
- p1.q####.com/dr/_100_70/t01c9d0c75990ba47f2.jpg
- p1.q####.com/dr/_100_70/t01cdf16b3b750e3873.jpg
- p1.q####.com/dr/_100_70/t01fbfb54a73d7e3ccb.jpg
- p1.q####.com/t01153c265593f3258e.jpg
- p1.q####.com/t013db82533aa9e5a9a.jpg
- p1.q####.com/t0147eeb331a280d627.jpg
- p1.q####.com/t0178bccfe750f110a1.jpg
- p1.q####.com/t018a091efca6865662.jpg
- p1.q####.com/t019394dd4b2d1e1505.jpg
- p1.q####.com/t019f6478307ad0eea6.jpg
- p1.q####.com/video/568_320_70/t012bf3ef6c57e847f8.webp
- p1.q####.com/video/568_320_70/t0156a352ae9a004c0c.webp
- p1.q####.com/video/568_320_70/t017f035dda5c34930f.webp
- p1.q####.com/video/568_320_70/t01bfa14e067829faf0.webp
- p1.q####.com/video/568_320_70/t01c3fc4ad12fef0734.webp
- p1.q####.com/video/568_320_70/t01d4427e20c045a56a.webp
- p1.q####.com/video/568_320_70/t01d4b608703cd4d13d.webp
- p1.q####.com/video/568_320_70/t01dd0c76d37c8dc0c7.webp
- p1.q####.com/video/568_320_70/t01e74e789c96784b47.webp
- p1.q####.com/video/568_320_70/t01f17cd049c3d1433c.webp
- p1.q####.com/video/568_320_70/t01f2162a0d7df100f7.webp
- p3.q####.com/dr/_100_70/t010d44a5c30eace11d.png
- p3.q####.com/dr/_100_70/t0132366c21e5fb3117.jpg
- p3.q####.com/dr/_100_70/t013a457b6bd56d678d.png
- p3.q####.com/dr/_100_70/t016ee45b0e2cd5aba9.jpg
- p3.q####.com/dr/_100_70/t016f90fb89c1d7be15.jpg
- p3.q####.com/dr/_100_70/t017ddd7272780cd2fa.jpg
- p3.q####.com/dr/_100_70/t018e177198125dde8a.jpg
- p3.q####.com/dr/_100_70/t0194a0fcf21bd85ec5.jpg
- p3.q####.com/dr/_100_70/t01a14d505dfbc8c821.jpg
- p3.q####.com/dr/_100_70/t01bcc2da87dda86028.jpg
- p3.q####.com/dr/_100_70/t01c16e36f9a3182662.jpg
- p3.q####.com/dr/_100_70/t01c29cde53dfbd1403.jpg
- p3.q####.com/t018a9cc33fe4135800.jpg
- p3.q####.com/t018b84477deb7d90c0.png
- p3.q####.com/t01ae4aad20279e7f68.png
- p3.q####.com/t01ae70f3f6372b712d.jpg
- p3.q####.com/t01c284e24d09f6b14d.jpg
- p3.q####.com/t01f9458c7931fe73bc.jpg
- p3.q####.com/video/568_320_70/t0109452af055465a28.webp
- p3.q####.com/video/568_320_70/t010ca6475d6de0c1c9.webp
- p3.q####.com/video/568_320_70/t011301d978999ffdab.webp
- p3.q####.com/video/568_320_70/t0114f29dea1ec5da14.webp
- p3.q####.com/video/568_320_70/t0117d6227688cdcea4.webp
- p3.q####.com/video/568_320_70/t0121d9f9da935845fe.webp
- p3.q####.com/video/568_320_70/t0130d099a5427277b0.webp
- p3.q####.com/video/568_320_70/t01337675f7c73b478d.webp
- p3.q####.com/video/568_320_70/t013399363e4d8c8aef.webp
- p3.q####.com/video/568_320_70/t01355312628928869d.webp
- p3.q####.com/video/568_320_70/t0140bb69a4c6fb3a0f.webp
- p3.q####.com/video/568_320_70/t014744ee7741f838ad.webp
- p3.q####.com/video/568_320_70/t014bf7cdea2a814b6f.webp
- p3.q####.com/video/568_320_70/t014fc732ba2a570065.webp
- p3.q####.com/video/568_320_70/t015527ba5a2ae3c89a.webp
- p3.q####.com/video/568_320_70/t01558aa52bb958ec28.webp
- p3.q####.com/video/568_320_70/t0158d3aa2cdf14fe4e.webp
- p3.q####.com/video/568_320_70/t016a68359467785a6b.webp
- p3.q####.com/video/568_320_70/t016e333511f7f7de30.webp
- p3.q####.com/video/568_320_70/t01817bf610ffbdf77a.webp
- p3.q####.com/video/568_320_70/t018b588da57a2e0849.webp
- p3.q####.com/video/568_320_70/t01a3a59d83ed336bec.webp
- p3.q####.com/video/568_320_70/t01b427e6d59b0a18dc.webp
- p3.q####.com/video/568_320_70/t01be54c48302708b71.webp
- p3.q####.com/video/568_320_70/t01bf573f0c084b1d5a.webp
- p3.q####.com/video/568_320_70/t01e18b67852aeaba16.webp
- p3.q####.com/video/568_320_70/t01ebedda0e1dd4d210.webp
- p3.q####.com/video/568_320_70/t01fa105610df07ddc2.webp
- p8.q####.com/dr/_280_50/t0109452af055465a28.webp
- p8.q####.com/dr/_280_50/t0117d6227688cdcea4.webp
- p8.q####.com/dr/_280_50/t013399363e4d8c8aef.webp
- p8.q####.com/dr/_280_50/t01355312628928869d.webp
- p8.q####.com/dr/_280_50/t01dd0c76d37c8dc0c7.webp
- p8.q####.com/dr/_280_50/t01e18b67852aeaba16.webp
- p8.q####.com/t01c1ff533a19145140.jpg
- p8.q####.com/t01eabeb32c4ae93244.jpg
- qos.l####.360.cn/vc.gif?&bid=####&pid=####&ver=####&c_ver=####&os=####&m...
- res.qhup####.com/360reader/click.gif?uid=411b8e6b4e089d595f860e077722395...
- s####.l####.360.####.com/Object.getFile/livecloudsdk/YW5kcm9pZF9wbHVnaW5...
- s####.s.360.cn/ak/6766aa2750c19aad2fa1b32f36ed4aee.html?m2=####
- s####.s.360.cn/su/index.php?k=####&av=####&slv=####&sv=####&be=####&cv=#...
- sdk.l####.360.cn/codec?os=####&tm=####&model=####&r=####&package=####&pi...
- sdk.l####.360.cn/rtc?os=####&tm=####&model=####&r=####&package=####&pid=...
- sdk.l####.360.cn/sdkconf/videoplace?sign=####&u=####&version=####&sdk_ve...
- sdk.l####.360.cn/xinxiliu_tv_android_10228.conf?os=####&tm=####&r=####&p...
- sh####.360t####.com/171122/c867c6e2f627a813302a3a0d0d891203/FZLTHK.TTF
- sni.c####.q####.####.net/tdata_jVg168
- sni.c####.q####.####.net/tdata_pSF696
- t####.c####.q####.####.com/tdata_EDT356
Запросы HTTP POST:
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- api.k.36####.com/k2/api/lockscreen/config?os=####&time=####&sys=####&m2=...
- c-h####.g####.com/api.php?format=####&t=####
- k####.36####.com/hotrizon2/report2?os=####&time=####&sys=####&m2=####&ap...
- k####.36####.com/k2/appconfig/getjarlist?appid=####&curEnv=####&m=####&m...
- k####.36####.com/k2/hotrizon2/getSInfo?os=####&sys=####&psw2=Fd####&ssid...
- m3.s.3####.cn/api/v1/newid
- p.s.3####.cn/pstat/plog.php
- p.s.3####.cn/update/update.php?p=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- u.api.l####.####.cn/comment/lists
- up####.sdk.jig####.cn/v1/push/sdk/postlist
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/15de269e-e93b-4e26-8a8f-8c6fb8fcb1b8
- /data/data/####/2033145970-602345128
- /data/data/####/4C3228E7AF86AF0BB35D594104950CAD.png
- /data/data/####/8c87839ccb4b
- /data/data/####/8e597da4-9833-4134-8534-ebd0ee084746
- /data/data/####/ACCS_BINDumeng;5a56c9198f4a9d0c2f0001a8.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alliance.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/FZ.TTF
- /data/data/####/MENU_CACHE.xml
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/PendantConfig.xml
- /data/data/####/QHDeviceFile
- /data/data/####/QHDeviceID.lock
- /data/data/####/QH_DeviceSDK.xml
- /data/data/####/QH_SDK_M2.xml
- /data/data/####/QH_SDK_UserData42998cf32d552343bc8e460416382dca.xml
- /data/data/####/QH_SDK_UserData6766aa2750c19aad2fa1b32f36ed4aee.xml
- /data/data/####/QH_SDK_sessionID42998cf32d552343bc8e460416382dc...leted)
- /data/data/####/QH_SDK_sessionID42998cf32d552343bc8e460416382dca.xml
- /data/data/####/TAB_CACHE.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/Y29tLmxpZ2h0c2t5LnZpZGVv.tick.lock
- /data/data/####/a6de7512-e31c-45cb-90b2-533139fcbde9
- /data/data/####/a797c442-eec2-4975-89f5-80f2d057b2c5
- /data/data/####/ab_test_config.xml
- /data/data/####/abtest_base_sp_filename42998cf32d552343bc8e4604...ca.xml
- /data/data/####/accs.db-journal
- /data/data/####/ad_config_file.xml
- /data/data/####/agoo.pid
- /data/data/####/android_player_20180725_145946_000.log_0
- /data/data/####/appPackageNames_v2
- /data/data/####/app_globel_config_file.xml
- /data/data/####/auth_guide_config_sdk.xml
- /data/data/####/auth_guide_config_sdk.xml.bak
- /data/data/####/banner.db-journal
- /data/data/####/cache.ttf
- /data/data/####/channel_webview.db-journal
- /data/data/####/cloud_config_file.xml
- /data/data/####/cloud_push_config_file.xml
- /data/data/####/cloud_switch_cache
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.rid.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/com.qihoo.livecloud.settings.GPWebrtcSettings.pref.xml
- /data/data/####/core_update
- /data/data/####/core_update_locker
- /data/data/####/critical_service_config.xml
- /data/data/####/daemon_webview.db-journal
- /data/data/####/dbfocus-journal
- /data/data/####/device_collector
- /data/data/####/device_collector_locker
- /data/data/####/download-journal
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/finalcore.jar
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/hotrizon_sharepref.xml
- /data/data/####/http_cookie.xml
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/i==1.2.0&&1.2.28_1532530760523_envelope.log
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_local_notification.db-wal
- /data/data/####/jpush_stat_cache.json
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/jpush_statistics.db-shm (deleted)
- /data/data/####/jpush_statistics.db-wal
- /data/data/####/jpushservice_webview.db-journal
- /data/data/####/libdvrender.so.tmp
- /data/data/####/libjiagu-71411075.so
- /data/data/####/libjplayer.so.tmp
- /data/data/####/liblocalserver.so.tmp
- /data/data/####/libmyssl.so.1.1.tmp
- /data/data/####/libtranscore.so.tmp
- /data/data/####/libviewer.so.tmp
- /data/data/####/libyfnet_360.so.tmp
- /data/data/####/light_sky_avast.xml
- /data/data/####/localserver_2.0.3.18042602.zip
- /data/data/####/locker
- /data/data/####/log_reupload_task
- /data/data/####/log_reupload_task_locker
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/msplugin_ksp.xml
- /data/data/####/multidex.version.xml
- /data/data/####/p.l
- /data/data/####/player_20180725_145949_000.log_0
- /data/data/####/player_record_2.0.3.18051401.zip
- /data/data/####/privacy_config_file.xml
- /data/data/####/profile_task
- /data/data/####/profile_task_locker
- /data/data/####/profile_torch_platform
- /data/data/####/push.db-journal
- /data/data/####/push.pid
- /data/data/####/push_share.xml
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qhvc_plugin.xml
- /data/data/####/run.pid
- /data/data/####/safe_user_info_file.xml
- /data/data/####/screen_conf.xml
- /data/data/####/session_base_sp_filename42998cf32d552343bc8e460...ca.xml
- /data/data/####/session_base_sp_filenameandroidID.xml
- /data/data/####/share_data.xml
- /data/data/####/shortcut_badger_sharepref.xml
- /data/data/####/sp.livecloud.database.xml
- /data/data/####/sp_file_recommend_upload.xml
- /data/data/####/tab_request_name.xml
- /data/data/####/tdata_jVg168
- /data/data/####/tdata_jVg168.jar
- /data/data/####/tdata_pSF696
- /data/data/####/tdata_pSF696.jar
- /data/data/####/tools_2.0.3.18051401.zip
- /data/data/####/torch_sdk_config.xml
- /data/data/####/trans_20180725_145949_000.log_0
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/uninstall_apk
- /data/data/####/uninstall_apk_locker
- /data/data/####/universalPopup.xml
- /data/data/####/videolist.db-journal
- /data/data/####/waitingDown
- /data/data/####/waitingDown_locker
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/yf_p2p_201804191558.zip
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.deviceId
- /data/media/####/.iddata
- /data/media/####/.nomedia
- /data/media/####/.push_deviceid
- /data/media/####/.sfp
- /data/media/####/.testf
- /data/media/####/.umm.dat
- /data/media/####/0DCjN021HW54m8Ag8C9fyzpBYY4.-2002409173.tmp
- /data/media/####/0qtZ0eAbc-CVju_K9rG8fPuU98g.1399683182.tmp
- /data/media/####/10264645306e4b34b5afc547b8c66c08
- /data/media/####/1Mg2J3p0MWrzoYDAbd67KqV64xE.-652354025.tmp
- /data/media/####/3BGjIz3U4r_qYUsyWlwVMajJIOw.-1345785976.tmp
- /data/media/####/3TN9JeE7Z5mbb718lSlYzQezgFI.1602513642.tmp
- /data/media/####/3bnIf3eFTDE8HJKud_Ek0U0xloA.-439073557.tmp
- /data/media/####/42998cf32d552343bc8e460416382dca
- /data/media/####/5GW-BxP2KcZy578EndASCzcMQZ4.-1702066576.tmp
- /data/media/####/5UR91GU6P5kJZI0r34fctFGM9hw.2064113669.tmp
- /data/media/####/5zLO6HIlb0jgAm8YMHxIMfc0gsE.1607579865.tmp
- /data/media/####/60MO1SXIN1dCWiR2H0kq2d9eCAk.-857271173.tmp
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee (deleted)
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee.tmp
- /data/media/####/6PvixC-nD3IVmFNtUqrkb3ynL60.-196480285.tmp
- /data/media/####/6VzzC07JSEQODUKPvcU_1em1xjk.-760674516.tmp
- /data/media/####/6fNn7X1hTuCQ2rc6cWGKTMMBEmc.-557843013.tmp
- /data/media/####/6xE4_u0q0cTp1ZLFwh9NGpXuM0o.1842828799.tmp
- /data/media/####/71e4952f000e447cb78176b238b800e0
- /data/media/####/7UBgawVMlj9pVOokd4mDx405AB4.-682568790.tmp
- /data/media/####/9M0
- /data/media/####/9M0 (deleted)
- /data/media/####/Alvin2.xml
- /data/media/####/Bu7BKdmU-xOSQ5fMqDNXzLHTCPE.-308322897.tmp
- /data/media/####/ContextData.xml
- /data/media/####/DSGkAweW1-H-pdnFtqUx4-1xLG8.-572407365.tmp
- /data/media/####/DTZ8tjMkpUIJg9UsaAS4UA5fwVc.1463625162.tmp
- /data/media/####/Db35u4kEWvnY2yC8eshSVSmQvro.-584705453.tmp
- /data/media/####/Gi237f0nHbG7g4WiRB3nDuAgYcE.210109649.tmp
- /data/media/####/H6n
- /data/media/####/H6n (deleted)
- /data/media/####/HHZMEqF2vGMl1lG_EAF9BfnoTOs.-663468048.tmp
- /data/media/####/KcPUjZoK2wee3ObDsjWHa3CBMkg.-947114109.tmp
- /data/media/####/LA5vDUPDRYC_MBVoh9sAW70zAU0.-1975055379.tmp
- /data/media/####/M8dRsKWCrVLCqDZME7L8l0Eo4uk.-766930493.tmp
- /data/media/####/MAZY5aEci3sxXHBBkXofXV6SYrU.963043135.tmp
- /data/media/####/MDCq3De_IMxBdOWyRPVXMXKoFPg.800369692.tmp
- /data/media/####/MDg4SbGO3k78hutDKEfsBmQ-LtE.-808962746.tmp
- /data/media/####/MNPWuVnbCAV5e48WHfeeMNUQsu4.-2136150039.tmp
- /data/media/####/MYMtYMmxzXN2X-uqF5OfY6kwjzw.10010720.tmp
- /data/media/####/MdzkIMMnw-Pqb_s9BIRWUNs4v1g.-1232760434.tmp
- /data/media/####/NbqxF6K2Ac3FBhpn8wQEw5d9n8A.1095336300.tmp
- /data/media/####/O0VnZkfxv-vGi-AJNQQ5V6LTiyo.1606915836.tmp
- /data/media/####/O5Q5kIU7-0JTlquzdMXicXaPML8.2040726380.tmp
- /data/media/####/OBsFdNaPqU7Efx_jWRsSbOorSBk.-1261993807.tmp
- /data/media/####/OOGAh-apUnfMM8KZobc90wNCi9Q.-2067460900.tmp
- /data/media/####/OORqCJmJjOPhPZubASg3FnJ6Prc.1266473093.tmp
- /data/media/####/PFueWFtBBrcS6V6kxftt3AzaRZk.-508227767.tmp
- /data/media/####/PXGdgBpVxH327ipknn9PLp0Rlqw.196776327.tmp
- /data/media/####/Qt6RAt3fQzVpYav-E6MTKs3Jwo8.1943953579.tmp
- /data/media/####/Rp6Cjtb7oV0yECI_LivNsBXFLaQ.-1830559826.tmp
- /data/media/####/U7hg6mwrSb-Z0OJbv_r14cMUjvk.660931890.tmp
- /data/media/####/VVE6oN4OggNpl7Klr6BcacCg87k.-109622109.tmp
- /data/media/####/W72nAVVxvX_UDDFuB0htrGcREv8.-1322124582.tmp
- /data/media/####/WYyIhksfybSdr2grMzvle2mm4Y8.-295493565.tmp
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv (deleted)
- /data/media/####/Ydr6uhrQhngA7AFZY7unxapaPik.-1105635713.tmp
- /data/media/####/ZYGlgt07EG8dnQfb7YaAJQ4JkUA.-1377074879.tmp
- /data/media/####/ZuY1LM74F27647yhL1Cc9XMD3Ac.1394205055.tmp
- /data/media/####/_Rj42f-v1PZMCOBDRn0ovctShSE.-1511052004.tmp
- /data/media/####/_ZuGBiT1gM8b_hjztFVY1QVP5M0.-1859007197.tmp
- /data/media/####/__VERSION__
- /data/media/####/_bb8Kr7DPnlnm-9yfOjAsfa0-bo.-1610272020.tmp
- /data/media/####/a22iI3l3Wv1JORZxX3NHIF1JWqQ.-47499209.tmp
- /data/media/####/a5t8laB3dOCC_v5j54JcEE9uE2g.-384072234.tmp
- /data/media/####/aGWoJ1ndkj_IbMvL3lmYbq0HjiI.1195952305.tmp
- /data/media/####/aGWoJ1ndkj_IbMvL3lmYbq0HjiI.cnt
- /data/media/####/aXIZUVdWwQ7ihxaBvggwdc2r1SQ.171322585.tmp
- /data/media/####/app.db
- /data/media/####/avast_done
- /data/media/####/b05ce39c1fe9e72dc1df70989e7e6d14
- /data/media/####/bIlQPzFSFD1X7FN5gTPmQOWB-1w.-510211217.tmp
- /data/media/####/c2rfqJ8SeYEDoVg5uUKnTg0J1Dw.-1318028652.tmp
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.lightsky.video.bin
- /data/media/####/com.lightsky.video.db
- /data/media/####/d0e98d629c754debb5f3a2554f2175a5
- /data/media/####/d198971a1db249acaad2852c78d7ed50
- /data/media/####/data.lock
- /data/media/####/deviceToken
- /data/media/####/eeN-ThXC2B4K9fILuwtlaMXDrok.-509026063.tmp
- /data/media/####/enHdz3U6pFYXzXwLiRmsCQ209p4.866781172.tmp
- /data/media/####/hRfoR0jJ0OYeIpeJ5JQ032lGzrs.1842089730.tmp
- /data/media/####/hhSNH-K4YVQHoMEtjJMRyq79ECI.-2108968949.tmp
- /data/media/####/inUwdEpzYd_J8is5UJxZ2W8HNxA.-1204106722.tmp
- /data/media/####/j3hlYyBgBKneRthCLgIg-xpvRvU.-563899511.tmp
- /data/media/####/j3nQOhxkcSfnNjQiwuRNK5ipD1c.-804970791.tmp
- /data/media/####/jBwfC_teN5JtvfjlfusfaKI8hKM.-532182126.tmp
- /data/media/####/jcSAOr9jGZwkhQZMXMgqUBAFH0c.-822110279.tmp
- /data/media/####/k9a
- /data/media/####/k9a (deleted)
- /data/media/####/lrxT2XjLkzUJfLiQ62LBz-kcurM.-1651301988.tmp
- /data/media/####/ogceans0-pIcKfh2Po6juY56suY.1003432100.tmp
- /data/media/####/pi7juBgpQQFIbnCP1exDkG5pQf0.-1922573963.tmp
- /data/media/####/q3B
- /data/media/####/q3B (deleted)
- /data/media/####/qBAdpRjA0-WlH8aM5fXGyjmpLgc.670297998.tmp
- /data/media/####/report.lock
- /data/media/####/sjQum8Qdi7jTPd4z-Jo13Lm4oAc.-626611521.tmp
- /data/media/####/t-Fo5-TrkhGwzV7Y0fyYPF8XW0I.-273096626.tmp
- /data/media/####/tBJ2MXuZIdfHgGx3JWG-wUk3Css.2031361460.tmp
- /data/media/####/tdata_jVg168
- /data/media/####/tdata_pSF696
- /data/media/####/test.log
- /data/media/####/ti1M9zEm-n-bJSsDQu4VSQyS6V4.-1920578012.tmp
- /data/media/####/ukZnJFFx8kipimVOo3DYmW8XcUI.188252140.tmp
- /data/media/####/uninstall_apk_list
- /data/media/####/vGf8cFDYKluKRc8YCDzD9YxXwUs.1193509562.tmp
- /data/media/####/wYQoxwlyGpFHaaY2MQ-pMVScn4g.689740802.tmp
- /data/media/####/wghDzq1vsBJbyD-FUYl67mVOvZc.-912059560.tmp
- /data/media/####/xUm-uHLZseen7-xzU1dB1QKFots.-1150446264.tmp
- /data/media/####/yEcVesxDdoaqb34OhKPOKVj2FLc.1581040702.tmp
- /data/media/####/yiDEbnuRI0nmWDX1xnqwPzJ32k0.760286059.tmp
- /data/media/####/ytyeZ3G1vmvQhL9bVZTf-fzyVeE.-767942077.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/xbin/which su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a56c9198f4a9d0c2f0001a8","utdid":"W1iQRmU7aVQDAGdzx1FSzUxz","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0
- cat /proc/version
- cat /sys/class/net/wlan0/address
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-71411075.so
- ls -l <Package Folder>
- ls /
- ls /sys/class/thermal
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0
Загружает динамические библиотеки:
- GPBreakpad
- getuiext2
- jcore120
- libdvrender
- libimagepipeline
- libjiagu-71411075
- libjplayer
- liblocalserver
- libtranscore
- libviewer
- libyfnet_360
- tnet-3.1
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- DES
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- DES
Использует повышенные привилегии.
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
