Adware.Gexin.1368

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) p0.ifen####.com:80
TCP(HTTP/1.1) wn.pos.b####.com:80
TCP(HTTP/1.1) ub####.baidust####.com:80
TCP(HTTP/1.1) sdk.talking####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) hbk.shu####.cn:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) dc.p####.cn:80
TCP(HTTP/1.1) n####.p####.cn:80
TCP(HTTP/1.1) m.p####.cn:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 1####.254.116.117:80
TCP(HTTP/1.1) a.v####.cn:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) api.p####.cn:80
TCP(HTTP/1.1) rcv.a####.com:80
TCP(HTTP/1.1) api.shu####.cn:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) api.unipl####.com:80
TCP(HTTP/1.1) h5####.talking####.net:80
TCP(HTTP/1.1) 19a1da1####.dlc####.fas####.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) o####.ad####.cn:80
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) loc.map.b####.com:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) daa.shu####.cn:443
TCP c####.g####.ig####.com:5227
TCP t####.qq.com:8080
TCP t####.qq.com:14000
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
a####.u####.com
a.v####.cn
and####.b####.qq.com
api.map.b####.com
api.p####.cn
api.shu####.cn
api.unipl####.com
av1.x####.com
c####.g####.ig####.com
c####.x####.com
c-h####.g####.com
cgi.con####.qq.com
daa.shu####.cn
dai.shu####.cn
dc.p####.cn
dcc.shu####.cn
fp.fraudme####.cn
h5####.talking####.net
hbk.shu####.cn
loc.map.b####.com
m.p####.cn
mt####.go####.com
n####.p####.cn
o####.ad####.cn
p0.ifen####.com
p8t5m####.bkt.clo####.com
pi####.qq.com
pub-####.qin####.com
rcv.a####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sdk.talking####.com
sta####.ho####.cn
sta####.p####.cn
t####.qq.com
thi####.q####.cn
ub####.baidust####.com
wn.pos.b####.com

Запросы HTTP GET:

19a1da1####.dlc####.fas####.com/h5/app/v168/app.2e3277c9800ba73cd169.js
19a1da1####.dlc####.fas####.com/h5/app/v168/img/go.fb5a9b5.png
19a1da1####.dlc####.fas####.com/h5/app/v168/img/mask-bottom.9752351.png
19a1da1####.dlc####.fas####.com/h5/app/v168/layouts/default.fa0a7077d05b...
19a1da1####.dlc####.fas####.com/h5/app/v168/manifest.92d063e1c3e36ebed45...
19a1da1####.dlc####.fas####.com/h5/app/v168/pages/hybird/guess/index.ccc...
19a1da1####.dlc####.fas####.com/h5/app/v168/vendor.6e48d98e8947251087e3.js
19a1da1####.dlc####.fas####.com/img/2018-08-15/1778544756488251063.png
19a1da1####.dlc####.fas####.com/img/2018-08-16/5410559178910637442.jpg
19a1da1####.dlc####.fas####.com/img/2018-08-16/5432721869331260930.png?1...
19a1da1####.dlc####.fas####.com/img/2018-08-16/8246172094236108194.png
19a1da1####.dlc####.fas####.com/img/splash/icon_splash_normal.png
a.v####.cn/se?e=####&t=####
api.unipl####.com/phone/notify.php?act=####&log=dsp####&uniplayid=####&r...
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
dc.p####.cn/inview.do?&newsid=####&token=####&pos=####&predictId=####&ap...
dc.p####.cn/push.do?screen=####&os=####&ov=####&osVersion=####&df=####&a...
dc.p####.cn/push.do?screen=####&os=####&ov=####&osVersion=####&imei=####...
dc.p####.cn/videoinview.do?&newsid=####&token=####&pos=####&predictId=##...
m.p####.cn/hybird/guess?appVersion=####&chanId=####
m.p####.cn/images/headImg/100006.png
n####.p####.cn/config/channel?screen=####&os=####&ov=####&osVersion=####...
n####.p####.cn/news/recomm?screen=####&os=####&ov=####&osVersion=####&im...
n####.p####.cn/splash/get?screen=####&os=####&ov=####&osVersion=####&df=...
n####.p####.cn/user/channel?screen=####&os=####&ov=####&osVersion=####&d...
n####.p####.cn/video/recomm?screen=####&os=####&ov=####&osVersion=####&i...
o####.ad####.cn/agent/openDisplay.do?st=####&uuidEncType=####&sv=####&sr...
p0.ifen####.com/pmop/2017/1207/46DDF5E81DD1C0B9369505615F312086BB33862C_...
p0.ifen####.com/pmop/2018/0511/341C4E19C843BD1882A2E67BB728BD87BFC914AA_...
rcv.a####.com/show?CAAQEA.####
rcv.a####.com/show?CAAQOA.####
sdk.talking####.com/app/h5/v1/websdk/js/sdk_release.js
sdk.talking####.com/app/h5/v1?appid=####&vn=####&vc=####
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_YYn966
sni.c####.q####.####.net/tdata_eOt091
t####.c####.q####.####.com/9dc220657e1c42fcb29c76b5d734cb0a
t####.c####.q####.####.com/ebcb76ba6e134130be34fdbd870fb01b
t####.c####.q####.####.com/tdata_EDT356
thi####.q####.cn/mmopen/vi_32/DYAIOgq83epJBy3z7geYGVEnibrl8NZSia2NxyWCBa...
thi####.q####.cn/mmopen/vi_32/ZHCw7kYyuIfooUtn8OicTlib15ga7Ky1ibRyI0cn8l...
thi####.q####.cn/mmopen/vi_32/wQ0pv60BsClU0ztdgD3doZg3aEnu7fibgnsL7EUScY...
ub####.baidust####.com/media/v1/0f000jiGGnSmnB64KlS1j6.jpg
wn.pos.b####.com/adx.php?c=####&ext=####

Запросы HTTP POST:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async?aid=####
api.p####.cn/bc-activity-service/user/userInfoCount
api.shu####.cn/report?v=####&c=####&e=####
c-h####.g####.com/api.php?format=####&t=####
h5####.talking####.net/app/v1
hbk.shu####.cn/report?v=####&c=####&e=####&t=####
pi####.qq.com/mstat/report/?index=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.td-3
/data/data/####/.tdck
/data/data/####/.tpns.service.xml.xml
/data/data/####/.tpns.settings.xml.xml
/data/data/####/.tpush_mta.xml
/data/data/####/02090857265782915130f18aec9cdfb3.0.tmp
/data/data/####/02090857265782915130f18aec9cdfb3.1.tmp
/data/data/####/0b6d789cc97dd2a6f5e810b42831185c8e6ab6d4e098da5....0.tmp
/data/data/####/0c15603da06a87407db9f8d6ff3aa1ae.0.tmp
/data/data/####/0c15603da06a87407db9f8d6ff3aa1ae.1.tmp
/data/data/####/0e85c6c1b6a5c99ce38baeafe00595a3.0.tmp
/data/data/####/0e85c6c1b6a5c99ce38baeafe00595a3.1.tmp
/data/data/####/1004
/data/data/####/100764f1a0c09c4213dd79714ba5c7d217da7a3a6f8cccb....0.tmp
/data/data/####/1534424837555_2088
/data/data/####/1534424837968_2088
/data/data/####/1534424838331_2088
/data/data/####/1534424838619_2088
/data/data/####/1534424838849_2088
/data/data/####/1534424842011_2088
/data/data/####/1534424842735_2088
/data/data/####/1534424842828_2110
/data/data/####/1534424843660_2129
/data/data/####/1534424843696_2110
/data/data/####/1534424843972_2129
/data/data/####/1534424846752_2088
/data/data/####/1534424857636_2609
/data/data/####/1534424857874_2609
/data/data/####/1534424872626_2742
/data/data/####/1534424873125_2742
/data/data/####/1534424879108_2742
/data/data/####/1534424899177_2873
/data/data/####/1534424900100_2873
/data/data/####/1534424901861_2088
/data/data/####/163cce21b34161106dfb7e1f056d98bf.0.tmp
/data/data/####/163cce21b34161106dfb7e1f056d98bf.1.tmp
/data/data/####/2fccfcdd44138601159966f48a056d82.0.tmp
/data/data/####/34693aec4b90355d42df5cf4237b0c2f01bf45a6cfe883b....0.tmp
/data/data/####/34fe96ed2b78e46b4f47e934e5f9ccdeb596e6320f00968....0.tmp
/data/data/####/39392e9c8c8ad3b8faa8d8096dfc176a.0.tmp
/data/data/####/39392e9c8c8ad3b8faa8d8096dfc176a.1.tmp
/data/data/####/3b9c641fe5f2331bc2f6759065832be0.0.tmp
/data/data/####/3b9c641fe5f2331bc2f6759065832be0.1.tmp
/data/data/####/3ba135cc8fa40bd9a1268f5ced3482a5.0.tmp
/data/data/####/3ba135cc8fa40bd9a1268f5ced3482a5.1.tmp
/data/data/####/5d2986a7394b27af6dd4f4e56921285d.0.tmp
/data/data/####/613a59f901cd20ebd1ed1bbc744c4d5e.0.tmp
/data/data/####/613a59f901cd20ebd1ed1bbc744c4d5e.1.tmp
/data/data/####/66ef81ff723f
/data/data/####/8407e2691aaeac770264a37f30a85fde6e892073f111adc....0.tmp
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/Cookies_Prefs.xml
/data/data/####/Lock0
/data/data/####/Lock2
/data/data/####/Lock7
/data/data/####/MultiDex.lock
/data/data/####/TDAntiCheating_Switch_Value
/data/data/####/TDCloud_Control_Cache_Param1
/data/data/####/TD_AES_DATA_LOCK
/data/data/####/TD_AES_IV_LOCK
/data/data/####/TD_AES_SALT_LOCK
/data/data/####/TD__App_Synchronous_Lock__
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/XR_REFRESH_KEY.xml
/data/data/####/a189b9736b1f905e79fed82152ea786a.0.tmp
/data/data/####/a189b9736b1f905e79fed82152ea786a.1.tmp
/data/data/####/a4ea4f9cb19469f4e0d26d1d2c46a6a7.0.tmp
/data/data/####/a4ea4f9cb19469f4e0d26d1d2c46a6a7.1.tmp
/data/data/####/a747587218a9f436dfee0531cc961d5b.0.tmp
/data/data/####/a747587218a9f436dfee0531cc961d5b.1.tmp
/data/data/####/authStatus_com.cnode.blockchain;remote.xml
/data/data/####/b89b931349cb92edebdae028afe1a6a0.0.tmp
/data/data/####/b89b931349cb92edebdae028afe1a6a0.1.tmp
/data/data/####/bad9fee0c393d4f9f6ca89849fd3ca21.png
/data/data/####/bc948d4639e230c5f4d4af6178e5d3f8.0.tmp
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/c62769ed671888eeca6ca9c6b51916fa.0.tmp
/data/data/####/c62769ed671888eeca6ca9c6b51916fa.1.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cd5050895c13e498e0b78a75848d1346.0.tmp
/data/data/####/cd5050895c13e498e0b78a75848d1346.1.tmp
/data/data/####/com.cnode.blockchain.thirdsdk.getui.NPushIntentService.xml
/data/data/####/com.cnode.blockchain_dna.xml
/data/data/####/com.cnode.blockchain_preferences.xml
/data/data/####/com.cnode.blockchain_preferences.xml.bak (deleted)
/data/data/####/com.cnode.blockchain_prefs.xml
/data/data/####/com.cnode.blockchain_prefs.xml.bak
/data/data/####/com.cnode.blockchain_prefs.xml.bak (deleted)
/data/data/####/com.tencent.open.config.json.1106942382
/data/data/####/crashrecord.xml
/data/data/####/d54b99136a44d7555a359196f5f6793b.0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dcna.xml
/data/data/####/device_id.xml
/data/data/####/du.lock
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f8815b37a9a01035b3662a325f6bf146c6d4ac7e3503a9c....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/firll.dat
/data/data/####/fm_shared.xml
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/guide_file.xml
/data/data/####/gx_sp.xml
/data/data/####/hianalytics_global_v2_com.cnode.blockchain.xml
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/iv
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libjiagu-1110564872.so
/data/data/####/local_crash_lock
/data/data/####/lock_screen.xml
/data/data/####/login_guide.xml
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/run.pid
/data/data/####/salt
/data/data/####/security_info
/data/data/####/splash_file.xml
/data/data/####/td_fm.jar
/data/data/####/tdata_YYn966
/data/data/####/tdata_YYn966.jar
/data/data/####/tdata_eOt091
/data/data/####/tdata_eOt091.jar
/data/data/####/tdid.xml
/data/data/####/tpush.shareprefs.xml
/data/data/####/tpush.shareprefs.xml (deleted)
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/user_info.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/xg_message.db
/data/data/####/xg_message.db-journal
/data/data/####/yike_push_info.xml
/data/media/####/..ccdid
/data/media/####/..ccvid
/data/media/####/..cvtid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.ccdid
/data/media/####/.ccvid
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.cvtid
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/.td-3
/data/media/####/.tdck
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/app.db
/data/media/####/com.cnode.blockchain.bin
/data/media/####/com.cnode.blockchain.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/tdata_YYn966
/data/media/####/tdata_eOt091
/data/media/####/test.log
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.thirdsdk.getui.NPushService 24970 300 0
<Package Folder>/lib/libxguardian.so <Package>,2100294216; 55692 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : 0 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 3.23 , mf : unknown , apn : %s }}] 0 18
<Package Folder>/lib/libxguardian.so <Package>,2100294216;<Package>,2100294216; 55556 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : f82d6f72cca6264e056f41de5c0a589f4b798c9d , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 3.23 , mf : unknown , apn : %s }}] 0 18
cat /sys/class/net/wlan0/address
chmod 444/storage/emulated/0/.td-3
chmod 444/storage/emulated/0/.tdck
chmod 444/storage/emulated/0/Alarms/.tdck
chmod 444/storage/emulated/0/Android/.td-3
chmod 444/storage/emulated/0/Android/.tdck
chmod 444/storage/emulated/0/DCIM/.td-3
chmod 444/storage/emulated/0/DCIM/.tdck
chmod 444/storage/emulated/0/Download/.td-3
chmod 444/storage/emulated/0/Download/.tdck
chmod 444/storage/emulated/0/Movies/.td-3
chmod 444/storage/emulated/0/Movies/.tdck
chmod 444/storage/emulated/0/Music/.td-3
chmod 444/storage/emulated/0/Music/.tdck
chmod 444/storage/emulated/0/Notifications/.td-3
chmod 444/storage/emulated/0/Notifications/.tdck
chmod 444/storage/emulated/0/Pictures/.td-3
chmod 444/storage/emulated/0/Pictures/.tdck
chmod 444/storage/emulated/0/Podcasts/.td-3
chmod 444/storage/emulated/0/Podcasts/.tdck
chmod 444/storage/emulated/0/Ringtones/.td-3
chmod 444/storage/emulated/0/Ringtones/.tdck
chmod 444/storage/emulated/0/libs/.tdck
chmod 444/storage/emulated/0/system/.td-3
chmod 444/storage/emulated/0/system/.tdck
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu-1110564872.so
date
df
getprop
getprop net.dns1
getprop ro.vivo.os.build.display.id
id
logcat -d -v threadtime
ls -l /system/xbin/su
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
sh -c cat
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c echo MEY4QTU4RkVEMDU2ODhCNkIwNkNDNzg1MjQ4REYxQzg4NEM1Qzg6MDc4QUI3OjBBQjE0MA== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo MEY4QTU4RkVEMDU2ODhCNkIwNkNDNzg1MjQ4REYxQzg4NEM1Qzg6MDc4QUI3OjBBQjE0MA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo MTAxNTRGN0NDODZDNTY4QzNDMjFGOUU0OUUwREM5MUQxNTM0NDI0ODYz > <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c echo MTAxNTRGN0NDODZDNTY4QzNDMjFGOUU0OUUwREM5MUQxNTM0NDI0ODYz > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c echo OTc0QjA1RDEzRDgwOUE2RUUxMzc3MkIyRUJFNDJDNTExMEQ3RjQ6RTM5QzUxOkZDOTc5Nw== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo OTc0QjA1RDEzRDgwOUE2RUUxMzc3MkIyRUJFNDJDNTExMEQ3RjQ6RTM5QzUxOkZDOTc5Nw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat

Загружает динамические библиотеки:

Bugly
du
getuiext2
libjiagu-1110564872
locSDK7b
tongdun
tpnsSecurity

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB8-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1PADDING
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB8-NoPadding
AES-GCM-NoPadding
DES-ECB-PKCS5Padding
desede-CBC-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о настроках APN.

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней