Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub-####.qin####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) m####.d####.com:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) cgi.con####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) 1####.217.19.206:443
- TCP(TLS/1.0) api.w####.com:443
- TCP c####.g####.ig####.com:5226
- TCP sdk.o####.t####.####.com:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a.appj####.com
- api.w####.com
- c####.g####.ig####.com
- c-h####.g####.com
- cgi.con####.qq.com
- h####.b####.com
- m####.d####.com
- pi####.qq.com
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
Запросы HTTP GET:
- cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
- m####.d####.com/images/cover6.png
- m####.d####.com/images/small/194.png?v=####
- m####.d####.com/images/small/195.png?v=####
- m####.d####.com/images/small/196.png?v=####
- m####.d####.com/images/small/197.png?v=####
- m####.d####.com/images/small/198.png?v=####
- m####.d####.com/images/small/199.png?v=####
- m####.d####.com/images/small/212.png?v=####
- m####.d####.com/images/small/213.png?v=####
- m####.d####.com/images/small/214.png?v=####
- m####.d####.com/images/small/215.png?v=####
- m####.d####.com/images/small/216.png?v=####
- m####.d####.com/images/small/217.png?v=####
- m####.d####.com/images/small/218.png?v=####
- m####.d####.com/images/small/219.png?v=####
- m####.d####.com/images/small/220.png?v=####
- m####.d####.com/images/small/221.png?v=####
- m####.d####.com/images/small/222.png?v=####
- m####.d####.com/images/small/223.png?v=####
- m####.d####.com/images/small/224.png?v=####
- m####.d####.com/images/small/225.png?v=####
- m####.d####.com/images/small/226.png?v=####
- m####.d####.com/images/small/227.png?v=####
- m####.d####.com/images/small/228.png?v=####
- m####.d####.com/images/small/229.png?v=####
- m####.d####.com/images/small/230.png?v=####
- m####.d####.com/images/small/231.png?v=####
- m####.d####.com/images/small/232.png?v=####
- m####.d####.com/images/small/233.png?v=####
- m####.d####.com/images/small/234.png?v=####
- m####.d####.com/images/small/235.png?v=####
- m####.d####.com/images/small/236.png?v=####
- m####.d####.com/images/small/237.png?v=####
- m####.d####.com/images/small/238.png?v=####
- m####.d####.com/images/small/239.png?v=####
- m####.d####.com/images/small/240.png?v=####
- m####.d####.com/images/small/241.png?v=####
- m####.d####.com/images/small/242.png?v=####
- m####.d####.com/images/small/243.png?v=####
- m####.d####.com/images/small/244.png?v=####
- m####.d####.com/images/small/245.png?v=####
- m####.d####.com/images/small/246.png?v=####
- m####.d####.com/images/small/247.png?v=####
- m####.d####.com/images/small/248.png?v=####
- m####.d####.com/images/small/249.png?v=####
- m####.d####.com/images/small/250.png?v=####
- m####.d####.com/images/small/251.png?v=####
- m####.d####.com/images/small/252.png?v=####
- m####.d####.com/images/small/253.png?v=####
- m####.d####.com/images/small/254.png?v=####
- m####.d####.com/images/small/255.png?v=####
- pub-####.qin####.com/tdata_EDT356
- t####.c####.q####.####.com/config/hz-hzv3.conf
- t####.c####.q####.####.com/tdata_BAI450
- t####.c####.q####.####.com/tdata_YJA893
Запросы HTTP POST:
- a.appj####.com/ad-service/ad/mark
- c-h####.g####.com/api.php?format=####&t=####
- m####.d####.com/app/config/androidupgrade
- m####.d####.com/app/config/color
- m####.d####.com/app/config/font
- m####.d####.com/app/config/index
- m####.d####.com/app/config/template
- pi####.qq.com/mstat/report
- sdk.o####.p####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/009f4da9cfb7c28899bfef1bfb68000dd2bfd7638050daa....0.tmp
- /data/data/####/010ca6026ddd33594a89a5aaedd58f15
- /data/data/####/01706596b230f27b8c047797b9e2e54fe63b6648c29d9bd....0.tmp
- /data/data/####/0379b5942fab466ceb8c9e4398183b21e811765c866af7f....0.tmp
- /data/data/####/059adb7c0b932ff8cbedc83377da281367fdad7881badc9....0.tmp
- /data/data/####/07efe8cf663beec9615e20b7550ab4b8
- /data/data/####/0a112015fdb1dabcc0c892bcc664548c516871b96f986c0....0.tmp
- /data/data/####/0a9432d51e82d1c7f23d4ddc161d4220
- /data/data/####/0aab722c2e10886d9e746be1ec26c2db
- /data/data/####/0b3cbc59895bf5f91705f1dc29d214f1b2e5d9d5375b1a0....0.tmp
- /data/data/####/0cd3bb413616260df4dcba5c68a8a0a089d4d46ae968af1....0.tmp
- /data/data/####/0e7df9af8d4299d6857017107df1141b
- /data/data/####/0ee903625f2f97512cbb7fb4354ddc73
- /data/data/####/0fc5f3194daa73bbf7606ad7212b05e6
- /data/data/####/0fe55fac3a232e8a75ec44f46fdb065c
- /data/data/####/108c7b2f403391402cd4016f30e4848fc134294f0c8f65b....0.tmp
- /data/data/####/11f7a7c68a2eef157d9c9e4cc10a118d7efc9872d4fb606....0.tmp
- /data/data/####/129aa13c8dc832242ae30c45833a48a160476be24ece0fe....0.tmp
- /data/data/####/1540943265761
- /data/data/####/1540943265793
- /data/data/####/196a2690ea803288399c9edf903b498ec8ab3c4e95afc21....0.tmp
- /data/data/####/199e713b51bb1eca5944da547dd4bff2
- /data/data/####/1b78e8708f6e289d231c5088c32e91c4c2257c8af732f67....0.tmp
- /data/data/####/1dc62c13bdc65cddd06c1510fe272036938029f94ad3f82....0.tmp
- /data/data/####/1e6e93e8e4b6b8de8e8a6eb67bc247bc1c6de4381da16f0....0.tmp
- /data/data/####/2082e541ca8fb19d2dc35332c4f2fd7a95ab893bfcca641....0.tmp
- /data/data/####/21ecf4a4c079f0f3b12e028e89d6e4ce2efe2e6d35eae4a....0.tmp
- /data/data/####/21faf83ebe03b218c145d5d126043ce4f022c5847a172a1....0.tmp
- /data/data/####/23339c179452c0a982575032fa7f98b8
- /data/data/####/2380a883e532af2e155720d2df1acc5e19e87231924cb79....0.tmp
- /data/data/####/244b5d4d1a57fbb949f23de2d4a773e8
- /data/data/####/2480a11795b1f1ae90f463c30920bece19eb05fa3245da8....0.tmp
- /data/data/####/258beba88204d78ee93747d9efa1be93b02d77b2f45c4fa....0.tmp
- /data/data/####/26694e93c6186f51bd8b77b1dbe4180f458a573e5d7ed81....0.tmp
- /data/data/####/277f0fcd7f5380aae22e1d0d9ae278f2
- /data/data/####/27cb9543e8407e1a0c59354fc98a6f9d
- /data/data/####/27f4e8b40781364ac7d8379844ed11ae
- /data/data/####/28d60ec4dc7c74ff5816af86b9582288
- /data/data/####/29ae821888e6bccb29f121fd40939f8c71ec47a6456d599....0.tmp
- /data/data/####/2aaa5fb49b2b37e8fcac602fcdaf17be
- /data/data/####/2d7c4110d327e6af0e5fabee5e0484ee
- /data/data/####/2ef7728254f31acf17c1120762727a4d
- /data/data/####/2f1528cc9dbb997f6c4bce2bb490172eb8d6b1f7fa248b2....0.tmp
- /data/data/####/306de4211fd143286bd59640f37f1e03
- /data/data/####/309d7612ae57cc6f14caf231e0639a88
- /data/data/####/311b4e34937803aa026d52b6af72ddd73e0d63eaabb1c54....0.tmp
- /data/data/####/312ef4050a7bcf0e9082bbf338034b4d59a9e2340853137....0.tmp
- /data/data/####/31bb99426746979fe2f04c5ad4e1aacf
- /data/data/####/323026a6ce5e76190960b5b867b72677
- /data/data/####/34b6108d58b244a912cbe428f3c6834b
- /data/data/####/34ecd4572a974d89ee033d0f69137c0d
- /data/data/####/3517cd31091122c0bdca56b4620546d9ab725428a9003d0....0.tmp
- /data/data/####/36b83969646f4bef49b0473e8545bc1a
- /data/data/####/37233f9e4c46e839c8910601979490da
- /data/data/####/3806fcbd917ff7f42668c053a5993b42d6628501d57c3d0....0.tmp
- /data/data/####/38a3c53bffdebc3ce0b699359bb12638368144f4c020752....0.tmp
- /data/data/####/395428402876307f07dda06faec12ae9
- /data/data/####/39a10bcc14c1ab22cb9e12bf159ff2c5ca73adb7cd889b5....0.tmp
- /data/data/####/39c51d15012cc6bcc1390114bcd7c07ee31c0817a7318f1....0.tmp
- /data/data/####/39d6e0a507d275c4bd76c4761bb9aca8a9638959dc9b78f....0.tmp
- /data/data/####/3a8e99b1a0ff2bdeccdcd11af30bddbba4a588067cfd5fe....0.tmp
- /data/data/####/3cdaaf605499f51504d42196ddb4f93fb585a6bcbfa365d....0.tmp
- /data/data/####/3db7941cdaac96a80880afc5721f9e8e
- /data/data/####/3fd0ba8acdb2393ebfec6dbd9bfb0a85
- /data/data/####/401944b7b9b8eec7d21c742578d5315b
- /data/data/####/402242980e785d8f1cd1c902c79822ae
- /data/data/####/40d198dd37f0cd070ccec9b3d43eb72f
- /data/data/####/417acc83baa3b8329c4b668ad2deaa8820820421d34457c....0.tmp
- /data/data/####/42a8441422a48edfe5eb2ed4cf5e04b2eef9c394d4bcd18....0.tmp
- /data/data/####/43ad7f8aea255558784d928bd7ce7232def9356af54569e....0.tmp
- /data/data/####/443bd38f8e48d9973eaf4fa01fe3d862163cac927de7c80....0.tmp
- /data/data/####/44ec632e2e509243fca7fa23b470165d561c71383fe8e6b....0.tmp
- /data/data/####/456e71564babc7b637e405f89a69711b3ac47d1f0283e91....0.tmp
- /data/data/####/49b116ba26ebf37fc38d698469febf98dd91f33916e3773....0.tmp
- /data/data/####/4b27a5bb26600ed9b25df380e7740e7311746ae0f27ff61....0.tmp
- /data/data/####/4b398f9ec7a588bbd34576a8be1fdde5965bef7b899ec11....0.tmp
- /data/data/####/4c3e59de1fa308e5a0b3e6ab23b9466de13edb0760c3f37....0.tmp
- /data/data/####/4d99309bdbfaeab4bfbd4b067c683ad82b1a556e1d686ed....0.tmp
- /data/data/####/4ef391b915362b21ff603c3628c30d5afbb8cddbe6b234c....0.tmp
- /data/data/####/5388029a01890b34b7874cd6a3370555
- /data/data/####/55e56440001ef0d3405dae88991b576d
- /data/data/####/564e9d5746c44caf09a49a7d7b8d86e2
- /data/data/####/573d8af4ae1434295334ec886677d3a0
- /data/data/####/58592351ae3db85e2cddbf91dc671d122202bb93d67c51c....0.tmp
- /data/data/####/586f59223b11f87e9ac305236cc8d4f9d748e4d602cdc55....0.tmp
- /data/data/####/5ba40c624f950ec6290de8a7a7a06cbbd14495ef036a62b....0.tmp
- /data/data/####/5c6964801022a270e418c7313579df12
- /data/data/####/5df078c49b595b4dddaf1837bad2ccdd
- /data/data/####/60328f3cf3c1b5dabc392f5a01abb503
- /data/data/####/6115b0ff0be11153e517b330d766eb000383a11e80a6d08....0.tmp
- /data/data/####/62890ab0fcfd7c4093c92611679e042f51fdfecefc78e83....0.tmp
- /data/data/####/64ac5cf836079a6aac429e65a4b35ce9
- /data/data/####/64cbaf676680db8813499bbb15e5ac7319f5e0ff8e01efd....0.tmp
- /data/data/####/6527af32a419a78ae2d19ac15e24505c9b9711c75f090d7....0.tmp
- /data/data/####/670f30f3923893d0b93c6a14ca8ab7c4
- /data/data/####/6788ce8bd0cc6e5cb306c891b84c830ca97838d38349e13....0.tmp
- /data/data/####/688680894e48297f2f79d7ff83e56b690fb2fade410ef64....0.tmp
- /data/data/####/68b81a216efb12de3135a6d44a244196a16ecd63d3a3e20....0.tmp
- /data/data/####/68daa4e8b594ecfb08afb1e8348972b7
- /data/data/####/6f42ecd08b736cd7363c6e9dd4207f19890d5b05f97e427....0.tmp
- /data/data/####/70cf7df3f938e8a57903dd3f71bedd88
- /data/data/####/724baacf63f48120ed8152c2561d3af5
- /data/data/####/731fbf250717b7097f71013f70080ed0
- /data/data/####/74e6577e61b793d52cdd6251ae23a85f1dcc544213548a6....0.tmp
- /data/data/####/7651f4a79ae8607314f17c6c5c923d4a
- /data/data/####/76c1e095f33fd70e1f6166ae1d27acaf
- /data/data/####/776cb9019c8e9b19fdcb11d64723cb7d
- /data/data/####/7acae949b653f607079e71cead345d3f212c2d4a72eda9c....0.tmp
- /data/data/####/7c53939ea0958a945e6896d58905c36c
- /data/data/####/7ed8bca5503d65a01d4975571af29056
- /data/data/####/806736fd25b04bd3b8821463762e1b77b8a987d6947418d....0.tmp
- /data/data/####/80a9ea04c5458aa510d6267ed1c5c475
- /data/data/####/80f872d4a7e3f2914365eec88aa3303346648904b692a91....0.tmp
- /data/data/####/81889f8bd61d850974523f284bc86f7b58e4e8e44bc340b....0.tmp
- /data/data/####/828caa6b5bea5fa40017e53d50e8ca5c2319a78da386fb7....0.tmp
- /data/data/####/82bf3bb1c568c0c38c9cbd0d2f31ab116ba4424a7809d4b....0.tmp
- /data/data/####/83f91550dd8d583ab9e07c72a3c8b101a1b9329bde38cb8....0.tmp
- /data/data/####/844960302062121e54070f7d7afae08c
- /data/data/####/8478d5d263eae68b5326122127c2aabe
- /data/data/####/84a4a3572d6b882eb57d0f8ce1962b2b3f567323b3ee479....0.tmp
- /data/data/####/84cbe1a330e98bd8a87159c97f4a45b01841f01ff115dd3....0.tmp
- /data/data/####/852d33b0c105d8dca9152ee0001459ea
- /data/data/####/85845ae11048cb467df2e8053a56d93782cc8daa6b289eb....0.tmp
- /data/data/####/869b89a80e830ed0451bce106000d98f
- /data/data/####/86d4cccd9ddc8696ea091c8002760dbb0b77ee1695bf087....0.tmp
- /data/data/####/874ebf3383d8428400e716a470d396d1a7e5adeecdc2428....0.tmp
- /data/data/####/8784e105f35cb2afdbb982559ed9d02f
- /data/data/####/8857ab5582c986491dce85cea053a702
- /data/data/####/8b592f859bab362d7cdc5f5b2dc35157eafff689ac32d0c....0.tmp
- /data/data/####/8b8e59922a971ca124600580699c2057479248f253c08ef....0.tmp
- /data/data/####/8e31ecc57d37f9294f4b5ebbde3dd347
- /data/data/####/8e71669a13028663aac11dfe37a542d4
- /data/data/####/9052f1d998fd95aeb0d6f17c8b5e536de930c6935f945d4....0.tmp
- /data/data/####/90a85fe60256b628493c54fe7ec38ce5
- /data/data/####/9176e5842dba44553f9c7d4b6fbee3d3
- /data/data/####/91e10f27e686806a0a7a7e60b0d630f7
- /data/data/####/9202dcf0a29d1afed590d86c0df4713d
- /data/data/####/928ae5e7c1255c158dd9e0b28cd55bd7
- /data/data/####/9327a8ba61c69eeebc2e7f9eb3a5761a052ac40cad02eee....0.tmp
- /data/data/####/9390e943525b566df95e562e4fe8569dfe23b5b83a1da8a....0.tmp
- /data/data/####/93b82c0b6325
- /data/data/####/93b9ebc83cb428753a5339a3a8e6a555ae670bbeeb9af07....0.tmp
- /data/data/####/93c3d1771ebde09dfad7d06900eeff1f
- /data/data/####/93f9e2bdcca63d3a7be7fdfbb5f91ca8
- /data/data/####/94674d26745fe294b403a44889c7bffd
- /data/data/####/94709c33776eb60e28011ec28585523a91258358b5e6ccc....0.tmp
- /data/data/####/97326a728385a71cb6872f6d11936b0e
- /data/data/####/98e06dbcb0ac0867320af48658e1afca
- /data/data/####/9b663e0b5f7785ca6a8c3779f268a98aa5bb94fb3f3735e....0.tmp
- /data/data/####/9caad383bab3f4f8fc4c0349b654089efed4bd48e7624c8....0.tmp
- /data/data/####/9cf5c4821c410c13d86419602c225fe3f109db31c3c1e9f....0.tmp
- /data/data/####/9d2e7b777d9c31d8c52ed176e94ad4a9f993c915a33cca9....0.tmp
- /data/data/####/9dba529445d8a58f789ac048d7a8a59a
- /data/data/####/Mz.db-journal
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__send_data_1540943222989
- /data/data/####/a08ee53a57ba869e29f89e781b9a502a
- /data/data/####/a0a32585a64e5500284bf8acbb16729b
- /data/data/####/a252ff58f857b5b86b87be39a3ec455e6c782d8653fa2d7....0.tmp
- /data/data/####/a2c721ede8b5881f2507e8eed8fdea69
- /data/data/####/a31393f7038a22e94cbdca75d8c050e7ff6e8420e6ce7c4....0.tmp
- /data/data/####/a49fc876ad0f1909d2601b7e4241d9aecebd29e95fe479c....0.tmp
- /data/data/####/a4c2e3da41108ceff15fcd749d550c9866df4286b03eb83....0.tmp
- /data/data/####/a55032a769bebd2e611e8094a7f8bb36
- /data/data/####/a62054c93b80ccb1411fce84270e9d355cf5f919905a736....0.tmp
- /data/data/####/a6ba9d239f1dd034ad247dd5072daaec
- /data/data/####/a6cc9cc51104c68e023cb053477f494f
- /data/data/####/a6ef7019f2800ef5a9ae24bd15bcb455f199f2bc0cd80d2....0.tmp
- /data/data/####/a83b5c7cb953fe4aa680cfa513e2a5b1
- /data/data/####/abebec27ae46e988fc948ece68eb3e65
- /data/data/####/ad4006e7c0403ef7d70fb75311618bb6edaf778d81b65f3....0.tmp
- /data/data/####/ad4bccd15c63b3e3b5cbd37d18891f86
- /data/data/####/b1dcabbb798936806a325da07072805d
- /data/data/####/b246d4eb58d7f300fd94f72ad8ba17b8b0ac8483ffe9426....0.tmp
- /data/data/####/b27bf1981c1c7c266226fa693265242b
- /data/data/####/b2aaecf98cac6b17b4250cb31d71bc640ee910762c38cd3....0.tmp
- /data/data/####/b36332d5cce0fe24cc4718165f08d014
- /data/data/####/b6c6d2e734e01334866fea44a6002733
- /data/data/####/b97f41d7b5bf024ebd03a29c024607bf
- /data/data/####/b99b09d519406425c8fec48561f8574d
- /data/data/####/bafe846b00a8944b894784e1a664b8b8
- /data/data/####/bb484c8f5e7c94503073a89c64edfa06
- /data/data/####/bb705ab432f0bae758592342487c46c8433b79cedec267d....0.tmp
- /data/data/####/bc6cb7a0f8eb2e16a20b3ec133c529696d8fdbf9b4b0d8a....0.tmp
- /data/data/####/bf574f8b22d19f36ea2b8ed2e5fa48c626686f14cb05051....0.tmp
- /data/data/####/c06e0ecaf09702df7f599e8e7d30db7348aed612ef10ae0....0.tmp
- /data/data/####/c1079afb2ba4d3e2a8bc32f2733cc1ca15309958cfc5c12....0.tmp
- /data/data/####/c2d1c9e225009951559ef4de5a6ca014
- /data/data/####/c32b1928572fa541a8abfc22fff27c7ecf6e16281c7e9ba....0.tmp
- /data/data/####/c32bc68570feec44f17d32e8712f88bb3d253e12e7adaeb....0.tmp
- /data/data/####/c402bc9ccc18b314727aa76a01f5a5d73ee0f81f1358620....0.tmp
- /data/data/####/c527dec5a480b6b6d4ed42f1def94813b1125c069df141f....0.tmp
- /data/data/####/c591bab2e74a214ced2231668e4de93e8e1fcc744a7de1b....0.tmp
- /data/data/####/c6fe8efd4b90a73213923a9af21f001862e6668b703d012....0.tmp
- /data/data/####/c798a4fbc364427cd733975297c34309
- /data/data/####/c79db6bbdcd41a7fa24f52b10152679a
- /data/data/####/cc7bce2947a81b5d3cb66b80b7f9bce10fcc06202ac8f6d....0.tmp
- /data/data/####/cd1d807af08d5584760f96bd4b7eab37
- /data/data/####/cd829bbb9d5c5f5ff6472cade6062ca4b9221d8f893e0fc....0.tmp
- /data/data/####/ce0a93c1b02d45481b670af84a4b9e7f1c5d6ecb7eac2df....0.tmp
- /data/data/####/ce81a52757eef80a9645f61e923f28d6be208d2dae57475....0.tmp
- /data/data/####/cec5c513df81db22f94a7f184ee0165f
- /data/data/####/ced50c4753b537d6677e8ac71fe38df6
- /data/data/####/cf9594c96b534618c2f994bc2de31356
- /data/data/####/cfcb56c84a69a49c7de7b3534ef0bc8f
- /data/data/####/com.deyi.meizi_preferences.xml
- /data/data/####/com.tencent.open.config.json.1105841576
- /data/data/####/d3702174e15c64a75f05446e3987cec651b9845168c5026....0.tmp
- /data/data/####/d61aac8ab0ce46015bd80093cd2c62c1
- /data/data/####/d71414fcb9896c4c7d1c1d40ca61b4aca22cad516fd7e4d....0.tmp
- /data/data/####/d9c084e834ad57b35bf3fdb2fa90c9fceda322910519e10....0.tmp
- /data/data/####/da281e2dc4cbd7131911b560b2c1f925ff3da1ad8565946....0.tmp
- /data/data/####/da36c7ded3f42ba47354d5f5c3f70ced
- /data/data/####/db1514d9bbcb0552ad2e975742d9767e65ec280ea52ce2f....0.tmp
- /data/data/####/ddce0670877b030cf2d8052d5b5d67ca
- /data/data/####/de87f401ad8376cf9b2532a0073b3bdbdb482e5402d48ff....0.tmp
- /data/data/####/device_id.xml.xml
- /data/data/####/df05f114fd30fb1dfa6de28853a1e237
- /data/data/####/dfb991ea473f61bab2cee42b909de968
- /data/data/####/e26fc95034b97e6a212215c28033c062b8014488d3e95e1....0.tmp
- /data/data/####/e3f210f765243b1329ce3fef6301b0d8
- /data/data/####/e50aa065fddd2d706afd104675b0917352970497a4c30ce....0.tmp
- /data/data/####/e6dc0ea0ff29a6129d95bc98380a20ca3d1d1249c1cbe78....0.tmp
- /data/data/####/e83eb3e60ba86ad85f027cb1fe87608c
- /data/data/####/e877aca4f1041c70fe16c653d7ce9a51
- /data/data/####/e99c153e564738bb8e3d18100a88e994f1f228198992627....0.tmp
- /data/data/####/e9ea2e98a5676cb8bce892f802ba80f9
- /data/data/####/eab49861fbba6236a1ad3e576410a910
- /data/data/####/eac3d1bc9ae7e9984281a26157f90ce5f9c502853255556....0.tmp
- /data/data/####/ef256918d16e717fba863c934c45bf07
- /data/data/####/f09bf1c3e085a5d5968c7a3c8c5ecfb836dfeb5155e8754....0.tmp
- /data/data/####/f10b2f3d83dc5176cc4a1d91365d4e3dc07c1145a7a4d3a....0.tmp
- /data/data/####/f1eaadb1076169b8a9c2bd7aac1e9f7b
- /data/data/####/f2c990d756c9266a856bc8a19129b9d4eaa4d167171ff97....0.tmp
- /data/data/####/f39cb8453a5116e4db133b4504983a1dfebb7f172ce4d96....0.tmp
- /data/data/####/f3f6d42bb1151f7764ec755413f48c2ff464e5eefde3389....0.tmp
- /data/data/####/f57c74a95c280a70a547f45b35e344e8
- /data/data/####/f706dfbac2f3a0a6424f464faf6fc979
- /data/data/####/f745b8280a1155cd50e28e75e7c3a8c7
- /data/data/####/f7bad6ea15c9c8ccd0864d9cfeed656b
- /data/data/####/f83d37fed71217cd99c2afbf2e101ace6f20810e9d4e447....0.tmp
- /data/data/####/f8d7473f8ee4f7b6465d4b9946a3e2d1075ff2f5e6e1ad2....0.tmp
- /data/data/####/fad1a695501de0f86eacbd4a7c4b0957
- /data/data/####/fccc7a0f288c310adcb5139f4c2da8bd
- /data/data/####/fd2c29c3fef820225f3098fa6b43a084ff3c19fe009cc0f....0.tmp
- /data/data/####/fd2dd4952402e2a19a31017b74794eba
- /data/data/####/fed33f79b67792287b1ed17a0eeac8df
- /data/data/####/ffe35cd27ce71e493cfb9b4569f370f5071460cd8abd7d6....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libjiagu.so
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/tdata_BAI450
- /data/data/####/tdata_BAI450.jar
- /data/data/####/tdata_YJA893
- /data/data/####/tdata_YJA893.jar
- /data/data/####/tencent_analysis.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/weibo_sdk_aid1
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.timestamp
- /data/media/####/app.db
- /data/media/####/com.deyi.meizi.bin
- /data/media/####/com.deyi.meizi.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/tdata_BAI450
- /data/media/####/tdata_YJA893
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.view.service.PushService 24380 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.view.service.PushService 24380 300 0
Загружает динамические библиотеки:
- MtaNativeCrash
- crash_analysis
- getuiext2
- libjiagu
- weibosdkcore
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
