Adware.Gexin.3261

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.207.168.45:80
TCP(HTTP/1.1) sc.yunjigl####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) pin####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 2####.107.1.1:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) vi####.yunjigl####.com:80
TCP(HTTP/1.1) erro####.yunjiwe####.com:80
TCP(HTTP/1.1) ta.yunjigl####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(TLS/1.0) x####.tc.qq.com:443
TCP(TLS/1.0) 1####.217.17.46:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) sc.yunjigl####.com:443
TCP(TLS/1.0) gl####.w.kunl####.####.com:443
TCP(TLS/1.0) g.al####.com:443
TCP(TLS/1.0) wild####.al####.com.####.net:443
TCP c####.g####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
7x####.c####.z0.####.com
a####.b####.qq.com
a####.man.aliy####.com
aeu.al####.com
aexcep####.b####.qq.com
and####.b####.qq.com
c####.g####.ig####.com
c-h####.g####.com
d####.yunjiwe####.com
erro####.yunjiwe####.com
g.al####.com
i####.yunjiwe####.com
img.al####.com
m.yunjigl####.com
pi####.qq.com
pin####.qq.com
s.b####.g####.com
sc.yunjigl####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.yunjigl####.com
st####.yunjiwe####.com
ta.yunjigl####.com
vi####.yunjigl####.com

Запросы HTTP GET:

erro####.yunjiwe####.com/yunjilog/admin/jslog.json?msg={"flag":"H5","err...
gl####.w.kunl####.####.com/0123eff3b27027894adf03a62ad9011c.jpg
gl####.w.kunl####.####.com/0173872314d102c1e2040297d47dc5e1.jpg
gl####.w.kunl####.####.com/0c0e9a743b920c1339c909a58a2344e1.jpg
gl####.w.kunl####.####.com/0d0a120e07b43ad31bb77dfc3a5a2f17.jpg?imageMo#...
gl####.w.kunl####.####.com/1717d390a7b784dc6947a49cd53326ba.jpg?imageMo#...
gl####.w.kunl####.####.com/1760a909d87edceb80e93dfb2e5f9371.jpg
gl####.w.kunl####.####.com/27d65d773cb2ac77c02c7e843163fbe5.jpg
gl####.w.kunl####.####.com/2f9ce8bbf1de7fa39efb3c290be774a0.jpg
gl####.w.kunl####.####.com/338f2bea3545fbdbaa246b2fd15d08ee.jpg?imageMo#...
gl####.w.kunl####.####.com/355eac40952e6e4729800f400558b0fe.jpg?imageVi#...
gl####.w.kunl####.####.com/3ef09423fc3e1cd656727323251c05f0.jpg
gl####.w.kunl####.####.com/408a3e18b1f0522db985ed37ceb2a213.gif?imageVi#...
gl####.w.kunl####.####.com/429bf7d1a36415369c1f2a5459120e4c.jpg
gl####.w.kunl####.####.com/547f4e971b4838fbe803bc7599c28521.jpg
gl####.w.kunl####.####.com/5713eabd610c717dd36d4f5bfa0bda73.gif?imageVi#...
gl####.w.kunl####.####.com/6221745b2c53baaad57ce6c7e02b9d8d.jpg
gl####.w.kunl####.####.com/63cc36800a95e9ca797bbe5c51afd2f2.jpg
gl####.w.kunl####.####.com/665d155670e57aba64b8f8f92ad706f9.jpg
gl####.w.kunl####.####.com/6cdcc6d54ec5b088efe5c8d5509bb457.jpg
gl####.w.kunl####.####.com/7442aa94dd0d5194bfee1b05636701c3.jpg
gl####.w.kunl####.####.com/7925defd59d002853d690bb3b3950165.gif?imageVi#...
gl####.w.kunl####.####.com/8893960c60fe2e263f2fb9611f41c08c.jpg
gl####.w.kunl####.####.com/8c74d87d9813dbe8a154db402f02a1ff.jpg?imageMo#...
gl####.w.kunl####.####.com/8d8dae85893c180402fd6e2a7d2dd3f4.jpg
gl####.w.kunl####.####.com/a45aa9433c145fa5a91eeaac05d6ae86.jpg
gl####.w.kunl####.####.com/addbdc80fb0c318fe80751aefa877a8c.jpg?imageVi#...
gl####.w.kunl####.####.com/adf9e1682f91a74fc69c677f91d893a8.jpg
gl####.w.kunl####.####.com/ae6b976e4e9e749c1653093545092528.jpg
gl####.w.kunl####.####.com/appUpload/app/apk/yjvip_yj_release_v2.1.09251...
gl####.w.kunl####.####.com/b457d2854fb9b9c9d68345b88629cb9a.jpg
gl####.w.kunl####.####.com/b7c971990ed286c6435ba7db724cebfc.gif?imageVi#...
gl####.w.kunl####.####.com/c179ad763fb9c55cacfb72c718af7a90.gif?imageVi#...
gl####.w.kunl####.####.com/c22f04acaa2f3ada78e9830d76e29f88.jpg
gl####.w.kunl####.####.com/d023bb6ca1b7ac53d7a41943f3772e3c.gif?imageVi#...
gl####.w.kunl####.####.com/d6efee0a51c2a1f3825fcd72d51b8914.jpg?imageVi#...
gl####.w.kunl####.####.com/d736bc2e4aad40b8b8f954c1b4fabfa8.jpg?imageMo#...
gl####.w.kunl####.####.com/d7cb97d88b30e52285ca90e819adc9f5.jpg
gl####.w.kunl####.####.com/e027dc8197300f8eb9213a97f2bda713.jpg
gl####.w.kunl####.####.com/e13520aba7d376132c79e92a8a19a9ca.jpg
gl####.w.kunl####.####.com/e30e8340bc6b574f6123aed82b764695.jpg
gl####.w.kunl####.####.com/e4580ea31027c3ba2cab6d2fdb965fee.jpg?imageMo#...
gl####.w.kunl####.####.com/e6407802e88b2713a4efc4d47fdb4987.jpg
gl####.w.kunl####.####.com/f49b5f22da6064e128753299b31d547f.jpg
gl####.w.kunl####.####.com/item_idc/0c37e809e50c6e83a15773f390bbe1e7.jpg...
gl####.w.kunl####.####.com/item_idc/1abf3c30fbb4531b118fbdb80da7e375.jpg...
gl####.w.kunl####.####.com/item_idc/1d0317fff548b807675fb5df00461cc6.jpg...
gl####.w.kunl####.####.com/item_idc/2b9841f7625d3ecb5567be3da7f1db95.jpg...
gl####.w.kunl####.####.com/item_idc/4183de4c992261484277bc2998f4a62e.jpg...
gl####.w.kunl####.####.com/item_idc/44701a9d3df132801c2be04f69323d92.jpg...
gl####.w.kunl####.####.com/item_idc/5f428d205508bd52d33f6ac8e566becd.jpg...
gl####.w.kunl####.####.com/item_idc/5f92a5ba1ab759200d109760aa904e1b.jpg...
gl####.w.kunl####.####.com/item_idc/6235d86b194852db369ca002002a7993.jpg...
gl####.w.kunl####.####.com/item_idc/683239b638dfb7019e26f7a5138406cb.jpg...
gl####.w.kunl####.####.com/item_idc/737af748171ca242270b142cb8dad79e.jpg...
gl####.w.kunl####.####.com/item_idc/8f99f2c2a560ab109480b7d1bcfbf36c.jpg...
gl####.w.kunl####.####.com/item_idc/939ddbc1c73279bac083d82c1e8efce0.jpg...
gl####.w.kunl####.####.com/item_idc/ab0158c393bbf3b944162302c0823e62.jpg...
gl####.w.kunl####.####.com/item_idc/aef7248d9fe40d94e10feed349128940.jpg...
gl####.w.kunl####.####.com/item_idc/b0cce62cb170b4caa605f5c9064ffca6.jpg...
gl####.w.kunl####.####.com/item_idc/b7c7b31a1649a347733ea5f507c3fbb3.jpg...
gl####.w.kunl####.####.com/item_idc/dc236062d9a35d751ccbb6c54768af8a.jpg...
gl####.w.kunl####.####.com/item_idc/ddc350c3eb46be928a9ae8bbed81fd3a.jpg...
gl####.w.kunl####.####.com/item_idc/ea6bd516780caec9dc4a05c36fa89109.jpg...
t####.c####.q####.####.com/20180817115648710704.jpg?imageVi####
t####.c####.q####.####.com/2018090922022669290.jpg?imageVi####
t####.c####.q####.####.com/20180917114308126192.jpg?imageVi####
t####.c####.q####.####.com/20180927154330263038.jpg?imageVi####
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_YYn966
t####.c####.q####.####.com/tdata_eOt091
ta.yunjigl####.com/config?appid=####
ta.yunjigl####.com/sync_js?&data=ey####&ext=crc####
vi####.yunjigl####.com/yunjiapp4buyer/app4buyer/buyervip/startPage.json?...
vi####.yunjigl####.com/yunjiapp4buyer/app4buyer/global/queryByUrlPath.js...

Запросы HTTP POST:

aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
pi####.qq.com/mstat/report/?index=####
pin####.qq.com/request
sc.yunjigl####.com/yunjidata/data/reportByJsonString.json
sdk.o####.p####.####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
ta.yunjigl####.com/sync
vi####.yunjigl####.com/yunjidata/data/reportByJsonString.json

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1037359673
/data/data/####/-1674496260
/data/data/####/0.0.0.bak
/data/data/####/0.1.2.bak
/data/data/####/04c6899a2916074199c1b338fc4f629a.0.tmp
/data/data/####/04c6899a2916074199c1b338fc4f629a.1.tmp
/data/data/####/1002
/data/data/####/1004
/data/data/####/21d95595c4a32d0d8b18950bfb25ac35.0.tmp
/data/data/####/21d95595c4a32d0d8b18950bfb25ac35.1.tmp
/data/data/####/2ed6959d434e56e370022988d432cf56.0.tmp
/data/data/####/2ed6959d434e56e370022988d432cf56.1.tmp
/data/data/####/5118e25f3e36b2201f16959643c5b4c9.0.tmp
/data/data/####/5118e25f3e36b2201f16959643c5b4c9.1.tmp
/data/data/####/5971c1036c3f5a1b8ba5a0bf94b87c14b1bcae81a4ea64b....0.tmp
/data/data/####/6e9d15ced70a8a3d0b1ae8e9fef094bd.0.tmp
/data/data/####/6e9d15ced70a8a3d0b1ae8e9fef094bd.1.tmp
/data/data/####/761511270
/data/data/####/798081204
/data/data/####/7fK2SKyBM0dRXtTqlK8nNELhCuM.-307029580.tmp
/data/data/####/859658193
/data/data/####/89677d03469da2eb0dd07c83d7485e38.0.tmp
/data/data/####/89677d03469da2eb0dd07c83d7485e38.1.tmp
/data/data/####/Alvin2.xml
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/ContextData.xml
/data/data/####/ErVAzONnMouSXXwMv6n03VNcuwI.-2037227974.tmp
/data/data/####/LdN_NZiV7mE1iahPfL6U8HapZVs.cnt
/data/data/####/MQc2RmvkO6mqrAPJRnzXYGFNSKM.-385959709.tmp
/data/data/####/UP_app_pefercen_profile.xml
/data/data/####/UPpref_longtime.xml
/data/data/####/UPpref_shorttime.xml
/data/data/####/UPtcagent.db
/data/data/####/UPtcagent.db-journal
/data/data/####/VDkjCraHs6v3wM7_yOCYxJG7hNA.879809133.tmp
/data/data/####/beb53bde0d1514b3a73e16b3aeaa96d0.0.tmp
/data/data/####/beb53bde0d1514b3a73e16b3aeaa96d0.1.tmp
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/changed_classes.dex.jar
/data/data/####/com.thinkingdata.analyse.xml
/data/data/####/com.yunjibuyer.yunji-journal
/data/data/####/com.yunjibuyer.yunji.BETA_VALUES.xml
/data/data/####/com.yunjibuyer.yunji.mid.world.ro.xml
/data/data/####/com.yunjibuyer.yunji_preferences.xml
/data/data/####/com.yunjibuyer.yunji_preferences.xml.bak
/data/data/####/crashrecord.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/ed338df3fe91465fb2c5eeadedc7bf81.0.tmp
/data/data/####/ed338df3fe91465fb2c5eeadedc7bf81.1
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/fa99270fc86b800ec711b111466f3122.0.tmp
/data/data/####/fa99270fc86b800ec711b111466f3122.1.tmp
/data/data/####/fd4dbbb2-4b09-491f-b7e4-12bc7ac12a92.zip
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/index
/data/data/####/index.android.bundle
/data/data/####/index.android.pat
/data/data/####/info.lock
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/lM8tXJQiwkaIAVWoqLgQSSi4x14.-555782980.tmp
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.2.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/patch-84e7d3ab.apk
/data/data/####/patch.apk
/data/data/####/patch.info
/data/data/####/patch.retry
/data/data/####/pri_tencent_analysis.db_com.yunjibuyer.yunji-journal
/data/data/####/pri_tencent_analysis.db_com.yunjibuyer.yunji;patch-journal
/data/data/####/pri_tencent_analysis.db_com.yunjibuyer.yunji;pu...ournal
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/td.lock
/data/data/####/tdata_YYn966
/data/data/####/tdata_YYn966.jar
/data/data/####/tdata_eOt091
/data/data/####/tdata_eOt091.jar
/data/data/####/tdid.xml
/data/data/####/temp.apk
/data/data/####/tencent_analysis.db_com.yunjibuyer.yunji-journal
/data/data/####/tencent_analysis.db_com.yunjibuyer.yunji;patch-journal
/data/data/####/tencent_analysis.db_com.yunjibuyer.yunji;pushse...ournal
/data/data/####/test.dex.jar
/data/data/####/tmpPatch.apk
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/yj_bundle.zip
/data/data/####/yunji_buyer.db-journal
/data/data/####/yunjibuyer_config.xml.xml
/data/media/####/.mid.txt
/data/media/####/.mid.txt1000001
/data/media/####/.mid.txt3
/data/media/####/.tcookieid
/data/media/####/2634635c3f45a069cf157a8c747a3bd1.0.tmp
/data/media/####/2634635c3f45a069cf157a8c747a3bd1.1.tmp
/data/media/####/37c1020f69721fa4d66a83f824a884b1.0.tmp
/data/media/####/37c1020f69721fa4d66a83f824a884b1.1.tmp
/data/media/####/39ea8203958914f2eaf5dd47dc9e8d07.0
/data/media/####/5e1ce40b84391f485fc487234433d696.0.tmp
/data/media/####/5e1ce40b84391f485fc487234433d696.1.tmp
/data/media/####/661554a03c8b05e1f7b386f6c5d3ddbe.0.tmp
/data/media/####/661554a03c8b05e1f7b386f6c5d3ddbe.1.tmp
/data/media/####/6754d2ae86945b4dfa6a0bfd936a4ede.0.tmp
/data/media/####/6754d2ae86945b4dfa6a0bfd936a4ede.1.tmp
/data/media/####/7029f93bad0e66370876115bbca56bcf.0.tmp
/data/media/####/7029f93bad0e66370876115bbca56bcf.1.tmp
/data/media/####/7136403c9d0c59f371984e4e88cb95b3.0.tmp
/data/media/####/7136403c9d0c59f371984e4e88cb95b3.1.tmp
/data/media/####/8af44d710b44e78f0e5e0ed1e29630b3.0.tmp
/data/media/####/8af44d710b44e78f0e5e0ed1e29630b3.1.tmp
/data/media/####/8e51fc9ea574da61c849969795380bb6.0.tmp
/data/media/####/8e51fc9ea574da61c849969795380bb6.1.tmp
/data/media/####/90e69a2c4f5b7f1d7cb6652214939c1a.0.tmp
/data/media/####/90e69a2c4f5b7f1d7cb6652214939c1a.1.tmp
/data/media/####/94b862ef920f3173a8cdcb49c8c8ad1b.0.tmp
/data/media/####/94b862ef920f3173a8cdcb49c8c8ad1b.1.tmp
/data/media/####/94e99028ea64e2820bb1c18c4e7b2707.0.tmp
/data/media/####/94e99028ea64e2820bb1c18c4e7b2707.1.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/abbd4288060a8cee615b8b1a4e446cdf.0.tmp
/data/media/####/abbd4288060a8cee615b8b1a4e446cdf.1.tmp
/data/media/####/app.db
/data/media/####/b6043d3a7926299af58f3f7d5b3e98f1.0.tmp
/data/media/####/b6043d3a7926299af58f3f7d5b3e98f1.1.tmp
/data/media/####/c63d3e70e89eed732b071b0a6dce1b3d.0.tmp
/data/media/####/c63d3e70e89eed732b071b0a6dce1b3d.1.tmp
/data/media/####/ceb28d2b71f7c304ce22a2309d13678d.0.tmp
/data/media/####/ceb28d2b71f7c304ce22a2309d13678d.1.tmp
/data/media/####/cf98d7282c7b9cde64fb9ab6a668b70b.0.tmp
/data/media/####/cf98d7282c7b9cde64fb9ab6a668b70b.1.tmp
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.yunjibuyer.yunji.bin
/data/media/####/com.yunjibuyer.yunji.db
/data/media/####/db1e134c972c5fcf80ba8aca52796061.0.tmp
/data/media/####/db1e134c972c5fcf80ba8aca52796061.1.tmp
/data/media/####/e4a41317d7e77f07aa07bdda271b5643.0.tmp
/data/media/####/e4a41317d7e77f07aa07bdda271b5643.1.tmp
/data/media/####/f88d37a9e91c4dad79ac7e582669be5c.0.tmp
/data/media/####/f88d37a9e91c4dad79ac7e582669be5c.1.tmp
/data/media/####/journal.tmp
/data/media/####/log_20180930.txt
/data/media/####/tdata_YYn966
/data/media/####/tdata_eOt091
/data/media/####/test.log
/data/media/####/yjvip_yj_release_v2.1.09251_legu_signed_zipalign.apk

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.yunji.imaginer.yjpush.YJGTPushService 25080 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime

Загружает динамические библиотеки:

Bugly
MtaNativeCrash_v2
eiu-bspatch
entryexpro
getuiext2
imagepipeline
libnfix
libshella-2.9.0.2
libufix
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding
RSA-NONE-PKCS1PADDING

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней