Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.611.origin
- Android.Triada.440.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.611.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.50.63.227:8881
- TCP(HTTP/1.1) cid.r####.cn:80
- TCP(HTTP/1.1) r.ibit####.com:80
- TCP(HTTP/1.1) f####.caiji####.com:80
- TCP(HTTP/1.1) dn.tc####.com:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) en####.tui####.com:80
- TCP(HTTP/1.1) ac####.hu####.cn:80
- TCP(HTTP/1.1) 1####.75.142.89:80
- TCP(HTTP/1.1) acti####.russi####.cn:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) ny.bule####.cn:6601
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) app-t####.b0.upa####.com:80
- TCP(HTTP/1.1) k.zcul####.net:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) a.ibit####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
- TCP(HTTP/1.1) api.chen####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) w####.pcon####.com.cn:80
- TCP(HTTP/1.1) weiboi####.g####.sina####.com:80
- TCP(HTTP/1.1) a####.3gu.com:80
- TCP(HTTP/1.1) z####.heyc####.net:80
- TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
- TCP(HTTP/1.1) yun.russi####.cn.####.com:80
- TCP(HTTP/1.1) ny.bul####.cn:666
- TCP(HTTP/1.1) v3.bule####.cn:7001
- TCP(HTTP/1.1) pic.87g.com.####.com:80
- TCP(HTTP/1.1) s####.caiji####.com:666
- TCP(HTTP/1.1) 1####.26.106.206:8088
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) inf.bule####.cn:6101
- TCP(HTTP/1.1) d####.wos####.com:80
- TCP(TLS/1.0) hotfix####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) analy####.map.qq.com:443
- TCP(TLS/1.0) weiboi####.g####.sina####.com:443
- TCP(TLS/1.0) public-####.f####.myqc####.com:443
- TCP(TLS/1.0) ac####.hu####.cn:443
- TCP(TLS/1.0) s####.e.qq.com:443
- TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) aliyuns####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) dxp.b####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) sf3-ttc####.ps####.com:443
- TCP(TLS/1.0) down####.ydst####.com:443
- TCP(TLS/1.0) is.sn####.com:443
Запросы DNS:
- a####.3gu.com
- a####.b####.qq.com
- a####.u####.com
- a.ibit####.com
- ac####.hu####.cn
- acti####.russi####.cn
- aexcep####.b####.qq.com
- aliyuno####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- analy####.map.qq.com
- and####.b####.qq.com
- api.chen####.com
- app-t####.b0.upa####.com
- cid.r####.cn
- d####.wos####.com
- dn.tc####.com
- down####.ydst####.com
- dxp.b####.com
- en####.tui####.com
- ex####.sn####.com
- f####.caiji####.com
- h####.b####.com
- hm.b####.com
- hotfix####.oss-cn-####.aliy####.com
- i.sn####.com
- inf.bule####.cn
- is.sn####.com
- k.zcul####.net
- kua####.chen####.com
- log.sn####.com
- mi.g####.qq.com
- mt####.go####.com
- ny.bul####.cn
- ny.bule####.cn
- p####.87g.com
- p####.ugd####.com
- public-####.f####.myqc####.com
- pv.s####.com
- qzones####.g####.cn
- r.ibit####.com
- s####.caiji####.com
- s####.e.qq.com
- sf1-ttc####.ps####.com
- sf3-ttc####.ps####.com
- st####.ton####.net
- v3.bule####.cn
- w####.pcon####.com.cn
- wx2.sin####.cn
- yun.russi####.cn
- yun.tuis####.com
- z####.heyc####.net
Запросы HTTP GET:
- a.ibit####.com/c/_ii_?_=####
- a.ibit####.com/c/strawberry_sdk
- a.ibit####.com/e/i.html
- a.ibit####.com/e/i.js
- a.ibit####.com/update_ch/fruit/core.jar
- a.ibit####.com/update_ch/fruit/coreconfig.jar
- ac####.hu####.cn/Html/baoxiang-2/css/common.css
- ac####.hu####.cn/Html/baoxiang-2/css/hdgg.css
- ac####.hu####.cn/Html/baoxiang-2/css/reset.css
- ac####.hu####.cn/Html/baoxiang-2/css/swiper.min.css
- ac####.hu####.cn/Html/baoxiang-2/index.html?gameId=####&appkey=####&adhd...
- ac####.hu####.cn/Html/baoxiang-2/js/common.js?v=####
- ac####.hu####.cn/Html/baoxiang-2/js/jquery.min.js
- ac####.hu####.cn/Html/baoxiang-2/js/layer.js
- ac####.hu####.cn/Html/baoxiang-2/js/skin/default/layer.css?v=####
- ac####.hu####.cn/Html/baoxiang-2/js/swiper.min.js
- ac####.hu####.cn/Html/com.js?v=####
- ac####.hu####.cn/Html/fhtrue.js?v=####
- ac####.hu####.cn/Html/laohuji-2/css/alertcommon.css
- ac####.hu####.cn/Html/laohuji-2/css/common.css
- ac####.hu####.cn/Html/laohuji-2/css/hdgg.css
- ac####.hu####.cn/Html/laohuji-2/css/reset.css
- ac####.hu####.cn/Html/laohuji-2/css/swiper.min.css
- ac####.hu####.cn/Html/laohuji-2/images/myprize.png
- ac####.hu####.cn/Html/laohuji-2/images/rulewhile.png
- ac####.hu####.cn/Html/laohuji-2/images/tiggerguanbi.png
- ac####.hu####.cn/Html/laohuji-2/images/tiggerline.png
- ac####.hu####.cn/Html/laohuji-2/images/tiggerline1.png
- ac####.hu####.cn/Html/laohuji-2/images/tiggermusic.mp3
- ac####.hu####.cn/Html/laohuji-2/images/tiggershadow.png
- ac####.hu####.cn/Html/laohuji-2/images/tiggerstart.png
- ac####.hu####.cn/Html/laohuji-2/images/tiggeryinyue.png
- ac####.hu####.cn/Html/laohuji-2/index.html?gameId=####&appkey=####&adhdk...
- ac####.hu####.cn/Html/laohuji-2/js/common.js?v=####
- ac####.hu####.cn/Html/laohuji-2/js/jquery.min.js
- ac####.hu####.cn/Html/laohuji-2/js/layer.js
- ac####.hu####.cn/Html/laohuji-2/js/skin/default/layer.css?v=####
- ac####.hu####.cn/Html/laohuji-2/js/swiper.min.js
- ac####.hu####.cn/Html/laohuji-2/picture/tigger100.png
- ac####.hu####.cn/Html/laohuji-2/picture/tigger200.png
- ac####.hu####.cn/Html/laohuji-2/picture/tigger300.png
- ac####.hu####.cn/Html/laohuji-2/picture/tigger500.png
- ac####.hu####.cn/Html/laohuji-2/picture/tigger800.png
- ac####.hu####.cn/Html/laoyu-2/css/alertcommon.css
- ac####.hu####.cn/Html/laoyu-2/css/common.css
- ac####.hu####.cn/Html/laoyu-2/css/hdgg.css
- ac####.hu####.cn/Html/laoyu-2/css/reset.css
- ac####.hu####.cn/Html/laoyu-2/css/swiper.min.css
- ac####.hu####.cn/Html/laoyu-2/images/7e50a09f4e794c71812ceefe792c3ea8.gif
- ac####.hu####.cn/Html/laoyu-2/images/85205d8269d642bb8ba62e28ff278da8.gif
- ac####.hu####.cn/Html/laoyu-2/images/bg.jpg
- ac####.hu####.cn/Html/laoyu-2/images/chuan.png
- ac####.hu####.cn/Html/laoyu-2/images/f748aedfbef64e2ebbe412c91436179f.gif
- ac####.hu####.cn/Html/laoyu-2/images/fudai.png
- ac####.hu####.cn/Html/laoyu-2/images/gan.png
- ac####.hu####.cn/Html/laoyu-2/images/hands.png
- ac####.hu####.cn/Html/laoyu-2/images/libao100.png
- ac####.hu####.cn/Html/laoyu-2/images/libao200.png
- ac####.hu####.cn/Html/laoyu-2/images/libao70d.png
- ac####.hu####.cn/Html/laoyu-2/images/libaoxing.png
- ac####.hu####.cn/Html/laoyu-2/images/person.png
- ac####.hu####.cn/Html/laoyu-2/images/rule.png
- ac####.hu####.cn/Html/laoyu-2/images/start.png
- ac####.hu####.cn/Html/laoyu-2/images/title.png
- ac####.hu####.cn/Html/laoyu-2/images/wang.png
- ac####.hu####.cn/Html/laoyu-2/images/wdjiangpin.png
- ac####.hu####.cn/Html/laoyu-2/img/guan.png
- ac####.hu####.cn/Html/laoyu-2/index.html?gameId=####&appkey=####&adhdkey...
- ac####.hu####.cn/Html/laoyu-2/js/common.js
- ac####.hu####.cn/Html/laoyu-2/js/jquery.min.js
- ac####.hu####.cn/Html/laoyu-2/js/swiper.min.js
- ac####.hu####.cn/Html/laoyu-2/picture/guan.png
- ac####.hu####.cn/Html/public/common.css
- ac####.hu####.cn/hdgg?appkey=####&adhdkey=####&gameId=####
- ac####.hu####.cn/v1/ads/getAdSpaceRedRate/6caad40e3b734707d16afd83fa49e44a
- ac####.hu####.cn/v1/tongji
- ac####.hu####.cn/v1/tongji/authFh?t=####
- acti####.russi####.cn/activity/index?id=####&slotId=####&login=####&appK...
- api.chen####.com/adApi/appAd
- api.chen####.com/api/getCommentList?json=####
- api.chen####.com/api/getHzCat?json=SM####
- api.chen####.com/api/getHzList?json=####
- api.chen####.com/api/getHzRelateNews?json=####
- api.chen####.com/article/hz/4501
- app-t####.b0.upa####.com/apps/ad_word.json
- app-t####.b0.upa####.com/resource/img/1acad00b21ba12f28d1e146988ed2d11.jpg
- app-t####.b0.upa####.com/resource/img/1c46063712a238ea1675dd0e830aca9f.png
- app-t####.b0.upa####.com/resource/img/2692bdfbf7586c8fd9afc6837ed09bc9.jpg
- app-t####.b0.upa####.com/resource/img/b2d06d967604428e598d82be4f491039.png
- app-t####.b0.upa####.com/resource/img/b653292cd0633574e52df330e42a4023.png
- app-t####.b0.upa####.com/resource/img/c0188c2b95efeaab2f2e00f1f9ce9a5c.png
- app-t####.b0.upa####.com/resource/img/d666119ea30d577987e0848294d2fab0.png
- app-t####.b0.upa####.com/resource/img/d8197498ba76b476199473315f64d9f7.jpg
- app-t####.b0.upa####.com/resource/img/e7bb1afb73b1f11f70c6472c138fc053.png
- app-t####.b0.upa####.com/tdu/tdu_js_file.js?partner=####&appName=####&ev...
- dn.tc####.com/dnfile/shengjibao/NewVideoKernalApiTT1127_101.jar
- dn.tc####.com/dnfile/wmp/WG20181221145126.jar
- en####.tui####.com/index/activity?appKey=####&adslotId=####
- mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android03/js-release/1.1.0/nati...
- pic.87g.com.####.com/upload/2018/0720/20180720113423200.jpg
- pic.87g.com.####.com/upload/2019/0114/20190114112039401.jpg
- pic.87g.com.####.com/upload/2019/0114/20190114112051297.gif
- pic.87g.com.####.com/upload/2019/0116/20190116134645196.jpg
- pic.87g.com.####.com/upload/2019/0117/20190117092345797.jpg
- pic.87g.com.####.com/upload/2019/0117/20190117094646774.jpg
- r.ibit####.com/newsdk?t=####&h1=####&uid=####&c=####&v=####&up=####&n2=#...
- s####.tc.qq.com/gdt/0/DAAjyFzAUAALQABcBcZ9dvARIEIeMe.jpg/0?ck=####
- sf1-ttc####.ps####.com/img/mosaic-legacy/150960005ced5b764a279~cs_690x38...
- sf1-ttc####.ps####.com/img/mosaic-legacy/15a8f000726d67faa1472~noop.jpg
- sf1-ttc####.ps####.com/img/mosaic-legacy/16df40001cd45dcea2b08~cs_690x38...
- sf1-ttc####.ps####.com/img/mosaic-legacy/1a6ea0007574b78eb07c0~cs_690x38...
- sf1-ttc####.ps####.com/img/mosaic-legacy/1af50000267cbcb1f4ead~cs_690x38...
- sf1-ttc####.ps####.com/img/web.business.image/201902095d0de26fcc0bdd6647...
- sf3-ttc####.ps####.com/img/web.business.image/201902215d0d517b40b6632445...
- weiboi####.g####.sina####.com/img/mosaic-legacy/15c85000351f2f71488d7~no...
- yun.russi####.cn.####.com/h5-mami/activity/turnCircle/5.0/actBase_201809...
- yun.russi####.cn.####.com/h5-mami/insurance/taobao/clipboard.min.js
- yun.russi####.cn.####.com/newactivity/assets/actBase.438f9e66.js
- yun.russi####.cn.####.com/newactivity/assets/actBase.f98e33d6.css
- yun.russi####.cn.####.com/newactivity/assets/gyroscope.c2045079.js
- yun.russi####.cn.####.com/newactivity/assets/touchs.3bae3309.js
- yun.russi####.cn.####.com/newactivity/assets/turnCard-fs.3.0.f010f63c.css
- yun.russi####.cn.####.com/newactivity/assets/turnCard-fs.3.0.f03e95a5.js...
- yun.russi####.cn.####.com/tuia/hunter/hunter.js
Запросы HTTP POST:
- a####.3gu.com/index.php/mcBox/code?json=####
- a####.3gu.com/index.php/mcBox/js?json=####
- a####.3gu.com/index.php/mcBox/material?json=####
- a####.3gu.com/index.php/mcBox/save?json=####
- a####.3gu.com/index.php/mcBox/skin?json=####
- a####.u####.com/app_logs
- ac####.hu####.cn/v1/Statistics/getDeviceId
- ac####.hu####.cn/v1/Statistics/pv
- ac####.hu####.cn/v1/adv/getAd
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- cid.r####.cn/api3
- d####.wos####.com/upload/longheartbeat.jsp
- f####.caiji####.com/v3/task/mobile
- gdv.a.s####.com/cityjson
- inf.bule####.cn:6101/bPushPhone.aspx
- k.zcul####.net/vsdk/a/t
- ny.bul####.cn:666/api_yi.aspx
- ny.bul####.cn:666/slsdk/exrep.aspx
- ny.bul####.cn:666/slsdk/getdata.aspx
- ny.bul####.cn:666/slsdk/settings.aspx
- ny.bule####.cn:6601/slsdk/settings.aspx
- s####.caiji####.com:666/v1/config
- s####.e.qq.com/activate
- s####.e.qq.com/launch
- s####.e.qq.com/msg
- sf3-ttc####.ps####.com/service/2/app_log_exception/?openudid=####&versio...
- v3.bule####.cn:7001/v3/api_request.aspx
- v3.bule####.cn:7001/v3/api_settings.aspx
- v3.bule####.cn:7001/verrlog.aspx
- w####.pcon####.com.cn/ip.jsp
- z####.heyc####.net/getlist
- z####.heyc####.net/xlogin
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.c90e535f-48b7-4981-96e5-c1adf54b79aa
- /data/data/####/.dbcedefe-77c3-4799-b8cb-77e3fa88c2b2
- /data/data/####/.imprint
- /data/data/####/1550773474419
- /data/data/####/1hdjnrf3n7bn7uzhgs26bjih7
- /data/data/####/1hdjnrf3n7bn7uzhgs26bjih7.tmp
- /data/data/####/2276.yaqcookie
- /data/data/####/2778.yaqcookie
- /data/data/####/29a4137bd2ff30c1bb527f4810abf04ace7fe544e9b8755....0.tmp
- /data/data/####/2d49aa83bafc87f4e1c9375315c240f78b6bbccecb21e94....0.tmp
- /data/data/####/2k1z014d0mx4a9jh43tsnhhf4
- /data/data/####/2k1z014d0mx4a9jh43tsnhhf4.tmp
- /data/data/####/30f38ed52541f375febb33e3099b05466e9bc385bafeed4....0.tmp
- /data/data/####/38b1b312b10e823958a29c981773a9d79f238af8daa0aad....0.tmp
- /data/data/####/455c8ad5593a8358670d8568d3e34fcd92284a710037979....0.tmp
- /data/data/####/4cac59e7d4b2b6bb9b2b8cc205e208240ad5c0d28472bee....0.tmp
- /data/data/####/4cb2fa31c63b396281a3a67b2eb1052f865670837c4424b....0.tmp
- /data/data/####/4h9jbhsxk13bsted6gam28fty
- /data/data/####/4h9jbhsxk13bsted6gam28fty.tmp
- /data/data/####/65dca8e0d5988ed8fb3455292bb09ad44ed1a0e6547f98c....0.tmp
- /data/data/####/6nrk8d0f78y71jded4nvm00vi
- /data/data/####/6nrk8d0f78y71jded4nvm00vi.tmp
- /data/data/####/6umxiiqrqfal4v1a7vr0ufl2m
- /data/data/####/6umxiiqrqfal4v1a7vr0ufl2m.tmp
- /data/data/####/793459f1404ba432249b13c401aae79154afb9b15bbd31c....0.tmp
- /data/data/####/89798dd6365b8da0f09015071eb0153d54082936b34c7b7....0.tmp
- /data/data/####/8fbfbf54e9f8ece76ef6b044af2f25d1446894db929f01a....0.tmp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ApplicationCache.db-journal (deleted)
- /data/data/####/BM2QRh6.jar
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/JSON.xml
- /data/data/####/VideoRes.apk
- /data/data/####/YXBwX3NwZl9zY2xp.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__local_stat_full_cache.json
- /data/data/####/__send_data_1550773452631
- /data/data/####/__send_data_1550773474145
- /data/data/####/__send_data_1550773488547
- /data/data/####/__track_send_data_1550773488685
- /data/data/####/app_crash_copy.xml
- /data/data/####/b8130c9fe21865d2eec7855738c110062d3b9f66110f311....0.tmp
- /data/data/####/baidu_mtj_sdk_record.xml
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c20e622a68b41febdd311c3718a1469cc86b2101d6ae1a8....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/close.png
- /data/data/####/com.mojang.minecraftpetool_preferences.xml
- /data/data/####/com.mojang.minecraftpetool_preferences.xml.bak
- /data/data/####/config.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/default.xml
- /data/data/####/defaultpref1.xml
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/dexMethod.36117467.dat
- /data/data/####/downloader.db-journal
- /data/data/####/dpi
- /data/data/####/entry_ext2.xml
- /data/data/####/euo2dopyww1t3blriuhjs9aw
- /data/data/####/euo2dopyww1t3blriuhjs9aw.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/gdt_config.cfg
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_stat.db
- /data/data/####/gdt_stat.db-journal
- /data/data/####/gdt_suid
- /data/data/####/hid.db
- /data/data/####/idfeda2cc7-cca0-4d84-8adc-76017fffb4c2.tmp
- /data/data/####/ijse1yui2ntl37fhqnfa6odv
- /data/data/####/ijse1yui2ntl37fhqnfa6odv.tmp
- /data/data/####/index
- /data/data/####/jgh491xdblr0suexa1sje2jy
- /data/data/####/jgh491xdblr0suexa1sje2jy.tmp
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.1.2.so
- /data/data/####/libufix.so
- /data/data/####/libyaqbasic.36117467.so
- /data/data/####/libyaqpro.36117467.so
- /data/data/####/load_MTAwMF8xMjAxXzE0OTAwMTAw;.xml
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/native_record_lock
- /data/data/####/phoneuid.xml
- /data/data/####/prdopt.xml
- /data/data/####/read.db
- /data/data/####/read.db-journal
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/security_info
- /data/data/####/sh_name_interactive.xml
- /data/data/####/sp_config.xml
- /data/data/####/tdargs.xml
- /data/data/####/tmp7.xml
- /data/data/####/tmpbl.jar
- /data/data/####/tmpbl.jar_tmp
- /data/data/####/tools8977.xml
- /data/data/####/trace_circle.data
- /data/data/####/tt_sdk_settings.xml
- /data/data/####/ttopenadsdk.xml
- /data/data/####/ttopensdk.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_lc
- /data/data/####/videokernel.apk
- /data/data/####/videokernel.dex (deleted)
- /data/data/####/videonewyd_db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/xconfig.xml
- /data/data/####/xsdk_preference.xml
- /data/data/####/yaqsdkcookie
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.nid
- /data/media/####/.nomedia
- /data/media/####/.timestamp
- /data/media/####/190110haokanshipin24s1128.mp4
- /data/media/####/Videoshell.log
- /data/media/####/c.jar
- /data/media/####/c.jar.tm
- /data/media/####/cf.jar
- /data/media/####/cf.jar.tm
- /data/media/####/dec_c.jar
- /data/media/####/dec_cf.jar
- /data/media/####/engc.jar
- /data/media/####/hst2.sysa108ca61-3748-411f-aa05-4a141d63adb3.tmp
- /data/media/####/kernel.dat (deleted)
- /data/media/####/ks.db
- /data/media/####/ks.db-journal
- /data/media/####/tag2.datc73122bb-63a8-47f9-930b-219751496538.tmp
- /data/media/####/tmpbl.jar
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.1.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.display.id
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.letv.release.version
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.smartisan.version
- getprop ro.vivo.os.build.display.id
- getprop ro.vivo.os.version
- getprop ro.yunos.version
- logcat -d -v threadtime
- ls -l /dev
- ls -l /dev/block
- ls -l /dev/block/vold
- ls -l /dev/bus
- ls -l /dev/bus/usb
- ls -l /dev/bus/usb/001
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuctl/apps
- ls -l /dev/cpuctl/apps/bg_non_interactive
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/log
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ps
Загружает динамические библиотеки:
- Bugly
- crash_analysis
- libnfix
- libshella-2.9.1.2
- libufix
- libyaqbasic.36117467
- libyaqpro.36117467
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
