Adware.Gexin.2309

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) cdn.43####.com.####.com:80
TCP(HTTP/1.1) com####.505####.com.####.com:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(HTTP/1.1) s####.m.img####.com:80
TCP(HTTP/1.1) f1.img####.com:80
TCP(HTTP/1.1) p####.43####.com:80
TCP(HTTP/1.1) 1111054####.dns.wa####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) m####.439####.net:80
TCP(HTTP/1.1) who.wa####.com:80
TCP(HTTP/1.1) cloud####.fengkon####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) l####.tbs.qq.com:443
TCP(TLS/1.0) m####.439####.net:443
TCP c####.g####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224
TCP p####.43####.com:4800

Запросы DNS:

111103f####.dns.wa####.com
1111054####.dns.wa####.com
7j####.c####.z0.####.com
a.img####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.43####.com
cloud####.fengkon####.com
com####.505####.com
f####.fengkon####.com
f1.img####.com
l####.tbs.qq.com
m####.439####.net
p####.43####.com
p.img####.com
pub-####.qin####.com
pus####.43####.com
s####.m.img####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sj2.img####.com
who.wa####.com

Запросы HTTP GET:

1111054####.dns.wa####.com/result?key=####&form=####&
cdn.43####.com.####.com//app/android/v4.4.1/gameDetail-mareacode-999998-...
cdn.43####.com.####.com/android/box/player/v3.1.1/miniGame-entryConfig-m...
cdn.43####.com.####.com/android/box/v1.0/gameCustom-network-mareacode-99...
cdn.43####.com.####.com/android/box/v1.0/news-getByRec-mareacode-999998-...
cdn.43####.com.####.com/app/android/v3.0/config-dailySign-mareacode-9999...
cdn.43####.com.####.com/app/android/v3.1/software-cover-mareacode-999998...
cdn.43####.com.####.com/app/android/v3.4/config-common-mareacode-999998....
cdn.43####.com.####.com/app/android/v3.4/config-common.html
cdn.43####.com.####.com/app/android/v4.3.1/game-index-mareacode-999998.h...
cdn.43####.com.####.com/app/forums/android/v2.1/chat-faces-mareacode-999...
cdn.43####.com.####.com/app/forums/android/v3.3/chat-faces-mareacode-999...
cdn.43####.com.####.com/service/android/v4.0/news-mareacode-999998-gameI...
com####.505####.com.####.com/shouji/5549/855549_1_js.html
f1.img####.com/1126996504/small
f1.img####.com/228680547~480x280
f1.img####.com/228971242~480x280
f1.img####.com/230022371~480x280
f1.img####.com/230619679~480x280
f1.img####.com/230883844~480x280
f1.img####.com/2361565285/small
f1.img####.com/742497113/small
f1.img####.com/box~cp/3212018/04/26/16_NJlxcU.147x147.png
f1.img####.com/box~cp/3212018/04/26/16_SlVb7q.147x147.png
f1.img####.com/box~cp/3212018/04/26/16_TkZ1JN.147x147.png
f1.img####.com/downloader/tpl/game/template342.zip
f1.img####.com/downloader/tpl/thread/template265.zip
f1.img####.com/ma~102333_logo2_c65f.jpg~124x124
f1.img####.com/ma~103587_logo2_cefa.jpg~124x124
f1.img####.com/ma~104850_logo2_be72.jpg~124x124
f1.img####.com/ma~107639_logo2_670e.jpg~124x124
f1.img####.com/ma~109671_logo2_e4d7.jpg~124x124
f1.img####.com/ma~110398_logo2_3e22.jpg~124x124
f1.img####.com/ma~111623_logo2_df81.jpg~124x124
f1.img####.com/ma~113467_logo2_888a.jpg~124x124
f1.img####.com/ma~115517_logo2_07a8.jpg~124x124
f1.img####.com/ma~120296_logo2_bbcc.jpg~124x124
f1.img####.com/ma~121315_logo2_17f7.jpg~124x124
f1.img####.com/ma~166_20180720101341_5b514555bcb45.png
f1.img####.com/ma~167_20180710165330_5b44740ac21c5.png
f1.img####.com/ma~167_20180710165344_5b4474187ab2f.png
f1.img####.com/ma~167_20180710165356_5b4474240281e.png
f1.img####.com/ma~167_20180710165413_5b44743544e36.png
f1.img####.com/ma~167_20180710165422_5b44743e7aa5c.png
f1.img####.com/ma~167_20180710165448_5b44745864b51.png
f1.img####.com/ma~167_20180710165507_5b44746bb1db1.png
f1.img####.com/ma~167_20180808145617_5b6a941108ec0.png
f1.img####.com/ma~207_20180907101338_5b91ded2d1fbd.jpeg
f1.img####.com/ma~207_20180907164246_5b923a06dd619.jpeg
f1.img####.com/ma~207_20180907164314_5b923a223674a.jpeg
f1.img####.com/ma~219_20180809144036_5b6be1e4beda9.jpeg
f1.img####.com/ma~46038_logo2_85ab.jpg~124x124
f1.img####.com/ma~87814_logo2_ac07.jpg~124x124
f1.img####.com/ma~88665_logo2_994d.jpg~124x124
f1.img####.com/ma~89482_logo2_bc42.jpg~124x124
f1.img####.com/ma~91389_logo2_5b76.jpg~124x124
f1.img####.com/ma~92170_logo2_e415.jpg~124x124
f1.img####.com/ma~g_110398_9360.jpg
f1.img####.com/ma~g_110398_9837.jpg
f1.img####.com/ma~g_110398_9b35.jpg
f1.img####.com/ma~g_110398_c294.jpg
f1.img####.com/ma~g_110398_cde2.jpg
f1.img####.com/ma~wap_s2_1535708975
f1.img####.com/mi~01e42e9b84fc9a3dcd8a65280b17ff59.jpeg
f1.img####.com/mi~24d5aa6691a4f50347d01542e62231ed.jpeg
f1.img####.com/mi~2d984a35d56174a3894bc055adc72eb0.jpeg
f1.img####.com/mi~3fcf43611cddfc8c9f088b44dd98a6ed.jpeg
f1.img####.com/mi~4528b7c81e25f3324f4750a49dbb6ff7.jpeg
f1.img####.com/mi~5d434bb3a4286c51183786236e8b07b7.jpeg
f1.img####.com/mi~8797c88dc7bcdcbfb254d4833549179c.jpeg
f1.img####.com/mi~c491ad6d399c274a62b39cb8083245af.jpeg
f1.img####.com/mi~faee214a6a66cbf0b14582726c1bbec9.jpeg
f1.img####.com/mi~fd1c8124b4d66a3a3d9d31c778cb1d4f.jpeg
f1.img####.com/sj~opensj_5b28a23670ef0
f1.img####.com/sj~opensj_5b28a236edad3
f1.img####.com/sj~opensj_5b28a23754fdc
f1.img####.com/sj~opensj_5b28a237a8f49
f1.img####.com/sj~opensj_5b28a2382ae98
f1.img####.com/youpai~upload/16121962018/04/08/04_ZGWU2K.540x360.jpg~250...
f1.img####.com/youpai~upload/18774562018/07/18/13_uhyoJ8.640x480.jpg~250...
m####.439####.net/service/counter.html?key=####&_callback_=####
p####.43####.com/cloud.php?act=####&rectime=####&appid=####&uid=####&fla...
p####.43####.com/cloud.php?act=####&rectime=####&flag=####&data=####
t####.c####.q####.####.com/tdata_EDT356
t####.c####.q####.####.com/tdata_YYn966
t####.c####.q####.####.com/tdata_eOt091
ti####.c####.l####.####.com/config/hz-hzv3.conf
who.wa####.com/?key=####&form=####

Запросы HTTP POST:

c-h####.g####.com/api.php?format=####&t=####
cloud####.fengkon####.com/v2/device/conf
f####.fengkon####.com/v2/device/profile
s####.m.img####.com/trace/<Package>/1.0/360/
s####.m.img####.com/trace/<Package>/1.0/360/.config?version=####
s####.m.img####.com/trace/<Package>/1.0/360/1100gbq0Ojzxc8jvgkYzf8799
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/._index.css
/data/data/####/._index.html
/data/data/####/._index.js
/data/data/####/._js
/data/data/####/.jg.ic
/data/data/####/.policy
/data/data/####/01bd6bb24c268d9b8478eeda673df21710447deb8fbfb87....0.tmp
/data/data/####/029afbab6c7f37f9c2f1376160ec41cd1a983d8730b505c....0.tmp
/data/data/####/0468447540e05fd7c5927fa7253df62965b65ee237ca8dd....0.tmp
/data/data/####/05f3450a33b0e3af9f76164dcf2aeab07bd27d0813be928....0.tmp
/data/data/####/0665f70056f245470336bc79a111900fef44010aaac155f....0.tmp
/data/data/####/0e67152627a25fd816ee35fcc5898cba764e7a888dd25e5....0.tmp
/data/data/####/0ee12b775bed142b0b762a1a04cdb1c48a6f908c0efa38d....0.tmp
/data/data/####/0eedde6382a3ff005a5d388c3076245ff86ca31acedc538....0.tmp
/data/data/####/101218ada48195598a75216655ef45478fd84292049212a....0.tmp
/data/data/####/1397e0a2d77fcf95a9cb4c4aeac0664e7a69a00ed4f4226....0.tmp
/data/data/####/189824ac62c3711857040df1afa4d64feefa3a809de1595....0.tmp
/data/data/####/1bdf53598d439818f95bdd0043bfd3bde11e675e81bef77....0.tmp
/data/data/####/1c9a498bc9b31a02808847ac0e4a91aa3888a1eafb8849d....0.tmp
/data/data/####/1d3bc494ffdbdbc64a5f3326aa5651c199a73468e5f84fa....0.tmp
/data/data/####/1e798c4c74a9b1734b4e7c54c4b17ad8c9d44b5048bdc02....0.tmp
/data/data/####/1fe5ecd855654a33699baf673dc40d8998dd6b8f4bfa022....0.tmp
/data/data/####/2088a0d868bc
/data/data/####/218caf66dd8f2bc86b9cb79fe74aa31366c2bebc46cb94f....0.tmp
/data/data/####/2196a8be466852ca1b00278c319655ee57ccb27751b1ea9....0.tmp
/data/data/####/22059fa5e990b8d31ed8c899b78eec68a569f01493e4774....0.tmp
/data/data/####/24157b7b2eefa8af444be677777fd3cc85566c16894a81b....0.tmp
/data/data/####/24337937c00055c97b835515159ab0761407dfaedfa08cd....0.tmp
/data/data/####/262a7bc60b9d05cbfaff61c5172041b40c0eb76b718376f....0.tmp
/data/data/####/27fdc44c57b09c628a0324c37fba5260ae0233deae7e66d....0.tmp
/data/data/####/2c1595e7a394287b6540df68705a50bdfc7a000da9df934....0.tmp
/data/data/####/2c70f32c765e25a29a2b75294800824d3fc3e4b94348955....0.tmp
/data/data/####/2e52ca825c0b38ea824b946f0bbc96cc69b65dfd10e7764....0.tmp
/data/data/####/3293349efd7e5832a8a25ca2a3aba2fae6229b59eefb70c....0.tmp
/data/data/####/32f2116710af13094c0b1a1f5fb16cbbc00c3f9afa004d3....0.tmp
/data/data/####/33e3758b262bc41db5ddf820e484e8e4b443c24c667cb04....0.tmp
/data/data/####/35768cfd67b316290b3e8c29fc6d0acbf6b5e57592c8187....0.tmp
/data/data/####/36da153fded3965350cc276ab5ba573a381c68095223468....0.tmp
/data/data/####/36db0ede8dee227cae8fbed43ca8d4b782d7a91f901ddc2....0.tmp
/data/data/####/3b0a03a48b280a4e1e8fd3a6dd80c6bcc08ac2e9bd37635....0.tmp
/data/data/####/3b1fec2864f54d92b0601472fe5e4b004d44ab3ff19c779....0.tmp
/data/data/####/43d92fd8a11cfc685db26d967238750d11ff0c9ae155106....0.tmp
/data/data/####/4582cff9205effaf1172c97da544d60dc47876eea0d1f05....0.tmp
/data/data/####/467bfa5350e41a5eb21a52d492e6b4a4167db19bfb7751e....0.tmp
/data/data/####/4ae12e8fa5c7ce4ca126be3d79ab2efd7dba4a2f08bc92b....0.tmp
/data/data/####/4c44be752927511030c50f7648eb0ff70326ec4fbb37ea9....0.tmp
/data/data/####/507be278a84b37636a74da9434a3e11e3d28f0fec113a2e....0.tmp
/data/data/####/50ab8b58069062bfde9ae95fbef2ed0cd8ae11b901a4049....0.tmp
/data/data/####/53d81cd9c0123c3411d80ba1abcbca1e0041c6590572470....0.tmp
/data/data/####/55f6da3fe292ac4b375eaaf4e7d7c1be245f694d6434cc9....0.tmp
/data/data/####/56ada908a61c5407ba3517d1c463c0eb349a7d9168ffa13....0.tmp
/data/data/####/57a0d8d7a0177d5a3bf588f7a0af2fe92c79f5cd5b4536a....0.tmp
/data/data/####/57ce0ed942c0d0f2b8bacb55c63e9a191cbfc73b3bf5f3f....0.tmp
/data/data/####/5e7183041ba50b8b147140e9db34efb1bd138f4d06f3b49....0.tmp
/data/data/####/608c26315a49fea034e4c2cd85f553f5f6dc333453e7452....0.tmp
/data/data/####/6192ee453955cecac602066b6e5db641ca4a2d2ec9a77ab....0.tmp
/data/data/####/689baf08765a9254c68e481d0ded84ea3fee37f055227f8....0.tmp
/data/data/####/7051b1e76e4d7027378313007a9bfdfc8e943d85008fe27....0.tmp
/data/data/####/73681fd46294e67292627ff8636cc1371702fdffc9fd004....0.tmp
/data/data/####/74cc38aa14a42dd23f3a1cb11856002a06719dd6e99f5d1....0.tmp
/data/data/####/7609243f2acb4ec52bad296e2aa087092b754b0b26620b5....0.tmp
/data/data/####/76b09c9f2938bb1bfac4f498f802defd3407c7bb005a19e....0.tmp
/data/data/####/79069288f45e0362a8b787e6e14affc1af9b802f1506b42....0.tmp
/data/data/####/7e11ce79206dd9df1b6bf3b6cf24d1158639fe1762a1307....0.tmp
/data/data/####/819994218df731aa9e9b58c8a464cf250a04a419e2c0134....0.tmp
/data/data/####/81f16b200f331a267250547259c1210c1329b2785ef957a....0.tmp
/data/data/####/82ca2aaa20b986b0929230de05ff6f107794fa0385dd438....0.tmp
/data/data/####/8627fe473a6cd872b80cf7b642c642677636aa39fb91708....0.tmp
/data/data/####/863d07bcd61cd24b1152c15641700bffc3813056779d8b1....0.tmp
/data/data/####/86778ad5df8e15e40ecabc5ab515faa241a1548e1ccb7b6....0.tmp
/data/data/####/87b9a2ac32775c700914c21801d4fedba4da777f7960e95....0.tmp
/data/data/####/890e920bc1fedd54c222b5f579dfad8744075d529880b84....0.tmp
/data/data/####/8f723e93ce35bf83424303d0f12388f735a062f9ca68a59....0.tmp
/data/data/####/92a1ca6924a7ba8e0f2cd23c31bebdf95fba04953645438....0.tmp
/data/data/####/96ecd0336f5cd2eb71af90c5e44f4350cb0eb5c49564a20....0.tmp
/data/data/####/995d0517a1b05d27a00198668748d3c34d84b2d1db6aa47....0.tmp
/data/data/####/9a61cb7e9d503a01e91072ca51c2a5e93bc04fe51730e3a....0.tmp
/data/data/####/9b1a8ca5bb3661aef2ab46d4a34764f3d14bbc32314b39c....0.tmp
/data/data/####/9e71520c074d1b22ad4af0c419cc76fb21c6d2b2730e6cd....0.tmp
/data/data/####/MultiDex.lock
/data/data/####/MyAnalytics_VERSION_INFO.xml
/data/data/####/MyAnalytics_device_id.xml
/data/data/####/MyAnalytics_general_config.xml
/data/data/####/MyAnalytics_send_config.xml
/data/data/####/UserInfo.xml
/data/data/####/a3a6c33616b62dc9ab6012a27ac0b840ac7d2542c8c748f....0.tmp
/data/data/####/a4696833492a28405a4352343329e03514e93f83222a1fd....0.tmp
/data/data/####/a7f286fd14e179a6f037e5e7dd6a238acbd978178c842a4....0.tmp
/data/data/####/a9ebc2ddd5fadf882b4e9d44c09483838bcc4f0f6fcaa8a....0.tmp
/data/data/####/aab6303083a53684ab84201a05c0e220aa368a70b5290fa....0.tmp
/data/data/####/ac779e0a33e24891e470c515dbcda2847d1623cf66e0ff6....0.tmp
/data/data/####/asset-manifest.json
/data/data/####/b02a8f18e76830c6e3e382cbed9241081c59250c4cf17e1....0.tmp
/data/data/####/b1bebc18f2e6a532af3488bf01f84325dfadfce7a1b736a....0.tmp
/data/data/####/b31407f2c02eb92b9df40172f0d80409a776f7f94d8c47a....0.tmp
/data/data/####/b771e0fe7ee9afbd2292aef2bf353454696125a782bff82....0.tmp
/data/data/####/be0b051059da26aec879887bd5c594437edcd7ef5a872c5....0.tmp
/data/data/####/c2126db02955ea0ba48cf8aee6906e20c49574c91631998....0.tmp
/data/data/####/c27aaac25cc57067e6207c68694408ba9b0d7370835d30e....0.tmp
/data/data/####/c583d2a367e5ed696fe7b6d2a49c994e5c2efb64be45721....0.tmp
/data/data/####/c6066fd594a0856882da846e7532725816b1951b2a2c758....0.tmp
/data/data/####/cadcb6e20c2f6c7f0ffa719ec42758872514b7370fd921b....0.tmp
/data/data/####/cbfba0ce858efe608ecdf23c60a2c8cfce5b11f45d2153f....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/ce03091307d073dc515211af4410e870a1c00967d5fac4b....0.tmp
/data/data/####/ce7ddcdfbe4561948be7bddd72fe0a5195c38cc8a07337f....0.tmp
/data/data/####/cloudms.conf.xml
/data/data/####/com.m4399.gamecenter_preferences.xml
/data/data/####/com.m4399.gamecenter_preferences.xml.bak
/data/data/####/com.shumei.xml
/data/data/####/comment.zip
/data/data/####/core_info
/data/data/####/d1d23ba551bc35265657f847d09bf02671e1645e4e8272b....0.tmp
/data/data/####/d258cbecf62473f1ef8b4ee277f79ef038c844c10d11a2e....0.tmp
/data/data/####/d3f5cd395eeedb75c1edaa0d42e6a833ebfd5619429d454....0.tmp
/data/data/####/d43bb0ba6a3fdfdadd1226f21b38260fcf824fbd80d2de8....0.tmp
/data/data/####/d4c1b7e9ea73891fdf7e11de605423040f9ab6ede414dde....0.tmp
/data/data/####/d54b8f5c29eeec44d871612ce871044cc320efb58fe6db6....0.tmp
/data/data/####/d7c157fb4051803a670bcd6dc2cf5f77a1fdde33f77f95a....0.tmp
/data/data/####/d7f32b0ceaf505d906eaf1c66e286b8d6aa5a84405e918c....0.tmp
/data/data/####/da764d6c2cf0c5103669d8f9817c324161c9114076e96de....0.tmp
/data/data/####/daa90aff04e090af5250a4cbdbf1d4c8e55d30239c69fc9....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dcccab202bb197e4f5d85ab02f2987e6f0f22bea395eec1....0.tmp
/data/data/####/ddb066b1e7ce9ea7038f1ebf80513c621e95f1dc6148db4....0.tmp
/data/data/####/de3359323cdaf3a396405f728fdc22c7497de1d95a4f662....0.tmp
/data/data/####/downloads.db-journal
/data/data/####/e020ca16d5461c19d9feeb103ca9cea5d8baf49f7d5dc8e....0.tmp
/data/data/####/e1a1e11249f3dd243ceac10b4e4cad4ad753da71ae11218....0.tmp
/data/data/####/e2a1d39b99a72b2082e3472928aa7138172b489e564464d....0.tmp
/data/data/####/e84d43482e3044bcbf76651d1573a11071c5ae56c257008....0.tmp
/data/data/####/e8a9a8d06eb82ee456f0235eb95686fdcdf32fda9680804....0.tmp
/data/data/####/e94f812b52beaaa7477c380ae830a10b57924162f3a7983....0.tmp
/data/data/####/e9f9f1dedff2673a6263761630393a09f7afe62ab3c73f9....0.tmp
/data/data/####/ef558fa35db0236aa5747c591bb0b72e86fd96b88d8dc9b....0.tmp
/data/data/####/efab66e9913946e997b9491da71122ad228c55feb760409....0.tmp
/data/data/####/f01b40707bc5caf50924a6dddf3fe63bdeef32eefd031e0....0.tmp
/data/data/####/f349899a6167b3bf20636c04067c5a9e4f2f243d1d798c1....0.tmp
/data/data/####/f41e6d67b6f7145820dfbafab92e82c22d2337cf22dc3f6....0.tmp
/data/data/####/f6d40618666a118c940d81a5c2f373b9c07f557964d17d9....0.tmp
/data/data/####/f881ee75cc41c57c851f98b8624fe5a62fa4fd794e5750c....0.tmp
/data/data/####/favicon.ico
/data/data/####/fd742624fca19e42c42adc53c47904f7e38d07b4220d455....0.tmp
/data/data/####/fe46d58692f45fd19255bf0f5376149a3d3901fc6dc103c....0.tmp
/data/data/####/fe5f66e27fff95b292dad0ec06639b4475fc17eb28c5e8e....0.tmp
/data/data/####/fe940db159cfb90f22bb16ededae4f88df833ba89cf4b85....0.tmp
/data/data/####/framework.db-journal
/data/data/####/gamecenter.db-journal
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/index.css
/data/data/####/index.html
/data/data/####/index.js
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu1858054988.so
/data/data/####/loading_content0.png
/data/data/####/loading_content1.png
/data/data/####/loading_content2.png
/data/data/####/loading_content3.png
/data/data/####/m4399AppEmoji3.0.json
/data/data/####/m4399BBSEmoji3.0.json
/data/data/####/main.917cc7aa.css
/data/data/####/main.986fc82a.css
/data/data/####/main.a69d03f0.css
/data/data/####/main.bb26782f.js
/data/data/####/main.fd331049.js
/data/data/####/main.ff76f3dd.js
/data/data/####/manifest.json
/data/data/####/mobclick_agent_cached_com.m4399.gamecenter1305
/data/data/####/multidex.version.xml
/data/data/####/placeholder.png
/data/data/####/plugin.meta
/data/data/####/pref.headup.message.chat.unread.pt
/data/data/####/push.jar
/data/data/####/push.pid
/data/data/####/push.zip
/data/data/####/push_box_sdk_version.xml
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.gif
/data/data/####/run.pid
/data/data/####/seq.xml
/data/data/####/service-worker.js
/data/data/####/skin_main_plugin_pref.xml
/data/data/####/statistics_agent_cached_com.m4399.gamecenter
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_YYn966
/data/data/####/tdata_YYn966.jar
/data/data/####/tdata_eOt091
/data/data/####/tdata_eOt091.jar
/data/data/####/template.zip
/data/data/####/tracker.db-journal
/data/data/####/type1
/data/data/####/type2
/data/data/####/umeng_general_config.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.disys
/data/media/####/.test.txt
/data/media/####/.thumbcache_idx0
/data/media/####/.udid
/data/media/####/5b769267-1e511.downlad
/data/media/####/5b87a88b-23e9e.downlad
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.m4399.gamecenter.bin
/data/media/####/com.m4399.gamecenter.db
/data/media/####/com.m4399.gamecenter.sdklogin
/data/media/####/shumei.txt
/data/media/####/t1v265.meta
/data/media/####/t2v342.meta
/data/media/####/tdata_YYn966
/data/media/####/tdata_eOt091
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GTPushService 24788 300 0
cat /proc/self/cgroup
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu1858054988.so
getprop
getprop ro.product.cpu.abi
grep -i virtualbox
ls /system/bin
ls /system/lib
mount
ps
sh

Загружает динамические библиотеки:

getuiext2
libjiagu1858054988
m4399
smsdk

Использует следующие алгоритмы для шифрования данных:

RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

DES-ECB-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней