Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pv####.baom####.com:80
- TCP(HTTP/1.1) i####.v####.baom####.####.com:80
- TCP(HTTP/1.1) i####.v####.baom####.com:80
- TCP(HTTP/1.1) 2####.205.146.22:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) v.g####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) 1####.211.204.209:80
- TCP(HTTP/1.1) d.g####.qq.com:80
- TCP(HTTP/1.1) 3####.tc.qq.com:80
- TCP(HTTP/1.1) app.inter####.baom####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) p####.baom####.com:80
- TCP(HTTP/1.1) cgi.con####.qq.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) c4.g####.qq.com:80
- TCP(TLS/1.0) 1####.202.114.81:443
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) s####.e.qq.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- a####.u####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- app.inter####.baom####.com
- c####.g####.ig####.com
- c-h####.g####.com
- c.g####.qq.com
- c4.g####.qq.com
- cfg.i####.qq.com
- cgi.con####.qq.com
- d.g####.qq.com
- h####.b####.com
- i####.dd.qq.com
- i####.v####.baom####.com
- i####.v####.baom####.com
- i####.v####.baom####.com
- i####.v####.baom####.com
- imgc####.qq.com
- l####.tbs.qq.com
- log.u####.com
- mi.g####.qq.com
- mo####.b####.com
- p####.baom####.com
- p####.ugd####.com
- pi####.qq.com
- pp.m####.com
- pv####.baom####.com
- qzones####.g####.cn
- s####.e.qq.com
- s####.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- v####.inter####.baom####.com
- v.g####.qq.com
Запросы HTTP GET:
- 3####.tc.qq.com/16891/709E2E5469CF8561D99F5DC3B69B565B.apk?fsname=####&c...
- app.inter####.baom####.com/xiuquapp.ashx?dataType=####
- app.inter####.baom####.com/xiuquapp.ashx?dataType=####&pageIndex=####&pa...
- app.inter####.baom####.com/xiuquapp.ashx?imeiCode=####&videoId=####&data...
- c4.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi...
- c4.g####.qq.com/gdt_trace_a.fcg?actionid=####&targettype=####&tagetid=##...
- cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
- d.g####.qq.com/fcg-bin/gdt_appdetail.fcg?ico=####&op_appid=####
- i####.v####.baom####.####.com/230_130/22199030.jpg
- i####.v####.baom####.####.com/230_130/36974447.jpg
- i####.v####.baom####.####.com/230_130/37059865.jpg
- i####.v####.baom####.####.com/230_130/37080196.jpg
- i####.v####.baom####.####.com/230_130/37104671.jpg
- i####.v####.baom####.####.com/230_130/37112261.jpg
- i####.v####.baom####.####.com/230_130/37115391.jpg
- i####.v####.baom####.####.com/230_130/37137276.jpg
- i####.v####.baom####.####.com/230_130/37139655.jpg
- i####.v####.baom####.####.com/230_130/37153386.jpg
- i####.v####.baom####.####.com/230_130/37154425.jpg
- i####.v####.baom####.####.com/230_130/37154732.jpg
- i####.v####.baom####.####.com/230_130/37158044.jpg
- i####.v####.baom####.####.com/230_130/37191137.jpg
- i####.v####.baom####.####.com/230_130/37207817.jpg
- i####.v####.baom####.####.com/230_130/37207822.jpg
- i####.v####.baom####.####.com/230_130/37208395.jpg
- i####.v####.baom####.####.com/230_130/37208398.jpg
- i####.v####.baom####.####.com/230_130/37208400.jpg
- i####.v####.baom####.####.com/230_130/37208484.jpg
- i####.v####.baom####.####.com/230_130/37208652.jpg
- i####.v####.baom####.####.com/230_130/37218345.jpg
- i####.v####.baom####.####.com/230_130/37218503.jpg
- i####.v####.baom####.####.com/230_130/37270332.jpg
- i####.v####.baom####.com/230_130/37259560.jpg
- i####.v####.baom####.com/230_130/37286197.jpg
- i####.v####.baom####.com/230_130/37293286.jpg
- i####.v####.baom####.com/230_130/37313509.jpg
- i####.v####.baom####.com/230_130/37315238.jpg
- i####.v####.baom####.com/230_130/37326173.jpg
- i####.v####.baom####.com/230_130/37365278.jpg
- i####.v####.baom####.com/230_130/37367591.jpg
- i####.v####.baom####.com/230_130/37377098.jpg
- i####.v####.baom####.com/230_130/37398731.jpg
- i####.v####.baom####.com/230_130/37403817.jpg
- i####.v####.baom####.com/230_130/37404801.jpg
- i####.v####.baom####.com/230_130/37410635.jpg
- i####.v####.baom####.com/230_130/37506826.jpg
- i####.v####.baom####.com/230_130/37530991.jpg
- i####.v####.baom####.com/230_130/37603715.jpg
- i####.v####.baom####.com/230_130/37625024.jpg
- i####.v####.baom####.com/230_130/37850340.jpg
- i####.v####.baom####.com/230_130/37874119.jpg
- i####.v####.baom####.com/230_130/37906829.jpg
- i####.v####.baom####.com/230_130/37909713.jpg
- i####.v####.baom####.com/230_130/37918262.jpg
- i####.v####.baom####.com/230_130/37920559.jpg
- i####.v####.baom####.com/230_130/38020846.jpg
- i####.v####.baom####.com/230_130/38068091.jpg
- i####.v####.baom####.com/230_130/38109280.jpg
- i####.v####.baom####.com/230_130/38113362.jpg
- i####.v####.baom####.com/230_130/38116059.jpg
- i####.v####.baom####.com/230_130/38116761.jpg
- i####.v####.baom####.com/230_130/38121594.jpg
- i####.v####.baom####.com/230_130/38121663.jpg
- i####.v####.baom####.com/230_130/38122440.jpg
- i####.v####.baom####.com/230_130/38125606.jpg
- i####.v####.baom####.com/230_130/38127278.jpg
- i####.v####.baom####.com/230_130/38144341.jpg
- i####.v####.baom####.com/230_130/38155487.jpg
- i####.v####.baom####.com/230_130/38347899.jpg
- i####.v####.baom####.com/230_130/38419176.jpg
- i####.v####.baom####.com/230_130/38469153.jpg
- i####.v####.baom####.com/230_130/38496900.jpg
- i####.v####.baom####.com/230_130/38506952.jpg
- i####.v####.baom####.com/230_130/38540986.jpg
- i####.v####.baom####.com/640_360/38548393.jpg
- mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
- mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
- mo####.b####.com/ads/pa/8/__xadsdk__remote__8.8006.jar
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969360624=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969361701=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969370893=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969371588=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969372564=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969383687=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969384897=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1539969386372=####
- p####.baom####.com/getvideourl.aspx?flvid=####&devicetype=####
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android03/js-release/1.1.0/nati...
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- pv####.baom####.com/datagather.aspx?ext=####&bcode=####&siteid=####&refu...
- pv####.baom####.com/videogather.aspx?siteid=####&playerid=####&type=####...
- s####.tc.qq.com/gdt/0/DAAD72KAKAAPAAApBbjS57B44zn5rU.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAFxScAUAALQABTBbvskkCV_aQrPY.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAALbIdAUAALQABjBbbTZiAxsl8pyW.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAVUSmAUAALQABSBbhR4RBVA2UsEO.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAVUSmAUAALQABUBbMg-7C0Fwyx87.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAVUSmAUAALQABfBbxYoeAkBaW4qw.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAVW-pAUAALQABOBbWtVhCDS8uUfF.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAXbfdAUAALQABYBbvutmBne1tYeL.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAYT3gAUAALQABZBak77gB3NBQX-G.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAgR4oAUAALQABQBbxDzWCsM-3ClG.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAgR4oAUAALQABZBbn34fAmCFPdqi.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/e4d135f0c682f4971184c1df8880d64c.JPG/0?ck=####
- s####.tc.qq.com/ma_icon/0/icon_11789440_1538103226/256
- t####.c####.q####.####.com/config/hz-hzv3.conf
- v.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####&gap=####
Запросы HTTP POST:
- a####.u####.com/app_logs
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- app.inter####.baom####.com/ChannelInfo.asmx/GetPgcInfo
- app.inter####.baom####.com/dataGrand.asmx/ReportData
- app.inter####.baom####.com/getlist.asmx/GetCommentList
- app.inter####.baom####.com/getlist.asmx/GetRecommendMhh
- app.inter####.baom####.com/getlist.asmx/GetVersionChannelInfo
- c-h####.g####.com/api.php?format=####&t=####
- l####.tbs.qq.com/ajax?c=####&v=####&k=####
- pi####.qq.com/mstat/report
- s####.e.qq.com/activate
- s####.e.qq.com/click
- s####.e.qq.com/msg
- sdk.o####.p####.####.com/api.php?format=####&t=####
- v.g####.qq.com/gdt_stats.fcg
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/0073b0040a11ee02d4d18db9b261bdd36797c312806067d....0.tmp
- /data/data/####/02ed28cae8d56df3f733ae91fb508ad3df7c4348ca8426b....0.tmp
- /data/data/####/0a36ad9d5dd86900fb8e3295f0eef6e554cf6f71f62a07e....0.tmp
- /data/data/####/0ada08899af994c9761d870484cd00378b666c4b000c4cc....0.tmp
- /data/data/####/0d9bcc9a458fe9c15b1f3859b75a9318c9abe7c883b9e01....0.tmp
- /data/data/####/10bdfbe76099ccd9b4157f2c6edf1839000683624f653a0....0.tmp
- /data/data/####/10d71be5cf6bba026ed04199754aa590e612d2be4a349c7....0.tmp
- /data/data/####/126c75712ebe881cc7af26291424c8341979f31e41afbd2....0.tmp
- /data/data/####/1539969342199.log
- /data/data/####/15514a85a6099936560b6287dd095ec33ab9ce71c4d2a14....0.tmp
- /data/data/####/17491560c84067879c093c639de522be1800692c9f6b58a....0.tmp
- /data/data/####/1a0b46d9c0fa0d5e5509d2fae6716de6a86b4355d227602....0.tmp
- /data/data/####/1c0c942407c38f8579f351883535d7c205ff6cf6d5fb1db....0.tmp
- /data/data/####/1d60df47690cdc450decc5242e62871bab31892da7b2a62....0.tmp
- /data/data/####/1d74f0dc87f564cffc00141444960ba001b4c7d5c48df68....0.tmp
- /data/data/####/1fc823f9a69f747fd4bf1fbc4bf6692e393437acc5eaeef....0.tmp
- /data/data/####/20a948cfa96de2e19c4a1c4ddf0a947f45f94aae2588c5a....0.tmp
- /data/data/####/2274.yaqcookie
- /data/data/####/2532de32af033139117d9f4657558ac50c61c799e9592b4....0.tmp
- /data/data/####/273b733ae532402e3fde391052fce639ea38019fee4e5c6....0.tmp
- /data/data/####/2b3feecb6484f44e18a8a08250ca10ff3c73da4cc9e9baa....0.tmp
- /data/data/####/2b821928d9a225819582722f7f7a3b937d22401d6994b42....0.tmp
- /data/data/####/2f631f9d6a636c6fdfed20b3bf5934e00678ebd9922fb22....0.tmp
- /data/data/####/311f3d617bc7d95cb9188efbdddfdc4d55cb62ba72ee62a....0.tmp
- /data/data/####/312de5c512c8a08eee89527f9f5aaed3253bf3e12a6c471....0.tmp
- /data/data/####/368257216b06eaa660185d32f0f3d7732983394dc6b4219....0.tmp
- /data/data/####/39fbff47e352b4ad49e512af4fbecc73a2d4592914392aa....0.tmp
- /data/data/####/4041b15d785c9d54129ea1fe47c9f47b2483efc8698fa8b....0.tmp
- /data/data/####/414483e860762ac1ab57e1bf47f1d8a351d664016b8c197....0.tmp
- /data/data/####/417515a0e9a8b52900a4fdf895568c214a5a892bdb65fa1....0.tmp
- /data/data/####/41b3fb7c80276edfe7448a45ef99b63ba9358d494d44931....0.tmp
- /data/data/####/42007350d309643ebcda842617ef881cac207db857ff097....0.tmp
- /data/data/####/460fd2161a97f919715f67b36fb7f1c9385add1ad99b112....0.tmp
- /data/data/####/461e1b3702385bb288b4e33edeafc0a9817988122ed6585....0.tmp
- /data/data/####/46d59c3d8ae7e24679872b53513a4308e3a3664fa27fb76....0.tmp
- /data/data/####/4b2acc2a3a0f94f235658a136c312c09557902a43098caa....0.tmp
- /data/data/####/4bf1c07922664b7cbf6b87d91c9f8f8e88f0677448fcfc2....0.tmp
- /data/data/####/4d0b164b15208a14b150b9ee7b2c189457b58912d7977ca....0.tmp
- /data/data/####/4d1e4a83e8c654a748a0a2719e116483fb96b1c3b357fee....0.tmp
- /data/data/####/4f9da78c5dd76c8cfed8b605676243accb10d55eea8e0aa....0.tmp
- /data/data/####/514d8ef3dafb9842c43427b276c1119a15d36f1bbaf6441....0.tmp
- /data/data/####/541ee01db2dfb9b78599931781f09578291b60745263512....0.tmp
- /data/data/####/54acb1791d16fa0dcc9d9c5b9b4bb622312ea8cce6a0c19....0.tmp
- /data/data/####/5805ce20308fb99a9f9eb69c2ef84df2a05de7b605c7c70....0.tmp
- /data/data/####/59ef789910b071ad27af8c516598b66772d3b8d882a8525....0.tmp
- /data/data/####/59f34ea3af4a46fc473f746ef071d02ff7a4e22737f3d1f....0.tmp
- /data/data/####/5c00af49b26ba6c43a2582195ad87eb5a77b8f2635199ac....0.tmp
- /data/data/####/5ead7c1916e321af3ee0d7d6aa595238.temp
- /data/data/####/60ef455106a2cb7c30fcf9a5b89b687cfe39ae8da8e7863....0.tmp
- /data/data/####/61298118cb5f2cc7b063cb861ee50ccd2fc81f53744e831....0.tmp
- /data/data/####/62a9fe96a1713e11a33cbc015487f9a472eb5d482c19f28....0.tmp
- /data/data/####/636601c436ceea68c294f1c6d793a464e0a11e19007f236....0.tmp
- /data/data/####/6615df609b53a866ca80ccbb2a8bb517a20ecee31a38659....0.tmp
- /data/data/####/67e0688eb931a56850f41781f2ac9fdf72ef02860f11700....0.tmp
- /data/data/####/681b8879c3cd6354120f444b13e0c0355405567073c32e0....0.tmp
- /data/data/####/688bbe8cb9f7faf78efa1c6174be4278697a1d6d7285df2....0.tmp
- /data/data/####/68bd262bfa6c25b73a0f5fbad419bb61ce960d74d798f51....0.tmp
- /data/data/####/6b5f6128e8f4adfd60d3cbdd573ccaaec74cda6a8aa75b8....0.tmp
- /data/data/####/6d741e4eaecd8900746797ea74d2c03cf6eae371eab22fd....0.tmp
- /data/data/####/70ef31561e7798a101668f710a5dfa2b43060854d080cc6....0.tmp
- /data/data/####/713f3d00fae0ec813d5342199e8cd7972fe904dcdbbfa69....0.tmp
- /data/data/####/74179b2a5cf880014f516924b8dce1c2810211ae0cfe1b5....0.tmp
- /data/data/####/745692d57a9e876f49d1ce7f3fd98dc15e68e21a1295ab0....0.tmp
- /data/data/####/76c0befe3b07a75148c6e9bdaa2034429f795716e9b9a70....0.tmp
- /data/data/####/796186b39eaff2fb40bd49cf352ec7dc8bd1e19d8234cad....0.tmp
- /data/data/####/7bb8a7b20db7925c583688f2e9601e6bb7a09a634c13935....0.tmp
- /data/data/####/7ce8f20c07c270391d01cf1d2585475ac9003babc6f04b1....0.tmp
- /data/data/####/7db3f8e20ede873bdb84fb55dabe951dc433a84486ee3f6....0.tmp
- /data/data/####/7e648576f172fd645e992435dc9d21265526bfe8f4fb68c....0.tmp
- /data/data/####/80d37a2f8ae0b91af823e1eadf8b70a994b6a5d8bd2db03....0.tmp
- /data/data/####/83fe065546a337082463088e5ea7f1f748f5febbfdfe6e1....0.tmp
- /data/data/####/8a6ad962566ed25e280c39434b063d8e2f3594819473d12....0.tmp
- /data/data/####/8fb46b1431ef0172cdba6f22dac811f0c027940ec586dce....0.tmp
- /data/data/####/912039009c41816e5d052c381c3fa8cc2673b551fad215e....0.tmp
- /data/data/####/925da290de367d35469b2de48c387b35621e4d3ceb0925c....0.tmp
- /data/data/####/92c0c3ddd0e5f771c44a223eaf14f20868aa564b143b62a....0.tmp
- /data/data/####/94347adeb80e5fa9f08915d48ffa44146dfbd92917a582b....0.tmp
- /data/data/####/94f99bfebf5ee8822f021dccc2af35756d30ef78bfd2b26....0.tmp
- /data/data/####/98bb93387967adf6dc6af758dcf650179534ede790e9044....0.tmp
- /data/data/####/9a5b5899c6577ec913c82a1b040919716d058fa01ff35e5....0.tmp
- /data/data/####/9e905c8bea6489e49111535027efec43abf0d9d550d88c2....0.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/BmhUserId.xml
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/ContextData.xml
- /data/data/####/CookiePersistence.xml
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/LastHistoryInterceptor.xml
- /data/data/####/PersonInfo.xml
- /data/data/####/User_XiuQu.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__send_data_1539969340565
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__9b106cb6-fff4-431a-a05...d0.jar
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/__xadsdk__remote__final__builtinversion__.jar
- /data/data/####/__xadsdk__remote__final__downloaded__.jar
- /data/data/####/__xadsdk__remote__final__running__.jar
- /data/data/####/__xadsdk_downloaded__version__.xml
- /data/data/####/a171a38dd90b781415420df232728ebcb651ba6bccb6908....0.tmp
- /data/data/####/a3c43c977347ba1cb84ac3ce4f1557142f384a08c83b10d....0.tmp
- /data/data/####/a58f0090fa6c62699074bbac5dadcb24712602158769113....0.tmp
- /data/data/####/a76abadf66053d65cea8b507c659a725dc2a87663774513....0.tmp
- /data/data/####/a773a57ab0070a1a68845d073980fb8b04f521c9b0f46f3....0.tmp
- /data/data/####/a95563496d6216cff215da8752a689ff0ede5e7343cfb1a....0.tmp
- /data/data/####/a9d5ee97a679ce0a9a41f9a4eb5fa75acac2b71829c61ab....0.tmp
- /data/data/####/aa24496809eeb01f5b46f8bd41cc9ba5c177f5619c7851e....0.tmp
- /data/data/####/ac904cf7ba192b55e2065c75a38de5cc349a9b6e8193ef6....0.tmp
- /data/data/####/ad5a9472fcdefb144320bddff6ef9cec3b4f3fa89876035....0.tmp
- /data/data/####/b05e8af4f89307be38d714552127b8958461851dd52e6c1....0.tmp
- /data/data/####/b0ed56e7bbefb0aa6270eba1b87b6afc3cbea26e89a9dac....0.tmp
- /data/data/####/b144b1f9d10726ea4b550ba8bc3bed4de9195b0c929807e....0.tmp
- /data/data/####/b4670a7f52426683c338de554e7ffe99b46ecd4f2b2ed44....0.tmp
- /data/data/####/b4dbdb8a8ec8ae208f08ff95b80b86ef804c3efe63c6424....0.tmp
- /data/data/####/b591091d213cc13f07628066f1ae51d50f7cf96e441351b....0.tmp
- /data/data/####/b5d414613288a4307ae8ebf7bd3b1ab32a9dffb9c36e93c....0.tmp
- /data/data/####/b62695c89e5c024382e552567114e575e9c827693477ca6....0.tmp
- /data/data/####/b6adebfd030ddb5b96f967a48bf78d219d12eca942ae888....0.tmp
- /data/data/####/b7de9b69dfbb1b16dcd00ac8f161cc11273399e6b012b5a....0.tmp
- /data/data/####/b8f92b3d245391a8d31a375da187b442710acad402d5d82....0.tmp
- /data/data/####/bae8308eafad255e8613e2420edd297290e886ac092eb4c....0.tmp
- /data/data/####/bfd99ae5f73cd250b1ff7b7486400568cef76fffd8e99ce....0.tmp
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c191f12894f970d57017d83f4e84ad0b7461173f276f922....0.tmp
- /data/data/####/c1aa86fe72a4fa05e7c295b4b45520780aba7509cb44860....0.tmp
- /data/data/####/c1e844c6a2faf501923d649f5f2619b21c7eff38cda449e....0.tmp
- /data/data/####/c73e01237f4aa8a28bc70014dbd3afda6db5d917b097fa9....0.tmp
- /data/data/####/c7bc9ac2d330d08c213fa60a6d023324873bc9c211c6fff....0.tmp
- /data/data/####/c856fe529ee20bc18df3de4bf67dd0d4afcedd6e99948e0....0.tmp
- /data/data/####/c8bf5d9f1cbdf3d875db91345e3b5aa737824c5289eaa53....0.tmp
- /data/data/####/c8d4f6b73de0d6594cc1c2235141af6922af4b8d7cab03f....0.tmp
- /data/data/####/c9ab0fe7a306bbdd1aa33bf29eb8650c8d11f5646100b97....0.tmp
- /data/data/####/caac000f5c293889dc63e052274358bb6b0fc8e5c05984c....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cce5595352c9f7e7496000337b4ea5ad6ecbc701101ec98....0.tmp
- /data/data/####/cdc6015b4a4addd8734bd6b36c41c74bd0c9be3c10fb274....0.tmp
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/com.com.baomihuawang.androidclient_preferences.xml
- /data/data/####/com.com.baomihuawang.androidclient_preferences.xml.bak
- /data/data/####/com.tencent.open.config.json.1105254905
- /data/data/####/core_info
- /data/data/####/d0b57985699ff011944ab4bd5e9866a188f1582102b2af3....0.tmp
- /data/data/####/d183789df0f67503b156548c7e1856867b45f2a4009564c....0.tmp
- /data/data/####/d5a30466bb59f68dd647eca6d3f8a8bc855342b1c514c3b....0.tmp
- /data/data/####/d6ac1c400c8307f1afaa152833e19d99cc47ab4b88eea8b....0.tmp
- /data/data/####/d8d2f2c6df70dff3a5aedabc92c74315bb19a81ee1d854e....0.tmp
- /data/data/####/d8e67ec7102dca09281249c880d77711.temp
- /data/data/####/d987ca3b00a4ef8016409306eaa791b302169b7cfcfb9cd....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dc4a0a77a9cd280a77d2d0aeaaef72d58ebbe1140f12880....0.tmp
- /data/data/####/debug.conf
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/dexMethod.82894129.dat
- /data/data/####/e41dba541d5a46a1c3f257a2ff4bb67d6b039c60e09b816....0.tmp
- /data/data/####/e5b9d584210048f62bfc7782c7628003ee2ca49fd3e175a....0.tmp
- /data/data/####/e629de6f0eb2ba2bef47d3d2d182423075973be7cd09f3c....0.tmp
- /data/data/####/e6df4dce969b3588802b0d9fd41497973ad797779c64868....0.tmp
- /data/data/####/eca120a492e36a5d2d2430cf0e1d1afe1950436d409d966....0.tmp
- /data/data/####/ed080de2a8c03e0f079dbd6bb515359efd068356cfd206f....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f1a47fc22886e681d5e27cff69b73a0faef015b30f82561....0.tmp
- /data/data/####/f25c2b1dd47468df76ab9f6df0525e98e045ae7f2cb7361....0.tmp
- /data/data/####/f271ac808835201702aa5e5f4b8fdb6e984863a08bdb274....0.tmp
- /data/data/####/f3944f275a4930f612754f8b286ac605c36ea30ab388cca....0.tmp
- /data/data/####/f40bbdd57332a2b2e95d54c22e120e6ba6dac7249d46293....0.tmp
- /data/data/####/f5e369eba09d9fb5119b7c2a2f04ee118c0a0dc12f35712....0.tmp
- /data/data/####/f725b04f346f93857520402dd4bcc2bdbc1e6a83a7d3667....0.tmp
- /data/data/####/f7e17f8976b08287d852f413351c1a07df03392125fb6a4....0.tmp
- /data/data/####/f9ce7009af1bedb61bfcf072043ed9012c3d059a1bf602d....0.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/fb31c79f4f27e0413d9a5a68e728dc1809fa131e6ba1781....0.tmp
- /data/data/####/fddc93dc85ac644080038e0cda6ffa371d47b7f2640f3af....0.tmp
- /data/data/####/ff35c5661b4933a926f074e8c4cf313a583bcb03a5d9b11....0.tmp
- /data/data/####/ff8c2fce664a4c0c49bb0571691ccfeb80fc0ccbb48c989....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/gdt_config.cfg
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_stat.db
- /data/data/####/gdt_stat.db-journal
- /data/data/####/gdt_suid
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/isNewInstall.xml
- /data/data/####/isShowGuids.xml
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.0.2.so
- /data/data/####/libyaqbasic.82894129.so
- /data/data/####/libyaqpro.82894129.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/net_sp_name.xml
- /data/data/####/permission.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/security_info
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_vxj811
- /data/data/####/tdata_vxj811.jar
- /data/data/####/tencent_analysis.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromium.db-journal (deleted)
- /data/data/####/yaqsdkcookie
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.timestamp
- /data/media/####/Alvin2.xml
- /data/media/####/Audio1539969354897
- /data/media/####/ContextData.xml
- /data/media/####/ae553c2c2e8d90073b8aa7313abffe64
- /data/media/####/app.db
- /data/media/####/com.com.baomihuawang.androidclient.bin
- /data/media/####/com.com.baomihuawang.androidclient.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.tencent.radio.apk_0
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_vxj811
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.ui.service.GePushService 26419 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.ui.service.GePushService 26419 300 0
Загружает динамические библиотеки:
- Bugly
- MtaNativeCrash
- crash_analysis
- getuiext2
- ijkffmpeg
- ijkplayer
- ijksdl
- libnfix
- libshella-2.9.0.2
- libufix
- libyaqbasic.82894129
- libyaqpro.82894129
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DESede-ECB-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DESede-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к интерфейсам записи аудио/видео данных.
Выполняет запись аудио/видео данных.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
