Adware.Gexin.5223

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) pub-####.qin####.com:80
TCP(HTTP/1.1) c6.v.d####.####.com:80
TCP(HTTP/1.1) ap####.d####.36####.com:80
TCP(HTTP/1.1) sh####.360t####.com:80
TCP(HTTP/1.1) qos.l####.360.cn:80
TCP(HTTP/1.1) m3.s.3####.cn:80
TCP(HTTP/1.1) p0.q####.com:80
TCP(HTTP/1.1) api.k.36####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) s####.s.360.cn:80
TCP(HTTP/1.1) p1.q####.com:80
TCP(HTTP/1.1) ab####.m.s.####.cn:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) sdk.l####.360.cn:80
TCP(HTTP/1.1) p.s.3####.cn:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) p4.q####.com:80
TCP(HTTP/1.1) s####.l####.360.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) gd-s####.j####.cn:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) t####.j####.cn:443
TCP(TLS/1.0) dp.p####.dc.####.cn:443
TCP(TLS/1.0) sdkc####.e.360.cn:443
TCP(TLS/1.0) cc.p####.dc.####.cn:443
TCP(TLS/1.0) api####.me####.com:443
TCP(TLS/1.0) s####.j####.cn:443
TCP openj####.m.ta####.com:80
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226
TCP 2####.167.166.45:443
TCP ope####.m.ta####.com:443
TCP 1####.202.138.14:7011
UDP s.j####.cn:19000

Запросы DNS:

7j####.c####.z0.####.com
a####.man.aliy####.com
ab####.m.s.####.cn
ag####.m.ta####.com
amdc####.m.ta####.com
ap####.d####.36####.com
api####.me####.com
api.k.36####.com
c####.g####.ig####.com
c-h####.g####.com
c6.v.d####.####.com
cc.p####.dc.####.cn
dp.p####.dc.####.cn
gd-s####.j####.cn
m3.s.3####.cn
msg.umengc####.com
p.s.3####.cn
p0.q####.com
p1.q####.com
p1.q####.com
p4.q####.com
p6.q####.com
p7.q####.com
p8.q####.com
p9.q####.com
plb####.u####.com
pub-####.qin####.com
qos.l####.360.cn
s####.j####.cn
s####.l####.360.cn
s####.s.360.cn
s.j####.cn
sdk.c####.ig####.com
sdk.l####.360.cn
sdk.l####.360.cn
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sdkc####.e.360.cn
sh####.360t####.com
sis.j####.io
t####.j####.cn
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com

Запросы HTTP GET:

ab####.m.s.####.cn/abtest/cloud.so?appkey=####&dt=####&os=####&ov=####&m...
ap####.d####.36####.com/appconfig/accsconfig?appid=####&m=####&m2=####&c...
ap####.d####.36####.com/appconfig/getAbRole?os=####&time=####&sys=####&b...
ap####.d####.36####.com/appconfig/getpopup?appid=####&m=####&m2=####&ch=...
ap####.d####.36####.com/appconfig/main?m2=####&use_gear=####&appid=####&...
ap####.d####.36####.com/appconfig/updateInfo?os=####&time=####&sys=####&...
ap####.d####.36####.com/channel?bt_conf=####&m2=####&appid=####&m=####&c...
ap####.d####.36####.com/follow/authorUpdate?appid=####&maxOffset=####&m=...
ap####.d####.36####.com/video/list?svc=####&kw=####&os=####&ckw=####&sys...
ap####.d####.36####.com/video/list?svc=####&os=####&sys=####&direction=#...
ap####.d####.36####.com/video/play?id=####&m2=####&strategy=####&appid=#...
ap####.d####.36####.com/video/topicRelate?id=####&cdn_url=####&m2=####&s...
c6.v.d####.####.com/vod-qvod-duan-core-100105-beijing/165037625_2-154114...
p0.q####.com/dr/_100_70/t01871aa87b686d227c.jpg
p0.q####.com/dr/_100_70/t01de999c0ea795c9f9.jpg
p0.q####.com/dr/_100_70/t01df5c0938e19c6da8.jpg
p0.q####.com/video/568_320_70/t0136371f60d794519a.jpg
p0.q####.com/video/568_320_70/t01427a141996a47113.jpg
p0.q####.com/video/568_320_70/t015086f6c074d273fb.jpg
p0.q####.com/video/568_320_70/t0151fde99c190099ef.jpg
p0.q####.com/video/568_320_70/t015653d7a80283bda6.jpg
p0.q####.com/video/568_320_70/t015da61f659e4f4fd2.jpg
p0.q####.com/video/568_320_70/t015f63ff2a8b1ab361.jpg
p0.q####.com/video/568_320_70/t016090d3aff20b42fb.jpg
p0.q####.com/video/568_320_70/t01652dfd27ab425ac1.jpg
p0.q####.com/video/568_320_70/t0167945e6b278309be.jpg
p0.q####.com/video/568_320_70/t016a3fabde17231a9a.jpg
p0.q####.com/video/568_320_70/t016e3be96601b377fb.jpg
p0.q####.com/video/568_320_70/t01733aaf714e788ebd.jpg
p0.q####.com/video/568_320_70/t0178caa386d4ab5ad6.jpg
p0.q####.com/video/568_320_70/t0179dab89f6ae966b0.jpg
p0.q####.com/video/568_320_70/t01827d48da44babbd6.jpg
p0.q####.com/video/568_320_70/t018435ee403aef5f3b.jpg
p0.q####.com/video/568_320_70/t018836bfc8d4d74734.jpg
p0.q####.com/video/568_320_70/t018844cf917417a006.jpg
p0.q####.com/video/568_320_70/t01ad290c1b30cd1aab.jpg
p0.q####.com/video/568_320_70/t01b3d78b02f960c059.jpg
p0.q####.com/video/568_320_70/t01bb085be3939891e6.jpg
p0.q####.com/video/568_320_70/t01bbdcd7cc848f1a5f.jpg
p0.q####.com/video/568_320_70/t01c7a841dabab4cfb4.jpg
p0.q####.com/video/568_320_70/t01cac77ac205c97a2e.jpg
p0.q####.com/video/568_320_70/t01e8009e82b932d6ee.jpg
p0.q####.com/video/568_320_70/t01f403cd016d9518c9.jpg
p0.q####.com/video/568_320_70/t01f424407dd0856213.jpg
p0.q####.com/video/568_320_70/t01ff9c6572b724e003.jpg
p1.q####.com/dr/_100_70/t010a8f6d98c47eb238.jpg
p1.q####.com/dr/_100_70/t01141d5707c052ea20.jpg
p1.q####.com/dr/_100_70/t0121dfd0d385c2b373.jpg
p1.q####.com/dr/_100_70/t0125bab7eb0d49a001.jpg
p1.q####.com/dr/_100_70/t012cf12a08746d6e01.jpg
p1.q####.com/dr/_100_70/t013dc194c85839b11f.jpg
p1.q####.com/dr/_100_70/t01657339cad5eae71c.jpg
p1.q####.com/dr/_100_70/t01687f1714964696c4.jpg
p1.q####.com/dr/_100_70/t017c86889cbd6a27f5.jpg
p1.q####.com/dr/_100_70/t019fa967d111e61c70.jpg
p1.q####.com/dr/_100_70/t01ab20d238deb2550e.jpg
p1.q####.com/dr/_100_70/t01b04f7c2adfc38bbc.jpg
p1.q####.com/t012f19c91915672246.jpg
p1.q####.com/video/568_320_70/t0106ef8df744d19055.jpg
p1.q####.com/video/568_320_70/t01072e04dce8ea987e.jpg
p1.q####.com/video/568_320_70/t01128c93ec8784da7a.jpg
p1.q####.com/video/568_320_70/t0117d7e80cbd824883.jpg
p1.q####.com/video/568_320_70/t012ebca24f0e2a3869.jpg
p1.q####.com/video/568_320_70/t013244b0f21b3e8ea1.jpg
p1.q####.com/video/568_320_70/t01487bc4ac079b3775.jpg
p1.q####.com/video/568_320_70/t014e828c73758f2139.jpg
p1.q####.com/video/568_320_70/t01537a66a071b5d687.jpg
p1.q####.com/video/568_320_70/t0154be1e927508827a.jpg
p1.q####.com/video/568_320_70/t0169363c949ea6d073.jpg
p1.q####.com/video/568_320_70/t016d8adaa256e19a04.jpg
p1.q####.com/video/568_320_70/t017baf7149fb765d92.jpg
p1.q####.com/video/568_320_70/t017f9cf7de55c9a89f.jpg
p1.q####.com/video/568_320_70/t0193eb0d9e9aa0a6eb.jpg
p1.q####.com/video/568_320_70/t0199399a2c5967be00.jpg
p1.q####.com/video/568_320_70/t0199fde63296163007.jpg
p1.q####.com/video/568_320_70/t019a822d8a839e818a.jpg
p1.q####.com/video/568_320_70/t019f69da0667fa2343.jpg
p1.q####.com/video/568_320_70/t019fd19b78aef146f6.jpg
p1.q####.com/video/568_320_70/t01a704cd06f22baae5.jpg
p1.q####.com/video/568_320_70/t01b02cc021397b516c.jpg
p1.q####.com/video/568_320_70/t01b3886f0f7c0fb887.jpg
p1.q####.com/video/568_320_70/t01b455b642282dac4a.jpg
p1.q####.com/video/568_320_70/t01c022ccc62c10c117.jpg
p1.q####.com/video/568_320_70/t01c11d650fb74fb073.jpg
p1.q####.com/video/568_320_70/t01c3421a01fe535348.jpg
p1.q####.com/video/568_320_70/t01db4d3d85a21dc017.jpg
p1.q####.com/video/568_320_70/t01df342c40aafbd0c8.jpg
p1.q####.com/video/568_320_70/t01f6056aa995876dd6.jpg
p1.q####.com/video/568_320_70/t01ff8e76aa7f6e0609.jpg
p4.q####.com/dr/_100_70/t01e08868af1b764e84.jpg
p4.q####.com/t015e4d3da665ecc8b2.jpg
pub-####.qin####.com/tdata_EDT356
qos.l####.360.cn/vc.gif?&bid=####&pid=####&ver=####&c_ver=####&os=####&m...
s####.l####.360.####.com/Object.getFile/livecloudsdk/YW5kcm9pZF9wbHVnaW5...
s####.l####.360.####.com/Object.getFile/livecloudsdk/cGx1Z2luX2NyYXNocmV...
s####.s.360.cn/ak/6766aa2750c19aad2fa1b32f36ed4aee.html?m2=####
s####.s.360.cn/su/index.php?k=####&av=####&slv=####&sv=####&be=####&cv=#...
sdk.l####.360.cn/codec?os=####&tm=####&model=####&r=####&package=####&pi...
sdk.l####.360.cn/rtc?os=####&tm=####&model=####&r=####&package=####&pid=...
sdk.l####.360.cn/sdkconf/videoplace?sign=####&u=####&version=####&sdk_ve...
sdk.l####.360.cn/xinxiliu_tv_android_1000110001.conf?os=####&tm=####&r=#...
sh####.360t####.com/171122/c867c6e2f627a813302a3a0d0d891203/FZLTHK.TTF
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_jVg168
t####.c####.q####.####.com/tdata_pSF696

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
ap####.d####.36####.com/appconfig/getjarlist?appid=####&curEnv=####&forc...
ap####.d####.36####.com/video/feedback?appid=####&m=####&m2=####&ch=####...
ap####.d####.36####.com/video/feedback?appid=####&mode=####&m=####&m2=##...
ap####.d####.36####.com/video/feedback?from=####&appid=####&m=####&m2=##...
ap####.d####.36####.com/video/getSInfo?os=####&sys=####&m2=####&appid=##...
api.k.36####.com/k2/api/lockscreen/config?os=####&time=####&sys=####&bra...
c-h####.g####.com/api.php?format=####&t=####
m3.s.3####.cn/api/v1/newid
p.s.3####.cn/pstat/plog.php
p.s.3####.cn/update/update.php?p=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/2033145970-602345128
/data/data/####/2295b3f1-2526-47c9-b48c-ac485e31aa0c
/data/data/####/3061d97f-76ef-4dec-9a95-ee880ec82ceb
/data/data/####/50e87248-0a23-43e8-bc60-14d73111a7e5
/data/data/####/ACCS_BINDumeng;5bac46d6b465f5e752000489.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/AKTorchDownload.db-journal
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alliance.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/FZ.TTF
/data/data/####/LittleVideoHome-10-10-10001.jar
/data/data/####/LittleVideoHome.lock
/data/data/####/MENU_CACHE.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PendantConfig.xml
/data/data/####/PluginPullPush-10-10-10001.jar
/data/data/####/PluginPullPush.lock
/data/data/####/QHDeviceFile
/data/data/####/QHDeviceID.lock
/data/data/####/QH_DeviceSDK.xml
/data/data/####/QH_SDK_M2.xml
/data/data/####/QH_SDK_UserData6766aa2750c19aad2fa1b32f36ed4aee.xml
/data/data/####/QH_SDK_UserDatac8c41c4a18675a74e01c8a20e8a0f662.xml
/data/data/####/QH_SDK_sessionIDc8c41c4a18675a74e01c8a20e8a0f662.xml
/data/data/####/TAB_CACHE.xml
/data/data/####/Y29tLmZpc2gudmlkZW8=.tick.lock
/data/data/####/ab_test_config.xml
/data/data/####/abtest_base_sp_filenamec8c41c4a18675a74e01c8a20...62.xml
/data/data/####/accs.db-journal
/data/data/####/ad_config_file.xml
/data/data/####/agoo.pid
/data/data/####/android_player_20181123_214702_000.log_0
/data/data/####/android_player_20181123_214735_000.log_0
/data/data/####/appPackageNames_v2
/data/data/####/app_globel_config_file.xml
/data/data/####/app_globel_config_file.xml.bak
/data/data/####/app_globel_config_file.xml.bak (deleted)
/data/data/####/auth_guide_config_sdk.xml
/data/data/####/auth_guide_config_sdk.xml.bak
/data/data/####/banner.db-journal
/data/data/####/cache.ttf
/data/data/####/cbccbe32-8fa0-42a8-9c4c-c91a6981fce7
/data/data/####/channel_webview.db-journal
/data/data/####/cloud_config_file.xml
/data/data/####/cloud_config_file_back_up.xml
/data/data/####/cloud_config_status_file.xml
/data/data/####/cloud_push_config_file.xml
/data/data/####/cloud_switch_cache
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.fish.video_preferences.xml
/data/data/####/core_update
/data/data/####/core_update_locker
/data/data/####/crashreport_1.0.0.18052303.zip
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzMDA5NjI1ODY5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzMDA5NjU5NzE5;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTQzMDA5NjcwMDUw;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1NDMwMDk2NTk5NzU=;
/data/data/####/daemon_webview.db-journal
/data/data/####/dbfocus-journal
/data/data/####/dee8c1d18b39
/data/data/####/device_collector
/data/data/####/device_collector_locker
/data/data/####/download-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e94b6120-52c1-44d0-a497-519edd32b007
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/finalcore.jar
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/hotrizon_sharepref.xml
/data/data/####/http_cookie.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&1.0.1_1543009625503_envelope.log
/data/data/####/i==1.2.0&&1.0.1_1543009659649_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jpushservice_webview.db-journal
/data/data/####/libcrashAnalyser.so.tmp
/data/data/####/libjiagu777599888.so
/data/data/####/libjplayer.so.tmp
/data/data/####/liblocalserver.so.tmp
/data/data/####/libmyssl.so.1.1.tmp
/data/data/####/libtranscore.so.tmp
/data/data/####/libviewer.so.tmp
/data/data/####/light_sky_avast.xml
/data/data/####/localserver_2.0.6.18081503.zip
/data/data/####/locker
/data/data/####/log_reupload_task
/data/data/####/log_reupload_task_locker
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/msplugin_ksp.xml
/data/data/####/multidex.version.xml
/data/data/####/p.l
/data/data/####/player_20181123_214737_000.log_0
/data/data/####/player_record_2.0.6.18082901.zip
/data/data/####/plugin_com.qihoo.livecloud.settings.GPWebrtcSet...ef.xml
/data/data/####/plugin_multidex.version.xml
/data/data/####/plugin_qhvc_plugin.xml
/data/data/####/plugin_qihoo_jiagu_crash_report.xml
/data/data/####/plugin_sp.livecloud.database.xml
/data/data/####/plugin_torch_sdk_config.xml
/data/data/####/plugin_torch_sdk_config.xml.bak (deleted)
/data/data/####/plugin_v3_LittleVideoHome-10-10-10001.jar.lock
/data/data/####/plugin_v3_PluginPullPush-10-10-10001.jar.lock
/data/data/####/plugins_PACM.temp.xml
/data/data/####/profile_task
/data/data/####/profile_task_locker
/data/data/####/profile_torch_platform
/data/data/####/push.db-journal
/data/data/####/push.pid
/data/data/####/push_share.xml
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/run.pid
/data/data/####/safe_user_info_file.xml
/data/data/####/screen_conf.xml
/data/data/####/session_base_sp_filenameandroidID.xml
/data/data/####/session_base_sp_filenamec8c41c4a18675a74e01c8a2...62.xml
/data/data/####/share_data.xml
/data/data/####/sp_file_recommend_upload.xml
/data/data/####/sp_init.xml
/data/data/####/tab_request_name.xml
/data/data/####/tdata_jVg168
/data/data/####/tdata_jVg168.jar
/data/data/####/tdata_pSF696
/data/data/####/tdata_pSF696.jar
/data/data/####/tools_2.0.6.18082901.zip
/data/data/####/trans_20181123_214737_000.log_0
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/uninstall_apk
/data/data/####/uninstall_apk_locker
/data/data/####/videolist.db-journal
/data/data/####/waitingDown
/data/data/####/waitingDown_locker
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/-APF8Rn-11JWDr2TJxYGh4qNbPo.819973550.tmp
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.deviceId
/data/media/####/.iddata
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/.sfp
/data/media/####/.testf
/data/media/####/.umm.dat
/data/media/####/03e007ddf27d4da1b3f49238d8bc050c
/data/media/####/0LSXH180b-8zz4NYpKDk1RbZeQ0.1293237532.tmp
/data/media/####/0d53e358b7fd4e8aa10f1e1112af67d8
/data/media/####/0e5869fcc68d530e932057d554c8b678
/data/media/####/0t3zPO5H9kL_kRo9mK6LG44HNhI.1307609886.tmp
/data/media/####/14O3VJ6T4mhuoGiFjCfQAsCKotw.29464077.tmp
/data/media/####/1n7Zzcm8QFNOmQ_C08Cm7iH4KMQ.-1066724618.tmp
/data/media/####/1qk-Nqsv8Cp8dbwfF5Ay7HWCHmM.-1549853902.tmp
/data/media/####/2JLY8Nt5GwuATcgVGatY60Vvy5s.66872331.tmp
/data/media/####/2RRNGYj_TaxCkcZJTfbRXwDRGjY.-545848353.tmp
/data/media/####/2Tp4eUByNOqn2jL80xuH3dWKJTQ.1307609886.tmp
/data/media/####/2XdCC6VOfdQdh4-JowM5lw2p98Y.1516030644.tmp
/data/media/####/4nxajYR6zqNT2IuRpQWcCi9ihi0.-467872763.tmp
/data/media/####/56B2SW_CeKsVqkntPQ_FCu6_THk.129543726.tmp
/data/media/####/5PYSHc7bZACNdtzdtsH1gVyUIRA.-1572559654.tmp
/data/media/####/5rVaPBciohMgmSLDgwiqEf8PYN8.-1966165873.tmp
/data/media/####/6766aa2750c19aad2fa1b32f36ed4aee
/data/media/####/6W3Rl3VadnLm7kF_cpq37EbQ-BM.212765595.tmp
/data/media/####/8cvE3O1tzqPXW_Y29bg2-AVObyk.-861627172.tmp
/data/media/####/8x6RkStdsMTHorQ4XAAs6sz3qk0.-1135216642.tmp
/data/media/####/9fd65ujds5L-MntNZevxnt1MQSY.-467872763.tmp
/data/media/####/9uU0qKTGJqTss3rYyrphxeq643Q.-539324494.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/E2HVFmuJOSWLpF0Rd0DHKMugUpI.-1727750872.tmp
/data/media/####/ENdqrcecgqz4lsVsAK8I-c7wt_I.356572012.tmp
/data/media/####/FHESOVb6ueiT8KK3cnskSZrn4vY.-2000141690.tmp
/data/media/####/FW8ZALi6VBQNWZyykqgU7I1VKXM.2119287418.tmp
/data/media/####/GJdaAPlja9Dr8MfaSpt1wP5DIvs.129543726.tmp
/data/media/####/GuTMRt9rKHVjykOs67mQFvHeo4Q.-1527456782.tmp
/data/media/####/IpLx8EqP0oDm50DFi6de_8elsrk.1293237532.tmp
/data/media/####/LE9R33izoB41UE9lT_xqS8qVg_M.2119287418.tmp
/data/media/####/LJZ0MvVIC9jvcHR4PCthNfwlcoc.-928044176.tmp
/data/media/####/N-KxrwX0ROaWc0wEWTJcOoAxSF0.-1277204178.tmp
/data/media/####/OkvFwGjrinxxjLk9svuPMjuTRag.1813599794.tmp
/data/media/####/PQekGepAkHuu4lVaONNQMU12YGA.29464077.tmp
/data/media/####/RQKpijr74KMBQdoO6fVcGiaKJpY.492496951.tmp
/data/media/####/RZTJ2gr0_2ix-ykOKIWsy2cZfAM.-1527456782.tmp
/data/media/####/Rd3
/data/media/####/Rd3 (deleted)
/data/media/####/S0udL37lDv_e5I7tvcP8j92ihmk.1377539440.tmp
/data/media/####/SA7O0biB3s_dA6ibtKawDZpFXrU.-13139814.tmp
/data/media/####/SAg-gfdFbRh8Z_wATpr_XsqdxsE.-431172322.tmp
/data/media/####/TGpPAwcTluwCQyA1xjWCKUdESMM.-99070507.tmp
/data/media/####/TJP5ZB5pTT1XGIcSObOL8aVuxE4.-1135216642.tmp
/data/media/####/UeT2YqzdMpifK2CVQ8COUEZkptc.66872331.tmp
/data/media/####/UuAJ4nNBPNZeY9nVhRcO6dbHgGE.-1966165873.tmp
/data/media/####/VSw7r2q3ho5uHv_FtJM3oBQydog.492496951.tmp
/data/media/####/VdNjuZmqMoXYv5HIyDYw7wY4csg.1433381338.tmp
/data/media/####/WtbgquXw7r4SdULMMfzdhapOdkk.848520671.tmp
/data/media/####/XLjIBs4MiT6XZzfbghAxa0RhP70.-861627172.tmp
/data/media/####/Y29tLmZpc2gudmlkZW8=
/data/media/####/Y29tLmZpc2gudmlkZW8= (deleted)
/data/media/####/Z8x0Hh6p8smUNY6-uJrUWZ8E-As.-1277204178.tmp
/data/media/####/__VERSION__
/data/media/####/app.db
/data/media/####/avast_done
/data/media/####/azwMcSTnfdbkpVxRtEI-dKAM71Y.1410566423.tmp
/data/media/####/b92a646b5bdd404f96ebacb150ee494e
/data/media/####/bZWgXOQ_E-nEg_zNRMg5NZaDsvI.-1446540441.tmp
/data/media/####/c8c41c4a18675a74e01c8a20e8a0f662
/data/media/####/cHsLUB31q6CEUyhqIOZy5SQn51Q.1516030644.tmp
/data/media/####/com.fish.video.bin
/data/media/####/com.fish.video.db
/data/media/####/com.fish.video_last_crash.log
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/config
/data/media/####/config.lock
/data/media/####/d0f8b174cff44765a7d5e772309f699a
/data/media/####/data.lock
/data/media/####/deviceToken
/data/media/####/doBelCW-Ivd4I3rPAWl2nUwY-V4.848520671.tmp
/data/media/####/e211YW1c0u2lmZEgX-Imy3gVmpY.241848607.tmp
/data/media/####/e8b83da1287f43dba0fb35371181a93a
/data/media/####/f9f77530681e475690c7715531e0b8e2
/data/media/####/gT5sEwl-_CFxX_u1VViqQaZLZ0Y.-1446540441.tmp
/data/media/####/hN_XrZ54U4d2To4pERK4Vz5bUPU.-539324494.tmp
/data/media/####/hjNDKMuDYwpnoiMG27kU9Rnpj1Q.241848607.tmp
/data/media/####/j4oNeXvENxvAKV87APaUGaZwqK4.-1066724618.tmp
/data/media/####/jHAcXDw29e2q1VR1qrfyTZ1SwAY.1410566423.tmp
/data/media/####/j_C-crljzBX-SDNZuguFeaC2_TE.-1549853902.tmp
/data/media/####/kBJ5AXbtz2Iv1MaoZUIK-h0ieI4.-1727750872.tmp
/data/media/####/kFSjfc7NJC-kLYvCuQVjHF6Q-4U.819973550.tmp
/data/media/####/lp555PXQD-RSTBheYacW3QZEMYE.541291666.tmp
/data/media/####/mXZ7Dj1NwdzglcEt2t12-ZP4dRE.-431172322.tmp
/data/media/####/n6r
/data/media/####/n6r (deleted)
/data/media/####/o_vR6LecdB-UbIjI-Nd6YdZAHkM.-1205042740.tmp
/data/media/####/ogm
/data/media/####/ogm (deleted)
/data/media/####/pSOdHx8JaDp7_7rlL1qnkus7jDw.212765595.tmp
/data/media/####/pYOs5oGB8mS7gAE0e2jUvLn6zRM.356572012.tmp
/data/media/####/pr-S8Mz_VZFhmGDiZo_rFuzT-mU.2134974388.tmp
/data/media/####/pvuy1c13lxdfchVZ1yRt0VxHAis.-1205042740.tmp
/data/media/####/q0MuYZCReFK_0pMtlmNrVpB4K1Q.-1572559654.tmp
/data/media/####/qee8vxXkey0364V3cZyGJVfQVuI.1377539440.tmp
/data/media/####/quL
/data/media/####/quL (deleted)
/data/media/####/report.lock
/data/media/####/rsKjgYvUZHcmrEtpWrd-s35BbmY.-1261723378.tmp
/data/media/####/s5Y
/data/media/####/s5Y (deleted)
/data/media/####/sysid.dat
/data/media/####/tS9lSzWqQTsP7gu35UvZWxFfAW0.-2000141690.tmp
/data/media/####/tdata_jVg168
/data/media/####/tdata_pSF696
/data/media/####/test.log
/data/media/####/uRM1Ar6qiSvP8dekue5QcmH8OYg.1433381338.tmp
/data/media/####/uninstall_apk_list
/data/media/####/uqo
/data/media/####/uqo (deleted)
/data/media/####/uwOa6xdwTdshTezjkYnILeK8NYA.-545848353.tmp
/data/media/####/w8Vz72bh_PQHPoreC_wMjbNxens.-928044176.tmp
/data/media/####/wFIJpfjTt2c8DsxaoCSd7cxUa0U.1813599794.tmp
/data/media/####/wFY9wvDPDRJKiyY8clEpmyvBSDM.-13139814.tmp
/data/media/####/weg815naB3UACJood0GQE25aiHI.2134974388.tmp
/data/media/####/ydE893e4q8g6mgeA0VeJmb3STi4.-99070507.tmp
/data/media/####/ynMX5ph1NhrDQoxf0WUspEB6OrU.-1261723378.tmp
/data/media/####/z5_Moy04OP_J2dVZS7FYB4iOboE.541291666.tmp

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/xbin/which su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5bac46d6b465f5e752000489","utdid":"W/h1TeHP84YDAGdzx1EfjthF","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24372 300 0
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu777599888.so
ls /sys/class/thermal
mount
ps
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24372 300 0

Загружает динамические библиотеки:

crashAnalyser
getuiext2
jcore125
libcrashAnalyser
libimagepipeline
libjiagu777599888
libjplayer
liblocalserver
libtranscore
libviewer
log4a-lib
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
DES

Использует повышенные привилегии.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Получает информацию о привязанных к устройству аккаунтах (Google, Facebook и т. д.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней