Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sc.yunjigl####.com:80
- TCP(HTTP/1.1) a####.b####.qq.com:8011
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) pin####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) 2####.107.1.1:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) 2####.107.1.65:80
- TCP(HTTP/1.1) vi####.yunjigl####.com:80
- TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(TLS/1.0) sc.yunjigl####.com:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP(TLS/1.0) gl####.w.kunl####.####.com:443
- TCP(TLS/1.0) g.al####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
Запросы DNS:
- 7j####.c####.z0.####.com
- 7x####.c####.z0.####.com
- a####.b####.qq.com
- a####.man.aliy####.com
- aeu.al####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- c####.g####.ig####.com
- c####.g####.ig####.com
- c-h####.g####.com
- d####.yunjiwe####.com
- g.al####.com
- i####.yunjiwe####.com
- img.al####.com
- m.yunjigl####.com
- pi####.qq.com
- pin####.qq.com
- pub-####.qin####.com
- sc.yunjigl####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st####.yunjigl####.com
- st####.yunjiwe####.com
- vi####.yunjigl####.com
Запросы HTTP GET:
- gl####.w.kunl####.####.com/002382df611d407db35c77333b067c14.jpg
- gl####.w.kunl####.####.com/0402a699281cd204ce7315a96580ae7a.jpg
- gl####.w.kunl####.####.com/04ef94abdc0948ac5015f5de1be70c64.jpg
- gl####.w.kunl####.####.com/05b50f9295e348cbd233416ac8a58e14.jpg
- gl####.w.kunl####.####.com/06d62ac9ca1c1650b08ac79ffd332bce.jpg
- gl####.w.kunl####.####.com/07ce562229ecb82f7b1045014cdfb746.jpg
- gl####.w.kunl####.####.com/09046eb0ff8a6236bd32d5814dd79376.jpg
- gl####.w.kunl####.####.com/093605e4ec3a9e77cf72c9baff39f0a8.jpg
- gl####.w.kunl####.####.com/093cff4dbe376e0aa01f7386730cad7a.jpg
- gl####.w.kunl####.####.com/095d9b9986134a00d617a8d07426ac2a.jpg?imageMo#...
- gl####.w.kunl####.####.com/0ea7622b494922c0be331c5f07d57a89.jpg
- gl####.w.kunl####.####.com/0fd6b2b24deffb981f17ca0a1d56433f.jpg
- gl####.w.kunl####.####.com/106883f18f1bdf8d7554fc5ab2be7d3c.jpg
- gl####.w.kunl####.####.com/12ce73eed94ca2d192ae41365e47d2fb.jpg
- gl####.w.kunl####.####.com/1478148d5e2a7b10fec056a6d314ea0a.jpg
- gl####.w.kunl####.####.com/14e50ea49f6837cfa70f78f9809060bd.jpg?imageMo#...
- gl####.w.kunl####.####.com/156cbde54939b28e0ded57d8bcbaa410.jpg?imageMo#...
- gl####.w.kunl####.####.com/1d0432ef96ec343a372111dec8010777.jpg
- gl####.w.kunl####.####.com/1e2a5bd3f47cf9dbc0658727fafda4fd.jpg
- gl####.w.kunl####.####.com/23f838afdebc81e0ec454976ea1177c5.jpg
- gl####.w.kunl####.####.com/26e84d2822cb95bd240edd4b3fc323f1.jpg?imageMo#...
- gl####.w.kunl####.####.com/292e7c78ef48381e808e0a7f6f9ae711.jpg?imageMo#...
- gl####.w.kunl####.####.com/2ec0dc73519d6db3c74a7565101ed24d.jpg
- gl####.w.kunl####.####.com/2f029168d67de605d50fb3d6c66cd64a.jpg?image####
- gl####.w.kunl####.####.com/2f029168d67de605d50fb3d6c66cd64a.jpg?imageMo#...
- gl####.w.kunl####.####.com/2f7dd5a4e5c660930596672db92edb74.jpg
- gl####.w.kunl####.####.com/2f9ce8bbf1de7fa39efb3c290be774a0.jpg
- gl####.w.kunl####.####.com/2fd927becb7beea17f90aeeaffe2bd09.jpg
- gl####.w.kunl####.####.com/309d9dab7cc287b0a66567a70ec6052d.jpg
- gl####.w.kunl####.####.com/30c627df561879978b186aae33fa4419.jpg?imageMo#...
- gl####.w.kunl####.####.com/353ff803d6e2d657c295d78caa66ca53.jpg
- gl####.w.kunl####.####.com/3804b3838099b6c84c65666d7a1d6990.jpg
- gl####.w.kunl####.####.com/38b15a0003f6424e49a96358b9dd8c0b.jpg
- gl####.w.kunl####.####.com/399e81d310b61f1699a783ce64da50f8.jpg?v=####
- gl####.w.kunl####.####.com/3a47ea599b1fedf4e7304ceb6a14954e.jpg
- gl####.w.kunl####.####.com/3af2f29796a822d0717fb2762855ce37.gif
- gl####.w.kunl####.####.com/3b7453e7ad668e073bf5187f90ad999b.jpg
- gl####.w.kunl####.####.com/3c278ae268e0e1b99d9fafc32388ed0d.jpg
- gl####.w.kunl####.####.com/3d8bb72e11d68863eab0dfd4442f91a7.jpg?imageMo#...
- gl####.w.kunl####.####.com/3db8f1edfc6dfa8060be1c0906c52235.jpg
- gl####.w.kunl####.####.com/405e5278d215b611eadfa73ee61a4ae7.jpg
- gl####.w.kunl####.####.com/41e0f9320fc3554c7c51ce7882d25137.jpg
- gl####.w.kunl####.####.com/43eb937d1e3db0188c9b16a2c1dc1192.jpg
- gl####.w.kunl####.####.com/4646d71c27b209f93b7c79693ce17347.jpg
- gl####.w.kunl####.####.com/474cb26d039edaade309bd2999b5b8a4.jpg
- gl####.w.kunl####.####.com/477fbb183b4fba9f406a1435fbe7af43.jpg
- gl####.w.kunl####.####.com/4b936558be6786731bd507aef89336db.jpg
- gl####.w.kunl####.####.com/5b5bd0347201b9339c1c67ea648c789e.jpg
- gl####.w.kunl####.####.com/5be7087a97e93af1458d51ac5f172b8d.jpg
- gl####.w.kunl####.####.com/5d739ec7e3f3661c8c74917c08e08a47.jpg
- gl####.w.kunl####.####.com/5f0098a6c322ab39467486eed4b80f73.jpg
- gl####.w.kunl####.####.com/61d2f7a0f4efac25c425af6bfeefc4d7.jpg
- gl####.w.kunl####.####.com/61fa3c7821bc2bd10425331d7307f8bf.jpg
- gl####.w.kunl####.####.com/64fa069ebb8df19ca39cb0951de49057.jpg
- gl####.w.kunl####.####.com/665d155670e57aba64b8f8f92ad706f9.jpg
- gl####.w.kunl####.####.com/66765f9ff90cb25b2d980822cba8af9e.jpg
- gl####.w.kunl####.####.com/679a917776d7ff1524104ac3b0bd067c.jpg
- gl####.w.kunl####.####.com/6ef961806bab85656f4f695e20decf7f.jpg?v=####
- gl####.w.kunl####.####.com/70686ada6e58cde74862908446b40d5a.jpg?imageMo#...
- gl####.w.kunl####.####.com/70c16b0c1fc02bc37a44a358e168b7b5.jpg?imageMo#...
- gl####.w.kunl####.####.com/7190f8f370ca7e42ef1a5b064edbfae7.jpg
- gl####.w.kunl####.####.com/71e31ca93272033224ddc262390c7b06.jpg
- gl####.w.kunl####.####.com/7218c47968da6987b325f5dbe7598ac4.jpg
- gl####.w.kunl####.####.com/736fa2c23cae0f3bebebe50a7af7c326.jpg
- gl####.w.kunl####.####.com/73a84dd2713c0d0b26174245e8df3293.jpg?imageMo#...
- gl####.w.kunl####.####.com/757a356de7d3e98ecc2d086c6ced9257.jpg?imageVi#...
- gl####.w.kunl####.####.com/77d008e7b7a9ca84c0da1a1a5dbbc41b.jpg
- gl####.w.kunl####.####.com/787a0984464e6eeed97cb541471cac98.png
- gl####.w.kunl####.####.com/7993ec68eebe667e8baad5db12d8a7f0.jpg
- gl####.w.kunl####.####.com/7a2b8fb3a8ef88b6550560bcb7da2955.jpg
- gl####.w.kunl####.####.com/7c075435a4c56fe92319cd7c361209f3.JPG
- gl####.w.kunl####.####.com/7c3f464b89815e82496f64e1e47d1896.jpg
- gl####.w.kunl####.####.com/7c6aa68e4c80dc8198662431cd85d7dd.jpg
- gl####.w.kunl####.####.com/7ca7cdafac54247b8a454c01fb5f1121.jpg
- gl####.w.kunl####.####.com/7cc0a98831deed11429802502af32b92.jpg
- gl####.w.kunl####.####.com/7cc7402c25ae3078facad8cd59bbae65.jpg
- gl####.w.kunl####.####.com/7ec63932f86e2a30981af871ec20af8e.jpg
- gl####.w.kunl####.####.com/7ee0137729b816f2a34d234f35f3ee32.jpg?imageMo#...
- gl####.w.kunl####.####.com/7f3c504364a04a3541cac8d94a30b076.jpg
- gl####.w.kunl####.####.com/7f55b7d0e3594fdf451582e66babf302.jpg?imageMo#...
- gl####.w.kunl####.####.com/808eebbed159aa1b80352bb8b512bdc2.jpg
- gl####.w.kunl####.####.com/8532f0c7dd632a0c3206ccfa4b0310a3.jpg
- gl####.w.kunl####.####.com/89cbe5e9156572ac6ba9b3298ed149bd.gif
- gl####.w.kunl####.####.com/8c1c6a0432417ca846dee38eee0396c7.jpg
- gl####.w.kunl####.####.com/8cd20b3b4af818e687854ae5cc966949.jpg?imageMo#...
- gl####.w.kunl####.####.com/8d5487f5713ec86109bc4e78ff42fdb5.jpg?imageMo#...
- gl####.w.kunl####.####.com/8f9cacd0f7c144733793e826428c6034.jpg?imageVi#...
- gl####.w.kunl####.####.com/90fe087b45ba75204b1211f7abfd7b07.jpg
- gl####.w.kunl####.####.com/9196c6a948936beb1b2ea490f5f18747.jpg
- gl####.w.kunl####.####.com/9363a485c8fec5d43cc9774adfdfb45b.jpg
- gl####.w.kunl####.####.com/946269ffe89f4eb406e27ea4e710f21b.jpg
- gl####.w.kunl####.####.com/9704f707368129f33620d76038012e7f.jpg
- gl####.w.kunl####.####.com/98b3643d79a2676ca997856921e144e8.jpg
- gl####.w.kunl####.####.com/993be4f76e7bd87c5040635a19c2fe2d.jpg?imageMo#...
- gl####.w.kunl####.####.com/99611e04b89aac7dfe2c2e0a86cbec5e.jpg
- gl####.w.kunl####.####.com/9ad6ab6d8cedc753bfdfc2964f990a65.jpg
- gl####.w.kunl####.####.com/9d040b53edc207d3071807e660ddc162.gif
- gl####.w.kunl####.####.com/9f75d821766e97e5ba32c99df05188bf.jpg
- gl####.w.kunl####.####.com/FiPSSyPkNCVXsLylt5n_aQuH7NpD
- gl####.w.kunl####.####.com/FrjYfrmO_nQupESmVvKi2vcEZSaj
- gl####.w.kunl####.####.com/a2c3300f2c7d2de67d276f2c7ee7014c.jpg
- gl####.w.kunl####.####.com/a327c552c606f7a1fb4f516eb8ef3bc4.jpg
- gl####.w.kunl####.####.com/a6f5afb7b044c7f6063d01c479edd94b.jpg
- gl####.w.kunl####.####.com/a970002320a7a264aaa3967c1d7d21a8.jpg
- gl####.w.kunl####.####.com/ab4243da30916666319212e9ec1beb64.jpg
- gl####.w.kunl####.####.com/b68097446070fca93349fc8bffd72ec2.jpg
- gl####.w.kunl####.####.com/b6c6945364eaff325ba14d33f76b952c.jpg
- gl####.w.kunl####.####.com/b9f5e7a26049207d3c4e8fe262fa7733.jpg
- gl####.w.kunl####.####.com/bbc42d5911c7b8c3fe374fec83a23c79.jpg
- gl####.w.kunl####.####.com/bcf7254518ef374678f038bc9857fb93.jpg
- gl####.w.kunl####.####.com/bebefe000d41006f611caeed43a3f3cd.jpg
- gl####.w.kunl####.####.com/c1c4efcdd89013331ad6f93cf8de8e73.jpg
- gl####.w.kunl####.####.com/c53b783acdfa1a3c2668168f80e4015e.jpg
- gl####.w.kunl####.####.com/c5e4be56ea63e2a40dc69b3ff59491b8.jpg
- gl####.w.kunl####.####.com/c5f6f873617f396077760342402a7a7f.jpg
- gl####.w.kunl####.####.com/c658abccb5f0bcef15a9287d79ad306a.jpg
- gl####.w.kunl####.####.com/c7ecf9d3b974fbee27805e93641d479d.jpg
- gl####.w.kunl####.####.com/c83f0a833950537fc799006074185416.jpg
- gl####.w.kunl####.####.com/ca50d2d87e7480bdc4e809b7f4577334.jpg
- gl####.w.kunl####.####.com/cc0d58967ca66c94edde3b03cb4cf861.jpg
- gl####.w.kunl####.####.com/ce379fa64db6f636e6c9a343c0c0556d.jpg
- gl####.w.kunl####.####.com/cf2d52fe05e9c97a870d90b27836b35e.jpg?imageMo#...
- gl####.w.kunl####.####.com/d12debe6008dcb3b6f25d0f1deb8fcac.jpg
- gl####.w.kunl####.####.com/d2c750dfbbc65e235d69cc2f91e1d689.jpg
- gl####.w.kunl####.####.com/d4e5ec671c56c04eb5dc65d8d04db0ec.jpg
- gl####.w.kunl####.####.com/d63f9e3fe66dcaf720084267d61e7ff9.jpg
- gl####.w.kunl####.####.com/d69431697ef1a117bc03ea0fada2b10f.png
- gl####.w.kunl####.####.com/d80ab59b241eed908eb1fbccd1f8cebd.jpg
- gl####.w.kunl####.####.com/dba408f56c9af8a3c2771ad2dcfe0221.jpg
- gl####.w.kunl####.####.com/dc5929276abf5de4df665da81fab646c.jpg
- gl####.w.kunl####.####.com/dcabd21f11f8692d5804258e6df1c84c.jpg
- gl####.w.kunl####.####.com/dd42b10635d3f2429cb25689dfa6094c.jpg?imageMo#...
- gl####.w.kunl####.####.com/dda2c2f429bb31668d9f36df29b8f155.jpg
- gl####.w.kunl####.####.com/e13520aba7d376132c79e92a8a19a9ca.jpg
- gl####.w.kunl####.####.com/e2ab36a2b0271d1a3b22c1c1b987634b.jpg
- gl####.w.kunl####.####.com/e523414cde6bb1b5eedb60d5b9d9dfcc.jpg
- gl####.w.kunl####.####.com/e52d2c1c97a960851a84d7ddda20ee4e.jpg?imageMo#...
- gl####.w.kunl####.####.com/e5479fec685c5d36f8f5686a6e044170.jpg
- gl####.w.kunl####.####.com/e6923735dde86b43234be328a1351163.jpg?imageMo#...
- gl####.w.kunl####.####.com/e8e3780bb6a18d65a71f7583fa7c4173.jpg
- gl####.w.kunl####.####.com/eefcf79df248c0467d0ccf87c0437dd5.jpg
- gl####.w.kunl####.####.com/f146cb6b5c2fa1896dc27401f936d26a.jpg
- gl####.w.kunl####.####.com/f2da49f09190ab2f636291bafd749c0d.jpg
- gl####.w.kunl####.####.com/f6e50235520b495d912378f8911a8d56.gif
- gl####.w.kunl####.####.com/f8d9b49b4bd4c2e16e07c8568b290ce2.jpg
- gl####.w.kunl####.####.com/fa69bec6aeb6b092f59ea40767ed7eb4.jpg
- gl####.w.kunl####.####.com/faedfbeed78934b4c54b6ae73fcf3194.JPG
- gl####.w.kunl####.####.com/fd4151cc41b795ec55d0756dc04b6ba1.jpg
- gl####.w.kunl####.####.com/fe5fd1e7a3ab3377089157ed888e003f.jpg
- gl####.w.kunl####.####.com/fe62575294b2c8bf16214a6c389bed82.jpg
- gl####.w.kunl####.####.com/fee55a4d2f65703f0772d38e74341f80.jpg
- gl####.w.kunl####.####.com/item_idc/099fc554b532b55353db666b738889bc.jpg...
- gl####.w.kunl####.####.com/item_idc/163c1718517a8c620f0ee954061f2e6e.jpg...
- gl####.w.kunl####.####.com/item_idc/1c35ce4f884c555db8eae19c3fdfb0c7.jpg...
- gl####.w.kunl####.####.com/item_idc/267bb1a636cd14c7865b907ee187dd24.jpg...
- gl####.w.kunl####.####.com/item_idc/2b4334a0f8e0dae7367dce018f5eca45.jpg...
- gl####.w.kunl####.####.com/item_idc/2e94d4511d24125b50e33423e67c72ae.jpg...
- gl####.w.kunl####.####.com/item_idc/34b72e01a813749d18a82ab87d855ebd.jpg...
- gl####.w.kunl####.####.com/item_idc/3a00a5312e3cf50f31f03397a53d9890.jpg...
- gl####.w.kunl####.####.com/item_idc/4e461da7aef3b23b16f2a102464c19ef.jpg...
- gl####.w.kunl####.####.com/item_idc/6383a3352333fd2a28676be99b7b2e2f.jpg...
- gl####.w.kunl####.####.com/item_idc/7453686ca7101190ccb065ba5c85bcb3.jpg...
- gl####.w.kunl####.####.com/item_idc/780fde2e1d14984e35112d811fafccf9.jpg...
- gl####.w.kunl####.####.com/item_idc/7dfd229b893f2443a7163f3c38bff22b.jpg...
- gl####.w.kunl####.####.com/item_idc/840a209dab6d8d22a028434b73d51820.jpg...
- gl####.w.kunl####.####.com/item_idc/8651b9cf4e5cb1bbf902d10f5a1ea913.jpg...
- gl####.w.kunl####.####.com/item_idc/95644b2ee97093ead5f2fcc442430827.jpg...
- gl####.w.kunl####.####.com/item_idc/98031f8f5033a1636f8da824d5c6509c.jpg...
- gl####.w.kunl####.####.com/item_idc/9872b00e834da8dd83f028d53e04d23c.jpg...
- gl####.w.kunl####.####.com/item_idc/a34749b8fdad0b3b25b9924fc073104b.jpg...
- gl####.w.kunl####.####.com/item_idc/b483fcbccf0fe1f4e30847d0b5987163.jpg...
- gl####.w.kunl####.####.com/item_idc/bae8c636d9fd2cdc06e68eee2bbda82e.jpg...
- gl####.w.kunl####.####.com/item_idc/beedb65044a869d6c5eeee294b544bb8.jpg...
- gl####.w.kunl####.####.com/item_idc/bfd5b843691228c8e5b601130691ced1.jpg...
- gl####.w.kunl####.####.com/item_idc/c3a27e04799de67d325162bcd20674be.jpg...
- gl####.w.kunl####.####.com/item_idc/ce1a8c93aaea6518a53096d68f9575df.jpg...
- gl####.w.kunl####.####.com/item_idc/d8540984b899212870269305607db6f9.jpg...
- gl####.w.kunl####.####.com/rn_android/1/config.json?t=####
- gl####.w.kunl####.####.com/rn_android/20180815124635/package.zip
- sni.c####.q####.####.net/20180813170905527902.jpg?imageVi####
- sni.c####.q####.####.net/20180813171311322225.jpg?imageVi####
- sni.c####.q####.####.net/20180813171638617011.jpg?imageVi####
- sni.c####.q####.####.net/20180813171956595327.jpg?imageVi####
- sni.c####.q####.####.net/20180813172351917645.jpg?imageVi####
- sni.c####.q####.####.net/20180813172942171683.jpg?imageVi####
- sni.c####.q####.####.net/20180813173417662467.jpg?imageVi####
- sni.c####.q####.####.net/20180813173633442676.jpg?imageVi####
- sni.c####.q####.####.net/20180813173833267023.jpg?imageVi####
- sni.c####.q####.####.net/20180813175954828229.jpg?imageVi####
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_YYn966
- sni.c####.q####.####.net/tdata_eOt091
- t####.c####.q####.####.com/tdata_EDT356
- vi####.yunjigl####.com/yunjiapp4buyer/app4buyer/buyervip/startPage.json?...
- vi####.yunjigl####.com/yunjiapp4buyer/app4buyer/global/queryByUrlPath.js...
Запросы HTTP POST:
- a####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- and####.b####.qq.com/rqd/async?aid=####
- c-h####.g####.com/api.php?format=####&t=####
- pi####.qq.com/mstat/report/?index=####
- pin####.qq.com/request
- sc.yunjigl####.com/yunjidata/data/reportByJsonString.json
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- vi####.yunjigl####.com/yunjidata/data/reportByJsonString.json
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1037359673
- /data/data/####/-1674496260
- /data/data/####/075dad080b00e5bb690a2458c5f7beee.0.tmp
- /data/data/####/075dad080b00e5bb690a2458c5f7beee.1.tmp
- /data/data/####/09c2470c327e04acc47f0fbaff83f1a5.0.tmp
- /data/data/####/09c2470c327e04acc47f0fbaff83f1a5.1.tmp
- /data/data/####/0ecdaa72cdfead67133a7c586ffb7190.0.tmp
- /data/data/####/0ecdaa72cdfead67133a7c586ffb7190.1.tmp
- /data/data/####/1002
- /data/data/####/1004
- /data/data/####/1f2c6fd77780dedf250676a0eca4ea68.0.tmp
- /data/data/####/1f2c6fd77780dedf250676a0eca4ea68.1.tmp
- /data/data/####/201808161215208.v1.crash
- /data/data/####/302f0b4cee48c15769e5662d3673b6e7.0.tmp
- /data/data/####/302f0b4cee48c15769e5662d3673b6e7.1.tmp
- /data/data/####/3GBk1igOW3EyvElmSIxJ3Hx6Gao.1035358146.tmp
- /data/data/####/3c5bf4e9d455a6405d389307311c370d.0.tmp
- /data/data/####/3c5bf4e9d455a6405d389307311c370d.1.tmp
- /data/data/####/3d175ab5fb70792f518e3e15c69f1947.0.tmp
- /data/data/####/3d175ab5fb70792f518e3e15c69f1947.1.tmp
- /data/data/####/4cb0ae6920ec0eef33792c67b91dc0bb.0.tmp
- /data/data/####/4cb0ae6920ec0eef33792c67b91dc0bb.1.tmp
- /data/data/####/5402bc51d07e995a439097884898a68f.0.tmp
- /data/data/####/5402bc51d07e995a439097884898a68f.1.tmp
- /data/data/####/576399710
- /data/data/####/622f4382b779ab61a8706401e26c073e.0.tmp
- /data/data/####/622f4382b779ab61a8706401e26c073e.1.tmp
- /data/data/####/698caa1674fd0d75d721847eabb655b6.0.tmp
- /data/data/####/698caa1674fd0d75d721847eabb655b6.1.tmp
- /data/data/####/7027bbe6d84e
- /data/data/####/761511270
- /data/data/####/798081204
- /data/data/####/8b5ebd37dd9bb0d753fa92d6b9c5321015711372fdb2c00....0.tmp
- /data/data/####/8f3a777d627f08d19ce45c3b47ddcb3c.0.tmp
- /data/data/####/8f3a777d627f08d19ce45c3b47ddcb3c.1.tmp
- /data/data/####/933ed41fc70eb54e6615f0cacfdd172d.0.tmp
- /data/data/####/933ed41fc70eb54e6615f0cacfdd172d.1.tmp
- /data/data/####/94Vdh5quCfXWZ-kFmdu940XM61g.183114614.tmp
- /data/data/####/9875d8cf1121c313e36d3dbd8dca9a1f.0.tmp
- /data/data/####/9875d8cf1121c313e36d3dbd8dca9a1f.1.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/BUGLY_COMMON_VALUES.xml
- /data/data/####/ContextData.xml
- /data/data/####/JWoRKVeG4TepclxI6I2IssePMno.1035358146.tmp
- /data/data/####/K9CCMQl9iCSKwCzt1oWFskjhNFM.448689314.tmp
- /data/data/####/TnJpXS3VVHXA0oX9RBg2RcQfZJw.-1046979891.tmp
- /data/data/####/a05a860ef2eebc54471691b429f87d81.0.tmp
- /data/data/####/a05a860ef2eebc54471691b429f87d81.1.tmp
- /data/data/####/afumw7hao5RO15I7TobF2HkmRE0.-2145768722.tmp
- /data/data/####/app_img_alarmclockn.png
- /data/data/####/app_img_alarmclocky.png
- /data/data/####/app_img_bgcountdowncounter.png
- /data/data/####/app_img_bgcountdowncross.png
- /data/data/####/app_img_bgcountdownnormal.png
- /data/data/####/app_img_bgcountdownpresale.png
- /data/data/####/app_img_concernd.png
- /data/data/####/app_img_concernn.png
- /data/data/####/app_img_concerny.png
- /data/data/####/app_img_copytip.png
- /data/data/####/app_img_couponbarline.png
- /data/data/####/app_img_couponnostock.png
- /data/data/####/app_img_couponreceviced.png
- /data/data/####/app_img_couponverticalline.png
- /data/data/####/app_img_detailitemno1.png
- /data/data/####/app_img_detailitemno2.png
- /data/data/####/app_img_detailitemno3.png
- /data/data/####/app_img_go_brand.png
- /data/data/####/app_img_icon_new2018head.png
- /data/data/####/app_img_icon_reward_20180725.png
- /data/data/####/app_img_iconbannervideoplay.png
- /data/data/####/app_img_iconbannervideoplaytime.png
- /data/data/####/app_img_iconbcinfo.png
- /data/data/####/app_img_iconmenufav.png
- /data/data/####/app_img_iconmenuhome.png
- /data/data/####/app_img_iconmenumore.png
- /data/data/####/app_img_iconmenumsg.png
- /data/data/####/app_img_iconmenumsgred.png
- /data/data/####/app_img_iconmenusearch.png
- /data/data/####/app_img_iconmenuservice.png
- /data/data/####/app_img_iconrecommend.png
- /data/data/####/app_img_icontitleback.png
- /data/data/####/app_img_icontitlemore.png
- /data/data/####/app_img_icontitlemorewhite.png
- /data/data/####/app_img_icontitleshare.png
- /data/data/####/app_img_icontuijian.png
- /data/data/####/app_img_iconvideodownload.png
- /data/data/####/app_img_iconvideodownloadcancel.png
- /data/data/####/app_img_iconvideofullscreen.png
- /data/data/####/app_img_iconvideominscreen.png
- /data/data/####/app_img_iconvideomuted.png
- /data/data/####/app_img_iconvideopause.png
- /data/data/####/app_img_iconvideoplay.png
- /data/data/####/app_img_iconvideovoice.png
- /data/data/####/app_img_linesprite.png
- /data/data/####/app_img_loadimgdetail.png
- /data/data/####/app_img_loading_gif.gif
- /data/data/####/app_img_material_play_video.png
- /data/data/####/app_img_next_brand.png
- /data/data/####/app_img_placeholderlogo.png
- /data/data/####/app_img_plainicon.png
- /data/data/####/app_img_presalehandsel.png
- /data/data/####/app_img_presaleinfoleftbg.png
- /data/data/####/app_img_selling_icon.png
- /data/data/####/app_img_to_top.png
- /data/data/####/b60afd0ba4539d7f01aa4b9c90366890.0.tmp
- /data/data/####/b60afd0ba4539d7f01aa4b9c90366890.1.tmp
- /data/data/####/bugly_db_-journal
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c20b8df6c522b0cdfba0a4b07c9da46a.0.tmp
- /data/data/####/c20b8df6c522b0cdfba0a4b07c9da46a.1.tmp
- /data/data/####/c438dd84df01f608a1077aa345f0ccd4.0.tmp
- /data/data/####/c438dd84df01f608a1077aa345f0ccd4.1.tmp
- /data/data/####/cada889faa0c3e5b8ede3a410f45c5fd.0.tmp
- /data/data/####/cada889faa0c3e5b8ede3a410f45c5fd.1.tmp
- /data/data/####/com.yunjibuyer.yunji.BETA_VALUES.xml
- /data/data/####/com.yunjibuyer.yunji.mid.world.ro.xml
- /data/data/####/com.yunjibuyer.yunji_preferences.xml
- /data/data/####/crashrecord.xml
- /data/data/####/d0db26e17970f9295d80889bd27e878f.0.tmp
- /data/data/####/d0db26e17970f9295d80889bd27e878f.1.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dffbb66c57e721207a2b02dbea0ce3bc.0.tmp
- /data/data/####/dffbb66c57e721207a2b02dbea0ce3bc.1.tmp
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/f5b62bdf38e6a923b56dfe143a341466.0.tmp
- /data/data/####/f5b62bdf38e6a923b56dfe143a341466.1.tmp
- /data/data/####/f8b56893b706eeada9f1576d8cd1b1e9.0
- /data/data/####/f8b56893b706eeada9f1576d8cd1b1e9.1
- /data/data/####/fUQL2mH0E3GuMKUDzNJSeqD25k4.183114614.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/f_00003b
- /data/data/####/f_00003c
- /data/data/####/f_00003d
- /data/data/####/f_00003e
- /data/data/####/f_00003f
- /data/data/####/f_000040
- /data/data/####/f_000041
- /data/data/####/f_000042
- /data/data/####/f_000043
- /data/data/####/f_000044
- /data/data/####/f_000045
- /data/data/####/f_000046
- /data/data/####/f_000047
- /data/data/####/f_000048
- /data/data/####/f_000049
- /data/data/####/f_00004a
- /data/data/####/f_00004b
- /data/data/####/f_00004c
- /data/data/####/f_00004d
- /data/data/####/f_00004e
- /data/data/####/f_00004f
- /data/data/####/f_000050
- /data/data/####/f_000051
- /data/data/####/f_000052
- /data/data/####/f_000053
- /data/data/####/f_000054
- /data/data/####/f_000055
- /data/data/####/f_000056
- /data/data/####/f_000057
- /data/data/####/f_000058
- /data/data/####/f_000059
- /data/data/####/f_00005a
- /data/data/####/f_00005b
- /data/data/####/f_00005c
- /data/data/####/f_00005d
- /data/data/####/f_00005e
- /data/data/####/f_00005f
- /data/data/####/f_000060
- /data/data/####/f_000061
- /data/data/####/f_000062
- /data/data/####/f_000063
- /data/data/####/f_000064
- /data/data/####/f_000065
- /data/data/####/f_000066
- /data/data/####/f_000067
- /data/data/####/f_000068
- /data/data/####/f_000069
- /data/data/####/f_00006a
- /data/data/####/f_00006b
- /data/data/####/f_00006c
- /data/data/####/f_00006d
- /data/data/####/f_00006e
- /data/data/####/f_00006f
- /data/data/####/f_000070
- /data/data/####/f_000071
- /data/data/####/f_000072
- /data/data/####/ff9416ddbe6feba05e1e0ecc1dfa084b.0.tmp
- /data/data/####/ff9416ddbe6feba05e1e0ecc1dfa084b.1.tmp
- /data/data/####/fyBPHUezV_-AJ7LWk4deul0Ua30.1541211180.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/h-5Idb5WHgeNDyBMmtln0TQlVz0.-735381844.tmp
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/index
- /data/data/####/index.android.bundle
- /data/data/####/index.android.bundle.meta
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.0.2.so
- /data/data/####/local_crash_lock
- /data/data/####/mPK-6V6thzCeXh2ObzzQ0LNuc1s.1541211180.tmp
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/node_modules_reactnavigation_src_views_assets_b...sk.png
- /data/data/####/node_modules_reactnavigation_src_views_assets_backicon.png
- /data/data/####/pri_tencent_analysis.db_com.yunjibuyer.yunji-journal
- /data/data/####/pri_tencent_analysis.db_com.yunjibuyer.yunji;pu...ournal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/s5BT8bfVq3OrKhs1PdKk85ictRI.899270984.tmp
- /data/data/####/security_info
- /data/data/####/spsOWQ0OjgZ_TFmsvYoQ34MygPA.-1046979891.tmp
- /data/data/####/tdata_YYn966
- /data/data/####/tdata_YYn966.jar
- /data/data/####/tdata_eOt091
- /data/data/####/tdata_eOt091.jar
- /data/data/####/tencent_analysis.db_com.yunjibuyer.yunji-journal
- /data/data/####/tencent_analysis.db_com.yunjibuyer.yunji;pushse...ournal
- /data/data/####/thread0_yj_bundle.zip.cache
- /data/data/####/thread1_yj_bundle.zip.cache
- /data/data/####/vewVuru19y8-5F2ES794Pm3ipHQ.-2145768722.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/yj_bundle.zip.tmp
- /data/data/####/yunji_buyer.db-journal
- /data/data/####/yunjibuyer_config.xml.xml
- /data/media/####/1202476b9e2f73b663488dd8a8126c0b.0.tmp
- /data/media/####/1202476b9e2f73b663488dd8a8126c0b.1.tmp
- /data/media/####/16f7476a5d495a0f9d0b365cc168c899.0.tmp
- /data/media/####/16f7476a5d495a0f9d0b365cc168c899.1.tmp
- /data/media/####/202b1584a35ebf0035dddb0aa510bfe8.0.tmp
- /data/media/####/202b1584a35ebf0035dddb0aa510bfe8.1.tmp
- /data/media/####/25dd55f5a98d7c958774bc34a3da0c9f.0.tmp
- /data/media/####/25dd55f5a98d7c958774bc34a3da0c9f.1.tmp
- /data/media/####/2634635c3f45a069cf157a8c747a3bd1.0.tmp
- /data/media/####/2634635c3f45a069cf157a8c747a3bd1.1.tmp
- /data/media/####/37c1020f69721fa4d66a83f824a884b1.0.tmp
- /data/media/####/37c1020f69721fa4d66a83f824a884b1.1.tmp
- /data/media/####/64df70e1c6150875fd5e27317cda078e.0
- /data/media/####/6754d2ae86945b4dfa6a0bfd936a4ede.0.tmp
- /data/media/####/6754d2ae86945b4dfa6a0bfd936a4ede.1.tmp
- /data/media/####/6c3c57c6519f09fe7025ed2f35b93a00.0.tmp
- /data/media/####/6c3c57c6519f09fe7025ed2f35b93a00.1.tmp
- /data/media/####/7029f93bad0e66370876115bbca56bcf.0.tmp
- /data/media/####/7029f93bad0e66370876115bbca56bcf.1.tmp
- /data/media/####/70ab73b5afa0ae61b91dc12187f29147.0.tmp
- /data/media/####/70ab73b5afa0ae61b91dc12187f29147.1.tmp
- /data/media/####/7d4bd08e42d0c439c3c41a0a80fc56db.0.tmp
- /data/media/####/7d4bd08e42d0c439c3c41a0a80fc56db.1.tmp
- /data/media/####/83a797e88891eeba2a2c5d91954ce1c1.0.tmp
- /data/media/####/83a797e88891eeba2a2c5d91954ce1c1.1.tmp
- /data/media/####/8af44d710b44e78f0e5e0ed1e29630b3.0.tmp
- /data/media/####/8af44d710b44e78f0e5e0ed1e29630b3.1.tmp
- /data/media/####/8e51fc9ea574da61c849969795380bb6.0.tmp
- /data/media/####/8e51fc9ea574da61c849969795380bb6.1.tmp
- /data/media/####/90e69a2c4f5b7f1d7cb6652214939c1a.0.tmp
- /data/media/####/90e69a2c4f5b7f1d7cb6652214939c1a.1.tmp
- /data/media/####/94b862ef920f3173a8cdcb49c8c8ad1b.0.tmp
- /data/media/####/94b862ef920f3173a8cdcb49c8c8ad1b.1.tmp
- /data/media/####/94e99028ea64e2820bb1c18c4e7b2707.0.tmp
- /data/media/####/94e99028ea64e2820bb1c18c4e7b2707.1.tmp
- /data/media/####/9b2f40538e24e681aa0d6caade11027f.0.tmp
- /data/media/####/9b2f40538e24e681aa0d6caade11027f.1.tmp
- /data/media/####/9f51b7c12a78f4c1a7b10ac9d4d96b36.0.tmp
- /data/media/####/9f51b7c12a78f4c1a7b10ac9d4d96b36.1.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/ab819f49b4134a5c516840318e1f63be.0.tmp
- /data/media/####/ab819f49b4134a5c516840318e1f63be.1.tmp
- /data/media/####/abbd4288060a8cee615b8b1a4e446cdf.0.tmp
- /data/media/####/abbd4288060a8cee615b8b1a4e446cdf.1.tmp
- /data/media/####/app.db
- /data/media/####/b6043d3a7926299af58f3f7d5b3e98f1.0.tmp
- /data/media/####/b6043d3a7926299af58f3f7d5b3e98f1.1.tmp
- /data/media/####/c63d3e70e89eed732b071b0a6dce1b3d.0.tmp
- /data/media/####/c63d3e70e89eed732b071b0a6dce1b3d.1.tmp
- /data/media/####/ceb28d2b71f7c304ce22a2309d13678d.0.tmp
- /data/media/####/ceb28d2b71f7c304ce22a2309d13678d.1.tmp
- /data/media/####/cf3af2b0798060fe3ca0772c50d6d2b8.0.tmp
- /data/media/####/cf3af2b0798060fe3ca0772c50d6d2b8.1.tmp
- /data/media/####/cf98d7282c7b9cde64fb9ab6a668b70b.0.tmp
- /data/media/####/cf98d7282c7b9cde64fb9ab6a668b70b.1.tmp
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.yunjibuyer.yunji.bin
- /data/media/####/com.yunjibuyer.yunji.db
- /data/media/####/d6b225afe096234a11c40bc04d0a610a.0.tmp
- /data/media/####/d6b225afe096234a11c40bc04d0a610a.1.tmp
- /data/media/####/db1e134c972c5fcf80ba8aca52796061.0.tmp
- /data/media/####/db1e134c972c5fcf80ba8aca52796061.1.tmp
- /data/media/####/df5073f682433f4d01cd02ae1b7b9d90.0.tmp
- /data/media/####/df5073f682433f4d01cd02ae1b7b9d90.1.tmp
- /data/media/####/e4a41317d7e77f07aa07bdda271b5643.0.tmp
- /data/media/####/e4a41317d7e77f07aa07bdda271b5643.1.tmp
- /data/media/####/f88d37a9e91c4dad79ac7e582669be5c.0.tmp
- /data/media/####/f88d37a9e91c4dad79ac7e582669be5c.1.tmp
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/log_20180816.txt
- /data/media/####/tdata_YYn966
- /data/media/####/tdata_eOt091
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.yunji.imaginer.yjpush.YJGTPushService 25080 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -c
- logcat -d -v threadtime
- logcat -d -v time
- mount
Загружает динамические библиотеки:
- Bugly
- MtaNativeCrash_v2
- getuiext2
- gifimage
- imagepipeline
- libnfix
- libreactnativejni
- libshella-2.9.0.2
- libufix
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-NONE-PKCS1PADDING
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- AES-GCM-NoPadding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
