Adware.Gexin.6879

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) www.hisunfl####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) h####.opensp####.cn:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) hisunfl####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) d####.opensp####.cn:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.0) res####.a####.com:443
TCP c####.g####.ig####.com:5224
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
a####.u####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
c####.g####.ig####.com
c-h####.g####.com
d####.opensp####.cn
h####.opensp####.cn
hisunfl####.com
r####.wx.qq.com
res####.a####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
url.hisunfl####.com
www.hisunfl####.com

Запросы HTTP GET:

h####.opensp####.cn/launchconfig?t=####&p=ci5hc####
hisunfl####.com/mobile/index.php?act=####&op=####
hisunfl####.com/mobile/index.php?act=####&op=####&app=####
hisunfl####.com/mobile/index.php?act=####&op=####&area_id=####&
hisunfl####.com/mobile/index.php?act=####&op=####&curpage=####&page=####...
hisunfl####.com/mobile/index.php?act=####&op=####&gc_id=####&area_id=####&
hisunfl####.com/mobile/index.php?act=####&op=####&sc_id=####
s####.tc.qq.com/open/js/jweixin-1.2.0.js
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
t####.c####.q####.####.com/tdata_Bbr255
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_ntt510
ti####.c####.l####.####.com/config/hz-hzv3.conf
www.hisunfl####.com/appdown/
www.hisunfl####.com/appdown/imgs/1.png
www.hisunfl####.com/appdown/imgs/2.png
www.hisunfl####.com/appdown/imgs/3.png
www.hisunfl####.com/data/upload/shop/banner/05730558804100939.png
www.hisunfl####.com/data/upload/shop/banner/05730559127922719.png
www.hisunfl####.com/data/upload/shop/banner/05730559409882585.png
www.hisunfl####.com/data/upload/shop/banner/05730559677964949.png
www.hisunfl####.com/data/upload/shop/banner/05730682623172710.jpg
www.hisunfl####.com/data/upload/shop/banner/05743590134330938.jpg
www.hisunfl####.com/data/upload/shop/banner/05743590446170168.jpg
www.hisunfl####.com/data/upload/shop/banner/05743665238276436.jpg
www.hisunfl####.com/data/upload/shop/banner/05745266056041307.png
www.hisunfl####.com/data/upload/shop/banner/05749513756390120.png
www.hisunfl####.com/data/upload/shop/goods_class/05647444182606780.png
www.hisunfl####.com/data/upload/shop/goods_class/05647444395861027.png
www.hisunfl####.com/data/upload/shop/goods_class/05647444614976168.png
www.hisunfl####.com/data/upload/shop/goods_class/05647444764282341.png
www.hisunfl####.com/data/upload/shop/goods_class/05647445333936346.png
www.hisunfl####.com/data/upload/shop/goods_class/05647445533055588.png
www.hisunfl####.com/data/upload/shop/goods_class/05647445906754323.png
www.hisunfl####.com/data/upload/shop/goods_class/05647446145871158.png
www.hisunfl####.com/data/upload/shop/goods_class/05647446297287373.png
www.hisunfl####.com/data/upload/shop/goods_class/05654571277939076.png
www.hisunfl####.com/data/upload/shop/goods_class/05654571409529921.png
www.hisunfl####.com/data/upload/shop/goods_class/05654571583141765.png
www.hisunfl####.com/data/upload/shop/goods_class/05654572771889484.png
www.hisunfl####.com/data/upload/shop/goods_class/05654574570202748.png
www.hisunfl####.com/data/upload/shop/goods_class/05654574720084660.png
www.hisunfl####.com/data/upload/shop/goods_class/05654575240765907.png
www.hisunfl####.com/data/upload/shop/goods_class/05654575509147421.png
www.hisunfl####.com/data/upload/shop/goods_class/05654575639045961.png
www.hisunfl####.com/data/upload/shop/goods_class/05654590419956917.png
www.hisunfl####.com/data/upload/shop/goods_class/05666700669902328.png
www.hisunfl####.com/data/upload/shop/store/05663150708604724_sm.jpg
www.hisunfl####.com/data/upload/shop/store/store_04_yt.png
www.hisunfl####.com/favicon.ico
www.hisunfl####.com/m/js/jquery.min.js
www.hisunfl####.com/url.php

Запросы HTTP POST:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
hisunfl####.com/mobile/index.php?act=####&op=####
sdk.o####.p####.####.com/api.php?format=####&t=####
www.hisunfl####.com/mobile/index.php?act=####&op=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/1122132202785.55
/data/data/####/1122132202785.55 (deleted)
/data/data/####/1122132203298.98
/data/data/####/1122132203298.98 (deleted)
/data/data/####/1122132203323.53
/data/data/####/1122132203323.53 (deleted)
/data/data/####/1122132203361.25
/data/data/####/1122132203361.25 (deleted)
/data/data/####/1122132203459.47
/data/data/####/1122132203459.47 (deleted)
/data/data/####/1122132203562.2
/data/data/####/1122132203562.2 (deleted)
/data/data/####/1122132203646.81
/data/data/####/1122132203646.81 (deleted)
/data/data/####/1122132203887.61
/data/data/####/1122132203887.61 (deleted)
/data/data/####/1122132203920.71
/data/data/####/1122132203920.71 (deleted)
/data/data/####/1122132203997.02
/data/data/####/1122132203997.02 (deleted)
/data/data/####/1122132204078.27
/data/data/####/1122132204078.27 (deleted)
/data/data/####/1122132204131.95
/data/data/####/1122132204131.95 (deleted)
/data/data/####/1122132204329.61
/data/data/####/1122132204329.61 (deleted)
/data/data/####/1122132204416.01
/data/data/####/1122132204416.01 (deleted)
/data/data/####/1122132204569.64
/data/data/####/1122132204569.64 (deleted)
/data/data/####/1122132204624.44
/data/data/####/1122132204624.44 (deleted)
/data/data/####/1122132204730.7
/data/data/####/1122132204730.7 (deleted)
/data/data/####/1122132205587.91
/data/data/####/1122132205587.91 (deleted)
/data/data/####/1122132205721.93
/data/data/####/1122132205721.93 (deleted)
/data/data/####/1122132205781.9
/data/data/####/1122132205781.9 (deleted)
/data/data/####/1122132206385.69
/data/data/####/1122132206385.69 (deleted)
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/20220199544300e71ea07d73625fd351414c4e615142844....0.tmp
/data/data/####/261205854860.156
/data/data/####/261205854860.156 (deleted)
/data/data/####/261205855028.996
/data/data/####/261205855028.996 (deleted)
/data/data/####/261205855394.373
/data/data/####/261205855394.373 (deleted)
/data/data/####/261205855541.52
/data/data/####/261205855541.52 (deleted)
/data/data/####/261205855550.125
/data/data/####/261205855550.125 (deleted)
/data/data/####/261205855992.653
/data/data/####/261205855992.653 (deleted)
/data/data/####/261205856654.987
/data/data/####/261205856654.987 (deleted)
/data/data/####/261205856690.579
/data/data/####/261205856690.579 (deleted)
/data/data/####/261205856696.099
/data/data/####/261205856696.099 (deleted)
/data/data/####/261205856816.199
/data/data/####/261205856816.199 (deleted)
/data/data/####/261205856844.467
/data/data/####/261205856844.467 (deleted)
/data/data/####/261205856936.983
/data/data/####/261205856936.983 (deleted)
/data/data/####/261205856985.736
/data/data/####/261205856985.736 (deleted)
/data/data/####/261205857155.867
/data/data/####/261205857155.867 (deleted)
/data/data/####/261205857324.271
/data/data/####/261205857324.271 (deleted)
/data/data/####/261205857433.493
/data/data/####/261205857433.493 (deleted)
/data/data/####/261205857667.359
/data/data/####/261205857667.359 (deleted)
/data/data/####/261205857921.966
/data/data/####/261205857921.966 (deleted)
/data/data/####/261205858268.676
/data/data/####/261205858268.676 (deleted)
/data/data/####/261205858564.882
/data/data/####/261205858564.882 (deleted)
/data/data/####/424622777523.412
/data/data/####/424622777523.412 (deleted)
/data/data/####/424622777717.698
/data/data/####/424622777717.698 (deleted)
/data/data/####/424622777726.986
/data/data/####/424622777726.986 (deleted)
/data/data/####/424622777741.26
/data/data/####/424622777741.26 (deleted)
/data/data/####/424622777778.427
/data/data/####/424622777778.427 (deleted)
/data/data/####/424622777817.302
/data/data/####/424622777817.302 (deleted)
/data/data/####/424622777849.317
/data/data/####/424622777849.317 (deleted)
/data/data/####/424622777940.439
/data/data/####/424622777940.439 (deleted)
/data/data/####/424622777952.966
/data/data/####/424622777952.966 (deleted)
/data/data/####/424622777981.842
/data/data/####/424622777981.842 (deleted)
/data/data/####/424622778012.587
/data/data/####/424622778012.587 (deleted)
/data/data/####/424622778032.898
/data/data/####/424622778032.898 (deleted)
/data/data/####/424622778107.694
/data/data/####/424622778107.694 (deleted)
/data/data/####/424622778140.388
/data/data/####/424622778140.388 (deleted)
/data/data/####/424622778198.526
/data/data/####/424622778198.526 (deleted)
/data/data/####/424622778219.259
/data/data/####/424622778219.259 (deleted)
/data/data/####/424622778259.471
/data/data/####/424622778259.471 (deleted)
/data/data/####/424622778583.845
/data/data/####/424622778583.845 (deleted)
/data/data/####/424622778634.559
/data/data/####/424622778634.559 (deleted)
/data/data/####/424622778657.253
/data/data/####/424622778657.253 (deleted)
/data/data/####/424622778885.73
/data/data/####/424622778885.73 (deleted)
/data/data/####/5457f7e989faba36501d8297990629d74d86edeb44f8147....0.tmp
/data/data/####/71102869250753.0
/data/data/####/86da300e7b6ecddbc9e16fff3f7b055b5ee84731362467d....0.tmp
/data/data/####/880103668322.752
/data/data/####/880103668322.752 (deleted)
/data/data/####/880103668891.641
/data/data/####/880103668891.641 (deleted)
/data/data/####/880103670122.735
/data/data/####/880103670122.735 (deleted)
/data/data/####/880103670618.53
/data/data/####/880103670618.53 (deleted)
/data/data/####/880103670647.524
/data/data/####/880103670647.524 (deleted)
/data/data/####/880103672138.574
/data/data/####/880103672138.574 (deleted)
/data/data/####/880103674370.234
/data/data/####/880103674370.234 (deleted)
/data/data/####/880103674490.157
/data/data/####/880103674490.157 (deleted)
/data/data/####/880103674508.755
/data/data/####/880103674508.755 (deleted)
/data/data/####/880103674913.42
/data/data/####/880103674913.42 (deleted)
/data/data/####/880103675008.663
/data/data/####/880103675008.663 (deleted)
/data/data/####/880103675320.385
/data/data/####/880103675320.385 (deleted)
/data/data/####/880103675484.656
/data/data/####/880103675484.656 (deleted)
/data/data/####/880103676057.891
/data/data/####/880103676057.891 (deleted)
/data/data/####/880103676625.31
/data/data/####/880103676625.31 (deleted)
/data/data/####/880103676993.321
/data/data/####/880103676993.321 (deleted)
/data/data/####/880103677781.307
/data/data/####/880103677781.307 (deleted)
/data/data/####/880103678639.176
/data/data/####/880103678639.176 (deleted)
/data/data/####/880103679807.376
/data/data/####/880103679807.376 (deleted)
/data/data/####/880103680805.408
/data/data/####/880103680805.408 (deleted)
/data/data/####/8d38b47bed8e740a2989bf5900a71853eca1db4d4c032d2....0.tmp
/data/data/####/959aa53d393b3a134e5a01e3dc63eafac2bf65fe28b3264....0.tmp
/data/data/####/98842146513.4816
/data/data/####/98842146513.4816 (deleted)
/data/data/####/98842146577.372
/data/data/####/98842146577.372 (deleted)
/data/data/####/98842146715.633
/data/data/####/98842146715.633 (deleted)
/data/data/####/98842146771.3145
/data/data/####/98842146771.3145 (deleted)
/data/data/####/98842146774.5707
/data/data/####/98842146774.5707 (deleted)
/data/data/####/98842146942.0267
/data/data/####/98842146942.0267 (deleted)
/data/data/####/98842147192.6585
/data/data/####/98842147192.6585 (deleted)
/data/data/####/98842147206.1268
/data/data/####/98842147206.1268 (deleted)
/data/data/####/98842147208.2155
/data/data/####/98842147208.2155 (deleted)
/data/data/####/98842147253.6623
/data/data/####/98842147253.6623 (deleted)
/data/data/####/98842147264.3589
/data/data/####/98842147264.3589 (deleted)
/data/data/####/98842147299.3675
/data/data/####/98842147299.3675 (deleted)
/data/data/####/98842147317.8164
/data/data/####/98842147317.8164 (deleted)
/data/data/####/98842147382.1948
/data/data/####/98842147382.1948 (deleted)
/data/data/####/98842147445.9203
/data/data/####/98842147445.9203 (deleted)
/data/data/####/98842147487.2506
/data/data/####/98842147487.2506 (deleted)
/data/data/####/98842147575.7473
/data/data/####/98842147575.7473 (deleted)
/data/data/####/98842147672.0923
/data/data/####/98842147672.0923 (deleted)
/data/data/####/98842147803.2898
/data/data/####/98842147803.2898 (deleted)
/data/data/####/98842147915.3761
/data/data/####/98842147915.3761 (deleted)
/data/data/####/b0fec3dab54aeb6cf9e53437cee1346929410cf09910dd7....0.tmp
/data/data/####/b5f86a0e394dbbc3b117d7872ba4659d68244690f41bf87....0.tmp
/data/data/####/bugly_db_legu-journal
/data/data/####/c1da508a816bb9ea40e3f9fb1eb87037753c8bc9f7586e4....0.tmp
/data/data/####/c9dca8bea47582073c5c978a38084edfabaec703401719f....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.iflytek.id.xml
/data/data/####/com.iflytek.msc.xml
/data/data/####/d1ab46d34c30348ed3918d1c4dfd4995bb7be083a9a5499....0.tmp
/data/data/####/dbaed49aeed24c2156fb79fcf50e4c3c44680dc8a9145c9....0.tmp
/data/data/####/deff484ade09839ba318a52049ab8f2f72d8a1613b90796....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/help.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/ifly_launch_lib.xml
/data/data/####/iflytek_state_com.hisunflower.app.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libnfix.so
/data/data/####/libshella-2.10.7.1.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_Bbr255
/data/data/####/tdata_Bbr255.jar
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_ntt510
/data/data/####/tdata_ntt510.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/xUtils_http_cache.db
/data/data/####/xUtils_http_cache.db-journal
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/media/####/.nomedia
/data/media/####/003b9a05826d8def3f0d18368daa6369
/data/media/####/003b9a05826d8def3f0d18368daa6369.tmp
/data/media/####/01846166fe8865241d3496ae95e15e61
/data/media/####/01846166fe8865241d3496ae95e15e61.tmp
/data/media/####/01a543a684a22f4336f5ae65daebb137
/data/media/####/080f28b700d7252e0e99fdee22f33ca5
/data/media/####/080f28b700d7252e0e99fdee22f33ca5.tmp
/data/media/####/0ebe7c24e05df35c082e32fe93e336c5
/data/media/####/0ebe7c24e05df35c082e32fe93e336c5.tmp
/data/media/####/133468885dcbb89c1ab1dd015ef5ecbb
/data/media/####/133468885dcbb89c1ab1dd015ef5ecbb.tmp
/data/media/####/1545401650335.db
/data/media/####/1dfcce4a3cd536b1a64b4450b5bb2199
/data/media/####/2253307c7af9f6e346027a9ef68e5b7d
/data/media/####/3097b893bee68dedb193921e5f44ba8b
/data/media/####/35570a3c6d427f8e62cec33cf719dc36
/data/media/####/35570a3c6d427f8e62cec33cf719dc36.tmp
/data/media/####/3b8c7d20f5126d4d976be2d449055f08
/data/media/####/3b8c7d20f5126d4d976be2d449055f08.tmp
/data/media/####/3bfa00f90a6b9f9c3f3eddb14da7a4f6
/data/media/####/3bfa00f90a6b9f9c3f3eddb14da7a4f6.tmp
/data/media/####/486aaa9e68d5182b271dff9c99d2dd79
/data/media/####/4a41bbc44644e4d146bbd3ae17bbe4b7
/data/media/####/4d4f459c7dc2617e2198cbebe92e7236
/data/media/####/4d4f459c7dc2617e2198cbebe92e7236.tmp
/data/media/####/4dc438ae2e91d2053e84059b81b13738
/data/media/####/4dc438ae2e91d2053e84059b81b13738.tmp
/data/media/####/501f2877bd3f8d4736ea3abfec165775
/data/media/####/6757d7fef8f7a5c6cd6daf2ba95aaa90
/data/media/####/6bdd3ddd97df29cea8e8f4e0a7c01ad8
/data/media/####/71cda1f0323e4f972108e5c9c31b629e
/data/media/####/773c5458ea5e0108daec8346a07a7f3f
/data/media/####/7a327659f0f71e46a666c3e018e8f469
/data/media/####/8a5ca4183d09f2d33e45fc827e3ee2d6
/data/media/####/8a5ca4183d09f2d33e45fc827e3ee2d6.tmp
/data/media/####/8a79b4794b86487fc1bf0b944227f075
/data/media/####/90e66a1230e0bc0bbd99f361592f8baa
/data/media/####/90e66a1230e0bc0bbd99f361592f8baa.tmp
/data/media/####/93d1abaee9447471f027dd9306d49be8
/data/media/####/93d1abaee9447471f027dd9306d49be8.tmp
/data/media/####/a324643826e7753d1b723905f79dba9d
/data/media/####/a8792570b9624b5af8c55839fff12d49
/data/media/####/aee7e1784cce836c197ff4e4846abf2d
/data/media/####/aee7e1784cce836c197ff4e4846abf2d.tmp
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/b325fe6b62ef5c100c94165da70fc7de
/data/media/####/b325fe6b62ef5c100c94165da70fc7de.tmp
/data/media/####/b8395fd1d5e154bcd6566a32681062b5
/data/media/####/cbcd9e818e5d00ecb5c0774709bdc87e
/data/media/####/cbdd53d60dd859ec1fd912aa1d37d44a
/data/media/####/cbdd53d60dd859ec1fd912aa1d37d44a.tmp
/data/media/####/cc0813a12c61948275e07d7f2cf3b67c
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.hisunflower.app.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/d276912e92f4f63c1c372e420a5d4a5a
/data/media/####/d27a67a5764529f744590cf8c2c1a74b
/data/media/####/d27a67a5764529f744590cf8c2c1a74b.tmp
/data/media/####/d3bdd95f463ed14d2569a48d168be3c3
/data/media/####/d3bdd95f463ed14d2569a48d168be3c3.tmp
/data/media/####/df381196a8b10cabf7179536f480b7a8
/data/media/####/df381196a8b10cabf7179536f480b7a8.tmp
/data/media/####/e34f12b398d9ec7b51c068eaefed92cc
/data/media/####/e4bc412ebaedd2b4fbe303409b4901a7
/data/media/####/ff61b50f7d5528d4cfb591e68e33a21e
/data/media/####/ff61b50f7d5528d4cfb591e68e33a21e.tmp
/data/media/####/iflyworkdir_test
/data/media/####/tdata_Bbr255
/data/media/####/tdata_Soq141
/data/media/####/tdata_ntt510
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24938 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.7.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24938 300 0

Загружает динамические библиотеки:

Bugly
getuiext2
libnfix
libshella-2.10.7.1
libufix
msc
nfix
ufix
webpbackport

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней