Android.RemoteCode.3446

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.RemoteCode.127.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.b####.qq.com:8012
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) api.won####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.map.b####.com:80
TCP(HTTP/1.1) a####.b####.qq.com:8011
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) api.s####.com:443
TCP(TLS/1.0) o####.map.b####.com:443
TCP(TLS/1.0) loc.map.b####.com:443
TCP(TLS/1.0) gd-s####.j####.cn:443
TCP(TLS/1.0) 1####.217.17.110:443
TCP(TLS/1.0) t####.j####.cn:443
TCP 43.2####.88.82:7007
UDP s.j####.cn:19000
UDP easytom####.com:19000

Запросы DNS:

a####.b####.qq.com
a####.exc.mob.com
aexcep####.b####.qq.com
ali-s####.j####.cn
and####.b####.qq.com
api.map.b####.com
api.s####.com
api.won####.com
easytom####.com
gd-s####.j####.cn
img.won####.com
loc.map.b####.com
mt####.go####.com
o####.map.b####.com
plb####.u####.com
s.j####.cn
sis.j####.io
t####.j####.cn
u####.u####.com

Запросы HTTP GET:

api.map.b####.com/sdkproxy/v2/lbs_androidsdk/place/v2/search?query=####&...
ti####.c####.l####.####.com/userfiles/image/20180804/0415170446fb01b7b25...
ti####.c####.l####.####.com/userfiles/image/20180815/15180341a1ef7e3a9d8...
ti####.c####.l####.####.com/userfiles/image/20180929/29164928bf7f7632937...
ti####.c####.l####.####.com/userfiles/image/20180930/30113133a66e28e2e15...
ti####.c####.l####.####.com/userfiles/image/20181008/081448446ad3f419092...
ti####.c####.l####.####.com/userfiles/image/20181128/28141204853dbb75eb2...
ti####.c####.l####.####.com/userfiles/image/20181203/0313485626e3d572494...
ti####.c####.l####.####.com/userfiles/image/20181213/131456201a1a3062aa7...
ti####.c####.l####.####.com/userfiles/image/20181213/13150758a2eb23ae290...
ti####.c####.l####.####.com/userfiles/image/20181218/1816545941459c21684...
ti####.c####.l####.####.com/userfiles/image/20181220/20103707c8a963180e2...
ti####.c####.l####.####.com/userfiles/image/20181220/20110044000a73149a8...
ti####.c####.l####.####.com/userfiles/image/20190105/0513563769b47cbaa32...
ti####.c####.l####.####.com/userfiles/image/20190105/05135644293b4a6a480...
ti####.c####.l####.####.com/userfiles/image/20190105/0513565121595e93a66...
ti####.c####.l####.####.com/userfiles/image/20190105/051356585ba6153dc44...
ti####.c####.l####.####.com/userfiles/image/20190107/07175349571b96fdb09...
ti####.c####.l####.####.com/userfiles/image/20190107/0717594602f654b7b43...
ti####.c####.l####.####.com/userfiles/image/20190214/14102145e766906f552...
ti####.c####.l####.####.com/userfiles/image/20190214/14102902c719c212453...
ti####.c####.l####.####.com/userfiles/image/20190214/141049286bc792eded4...
ti####.c####.l####.####.com/userfiles/image/20190214/14105611992dfba00e9...
ti####.c####.l####.####.com/userfiles/image/20190214/14105742995edac4a15...
ti####.c####.l####.####.com/userfiles/image/20190214/141110186a5688aa930...
ti####.c####.l####.####.com/userfiles/image/20190214/14111924be523901a27...
ti####.c####.l####.####.com/userfiles/image/20190214/141135170271178a5a6...
ti####.c####.l####.####.com/userfiles/image/20190215/15142529dfd441ac592...
ti####.c####.l####.####.com/userfiles/image/20190220/201119364b17bed9a95...
ti####.c####.l####.####.com/userfiles/images/1lajaqcxyr41lajaqcxyr4.jpg
ti####.c####.l####.####.com/userfiles/images/4b04rgoskot4b04rgoskot.jpg
ti####.c####.l####.####.com/userfiles/images/a5mbp0odr35a5mbp0odr35.jpg-...
ti####.c####.l####.####.com/userfiles/images/aog35ru1he0aog35ru1he0.jpg
ti####.c####.l####.####.com/userfiles/images/ch2xvrkwsd2ch2xvrkwsd2.jpg
ti####.c####.l####.####.com/userfiles/images/cov1aihql3dcov1aihql3d.jpg
ti####.c####.l####.####.com/userfiles/images/d0vq5jjqzeod0vq5jjqzeo.jpg-...
ti####.c####.l####.####.com/userfiles/images/ggqsucvn4rhggqsucvn4rh.jpg
ti####.c####.l####.####.com/userfiles/images/j3jh1qvg0ngj3jh1qvg0ng.jpg
ti####.c####.l####.####.com/userfiles/images/jwss0fgmcdmjwss0fgmcdm.jpg
ti####.c####.l####.####.com/userfiles/images/jzpsvxjkemkjzpsvxjkemk.jpg
ti####.c####.l####.####.com/userfiles/images/k3njlxefuybk3njlxefuyb.jpg-...
ti####.c####.l####.####.com/userfiles/images/mghpg02cx3amghpg02cx3a.jpg
ti####.c####.l####.####.com/userfiles/images/mspxmopxv4nmspxmopxv4n.jpg
ti####.c####.l####.####.com/userfiles/images/ouiuftj5wevouiuftj5wev.jpg-...
ti####.c####.l####.####.com/userfiles/images/oujrpjrtnsgoujrpjrtnsg.jpg
ti####.c####.l####.####.com/userfiles/images/wwfozdllyo3wwfozdllyo3.jpg
ti####.c####.l####.####.com/userfiles/images/x100cb44uujx100cb44uuj.jpg
ti####.c####.l####.####.com/userfiles/images/x100cb44uujx100cb44uuj.jpg-...
ti####.c####.l####.####.com/userfiles/images/xv3kfukbev2xv3kfukbev2.jpg-...
ti####.c####.l####.####.com/userfiles/images/zwp41rvevwezwp41rvevwe.jpg

Запросы HTTP POST:

a####.b####.qq.com:8011/rqd/async
a####.b####.qq.com:8012/rqd/async
a####.exc.mob.com/errconf
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
api.won####.com/api/v1/developer/brands?area_id=####
api.won####.com/api/v1/houses/detail?houses_id=####&api_token=####
api.won####.com/api/v1/houses/pictures?houses_id=####
api.won####.com/api/v1/houses/search?area_id=####&page=####
api.won####.com/api/v1/houses/search?keyword=####&sort_column=####&sort=...
api.won####.com/api/v1/houses/similar?houses_id=####
api.won####.com/api/v1/planner?page=####&area_id=####&api_token=####
api.won####.com/api/v1/public/acreage/list
api.won####.com/api/v1/public/app/version?type=####
api.won####.com/api/v1/public/areas
api.won####.com/api/v1/public/areas/business?area_id=####
api.won####.com/api/v1/public/broadcast
api.won####.com/api/v1/public/feature/list?area_id=####
api.won####.com/api/v1/public/house/price/list?area_id=####
api.won####.com/api/v1/public/house/types
api.won####.com/api/v1/public/sale/status/list
api.won####.com/api/v1/public/slide?area_id=####
api.won####.com/api/v1/public/type/list
api.won####.com/api/v1?area_id=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1106445582
/data/data/####/-1115058732
/data/data/####/-1421164408
/data/data/####/-1821612606
/data/data/####/-569690973
/data/data/####/-889919583
/data/data/####/-890492684
/data/data/####/.duid
/data/data/####/.imprint
/data/data/####/.lock
/data/data/####/.vpl_lock
/data/data/####/04d8a1971901a1abb7bc5b45cb1d0736b3b9c9b766ee7a5....0.tmp
/data/data/####/08ff28255f6d6843dda1cedf20411baf08448251742aa28....0.tmp
/data/data/####/092413a9d4305a3f33cf8fab07d951bd5b6926e122e54d2....0.tmp
/data/data/####/0b0e502b37cd1f61dde1032b299490d9e7314ddfad9da16....0.tmp
/data/data/####/0d3eebd119da31041282e88182809b4fac74c70a50169e2....0.tmp
/data/data/####/0e5aca7d0a560d7e1abc3c802c0623b1c644a120718dec8....0.tmp
/data/data/####/1004
/data/data/####/108880ffeb9b2e66db52cd9a116280847a47180ff88aece....0.tmp
/data/data/####/109526449
/data/data/####/1112798511
/data/data/####/14a504d3-b9f4-4ee4-b536-5a0a4caa9f4c
/data/data/####/1990137437
/data/data/####/1c3129d2-f48d-4612-85b1-46d5d85d8fca
/data/data/####/1c431a54b8175e4bbfc46bb6f015d500db3ca9be6b25aa6....0.tmp
/data/data/####/1e8583a11e94816731ce69259e1f3a87eb75b3ee03f6923....0.tmp
/data/data/####/1ecbe4e648149171af732453d8fe1f754b4d991a8f012f7....0.tmp
/data/data/####/1f62b07bf5722321b874273a6fedb00c49f86e8e513a76b....0.tmp
/data/data/####/236e0cfdc225b6737238d163dcc8108b6fcfc74bc16fa95....0.tmp
/data/data/####/26422a93247ce3af73ea19467f1778818dbb950a4c93162....0.tmp
/data/data/####/2688e2ef35acd0a8da63e9a9962b3d5976a799e9e0caa41....0.tmp
/data/data/####/2854706727592899b5928d546be2dc6d7f6ed65276c2f61....0.tmp
/data/data/####/299d53f7bdb97bbc963b0e1ff2f3a9319f53780a007b864....0.tmp
/data/data/####/2b2fbd6193feabb7c08a5fe65e50df144c05a56ef109599....0.tmp
/data/data/####/2dada1c500864b21b81c39a58aab1d003e453f3807e81af....0.tmp
/data/data/####/30326494e9d14726ee732291f64035a676566b36f33575c....0.tmp
/data/data/####/30ad81b7ab999c61869116c405e983c7fec12d0ecc52017....0.tmp
/data/data/####/31171cf1fc5c45fd1635c4021759cca2e1a912a68f3a097....0.tmp
/data/data/####/32b14fe831fe172a254ce84e3eb34e60a9f12cabc1857b3....0.tmp
/data/data/####/3315bea6b28e2ed37e3c2a8077ef59e78856dd2749347ae....0.tmp
/data/data/####/3c90326f06cf36b7b14d282f7280789deda00cbc04a1896....0.tmp
/data/data/####/403a92b2823f197d3f39921cc1cd9c8a3d577ecf09f0c8d....0.tmp
/data/data/####/40d67761aa19ebcaa730e449df39c07fea7b83204014c61....0.tmp
/data/data/####/430f460a9e5d9616045d9fff0e1c17d6aff9d153578b5f7....0.tmp
/data/data/####/444ccd9528ae8ece2e1655a1c4b80938322306cc3913b0b....0.tmp
/data/data/####/467fc34cfb364daf1aa3d96dfb4bc0aabbe81e257708720....0.tmp
/data/data/####/4a901f765f2fa6127596cb46b4364eb3b8ea85255c7d9af....0.tmp
/data/data/####/4b2ff10f2ebec92f5fbf897598f788c83726f933de305a7....0.tmp
/data/data/####/4c02b80b54ee56c6caa94d8152419f41193c05d784fdbea....0.tmp
/data/data/####/4c1ee4def93ee7aa300a49b9fc3b44584cd7532f30b823f....0.tmp
/data/data/####/50a3029effc0a73d7a5958463e2a49fce1fa520a1ce87d3....0.tmp
/data/data/####/5229bb075eb9a407b568d5b1ba8d26319c50446e00c1770....0.tmp
/data/data/####/52faa38e71534b7de3cfce23bbfd3af4d76a493a67908e6....0.tmp
/data/data/####/5526398fccb1d609b6ee73ee126c3576af5a3a49eb51bca....0.tmp
/data/data/####/5b911cdff3f4cf5e2871748b2c578cc2817cb2bd74c7b51....0.tmp
/data/data/####/5f76d888269315fff6f65ceb99cda5c792f0214305fed0b....0.tmp
/data/data/####/604d9cdd978b8f0bfb59c5c198f1a3f482ba1e2ea961764....0.tmp
/data/data/####/64ebb501b25520f8142419cb3fe2757a953862868f0465b....0.tmp
/data/data/####/667ad21b52bb1921a62d44612a396f763cdf34099f30ddb....0.tmp
/data/data/####/669066272
/data/data/####/6989e2cc5806781ccd42096f6ed27a001769770c2069e60....0.tmp
/data/data/####/6bee679e63f788dd306a15527f303dbabfc40412d4e8658....0.tmp
/data/data/####/700f417d20271fdefcd5b9fe6387676db547a3edef85f5d....0.tmp
/data/data/####/70ad60394b041d86ad79c2789116a48d6bc6b6391a95041....0.tmp
/data/data/####/79334a0c341c036a1f1a75186fd66624bb603d948988642....0.tmp
/data/data/####/797aba086e0031d07dfdbec92c83010b0bd6af9461b9212....0.tmp
/data/data/####/7aac72fea4238f56b283298d526adfb5dba8fd1ccb4cfcb....0.tmp
/data/data/####/7bdfd86f5526c68d8cd5668927c63e0b3842dd35173da75....0.tmp
/data/data/####/7c01c7cdcfc2cd60f3d611d4f10d5822da93cec2caeb68f....0.tmp
/data/data/####/7e48c0ecb45af5e0029fd74fd65f56cdafea53dd80ff4b2....0.tmp
/data/data/####/7efdff2614c7a782ce9b6a3dd4f1567e4c91d247d511b7b....0.tmp
/data/data/####/82050c5e6f47f3db7deba259febd28831e53000b38f3b5e....0.tmp
/data/data/####/82890498f7bba116d02c7856da3d223e75ce747595f64c0....0.tmp
/data/data/####/852efc5ecf0583005303a67ff01bedacfbf7d20f630ac9f....0.tmp
/data/data/####/8806c69af08dd91cb1f44997afea3f55b71372dfe48b167....0.tmp
/data/data/####/88523df151ced31ce17114a9ede0fa64011d6784e5dc61a....0.tmp
/data/data/####/8b433d0d5b36c4b7d850d294210de90cea4ac125d74ad30....0.tmp
/data/data/####/8d8d7bd3599171344345605a89a892e52ca30268209ef02....0.tmp
/data/data/####/8eb0909a811b1b5a3364e9fb83ba48db91d9af970289862....0.tmp
/data/data/####/905248af806afd8bcf21627e218a1a1091050088799da5f....0.tmp
/data/data/####/93f68b4c0537640a3755c122ac9c26a8aed992e7ccd7500....0.tmp
/data/data/####/96eef27e9b94dab569f4745200d1f14190afff6c220ede2....0.tmp
/data/data/####/9aebc00adb2eb9827ecf901d40e834d92fd4ca7d0aa43d4....0.tmp
/data/data/####/CustomIndex
/data/data/####/DVDirectory.cfg
/data/data/####/DVHotMap.cfg
/data/data/####/DVHotcity.cfg
/data/data/####/DVIndoor.cfg
/data/data/####/DVSDirectory.cfg
/data/data/####/DVVersion.cfg
/data/data/####/JPushSA_Config.xml
/data/data/####/ResPackIndoorMap.rs
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a35c1c28-e011-4dac-830f-26df253f64c0
/data/data/####/a==7.5.4&&1.0.7_1550933887244_envelope.log
/data/data/####/ada05774f5f83d482d0294391efb099056e5fb50eecda26....0.tmp
/data/data/####/ae9e9749aff299d6e1e234df48624848048d11c50eba843....0.tmp
/data/data/####/afdd29856b245da740b0d82d85e8b4dc34c6c2d4f9cf87c....0.tmp
/data/data/####/appPackageNames_v2
/data/data/####/authStatus_com.mgmt.woniuge.xml
/data/data/####/authStatus_com.mgmt.woniuge;pushcore.xml
/data/data/####/authStatus_com.mgmt.woniuge;remote.xml
/data/data/####/b4376699fa4827f9047b233092a4f89d440838f7fc82bcd....0.tmp
/data/data/####/baseindoormap.sty
/data/data/####/be0c1d8f1a5c4c3ca0f7cd7eb2cb79970ead2ce017a5e73....0.tmp
/data/data/####/be3273075344d9335158735cd5602d54a387d3555e37114....0.tmp
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/c0c9aaf5dbaa2a26c53797c96aab262e7e98b166efc7ea4....0.tmp
/data/data/####/c1c3c54f9614e92b6d92b23529ddf44646756bd97b528cc....0.tmp
/data/data/####/c209cc755567a91bdee5d10c1a0b2ddc5bce4a43ad225b8....0.tmp
/data/data/####/c4577220582a7f15aca343467b59f9bafee1728e1dd5fb0....0.tmp
/data/data/####/c8da6d75b39e31ac7fdc8f5dca230099828913217ca661c....0.tmp
/data/data/####/cbbb8a3c2ce9c5a582f2e10f9a2b415c5d08735597b092b....0.tmp
/data/data/####/ccbc231047231b23dbf42abad9f61ca80ff9036f73044a9....0.tmp
/data/data/####/cff9968a5c3b87b24dbff1be87869b13044bd02bb2b2a27....0.tmp
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/crashrecord.xml
/data/data/####/d5f224b8-7e34-4947-b0c0-45ec2f582454
/data/data/####/d690537e3165b79233097770271c394f8c42a322038482b....0.tmp
/data/data/####/d72d9ca06dcca6e141b6845f6a4fab7ef4ca13f00948533....0.tmp
/data/data/####/d83cd10188a2920079fe7fd7b8638cd66f90bb7359cb03b....0.tmp
/data/data/####/d8d90f2dc5df4302c503823717cf935295666b566777d5e....0.tmp
/data/data/####/d8da508435bdaf5eeda71419538f6fc9c88dcec3a5321ae....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUwOTMzODg1MDU1;
/data/data/####/da69a26e-181c-4852-b3d8-e613f81a6d92
/data/data/####/dd3ee57a4839659ea5b69ef7216778bb64f40543db1395e....0.tmp
/data/data/####/domain_1
/data/data/####/e0aa17413679c763aeefe63d4393492073cdb011e38a856....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f051745a3c70e329633def8ad778aeebee069b5dd7c9c87....0.tmp
/data/data/####/f051745a3c70e329633def8ad778aeebee069b5dd7c9c87...304f.0
/data/data/####/f0566f25-f36c-46bf-8485-9a598471a3f2
/data/data/####/f31028b34e5dc72aa4b4368596e6ce1b49df1157e91ab26....0.tmp
/data/data/####/f58cf5b41e398ff4bfb2c63f72644e31b9af8a37a812ee8....0.tmp
/data/data/####/f6dcf913dd80754e7c21b8fc5cb27b501c4eb7324ceb98f....0.tmp
/data/data/####/fb0db7b53372a0152cf06c0a80d09a78b0c1793253209dc....0.tmp
/data/data/####/fe0e6a6e93dfa096fa5adc0ea035fa59cd1d276f0abeef3....0.tmp
/data/data/####/ff87fae8548d90de635f85ee73d806df7a1f9dba18c869a....0.tmp
/data/data/####/firll.dat
/data/data/####/gal.db
/data/data/####/gal.db-journal
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/i==1.2.0&&1.0.7_1550933885086_envelope.log
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/libcuid.so
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.1.2.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/map.rs
/data/data/####/map.sty
/data/data/####/map_pref.xml
/data/data/####/mix.dex
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/native_record_lock
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/reduct.rs
/data/data/####/reduct.sty
/data/data/####/security_info
/data/data/####/sobot_chat_20190223_log.txt
/data/data/####/sobot_config.xml
/data/data/####/traffic.rs
/data/data/####/traffic.sty
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ver.dat
/data/data/####/wng_sp.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.artc_lock
/data/media/####/.cca.dat
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.di
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.im_lock
/data/media/####/.lesd_lock
/data/media/####/.mn_-1464060969
/data/media/####/.nomedia
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.push_deviceid
/data/media/####/.rc_lock
/data/media/####/.slw
/data/media/####/.ss_lock
/data/media/####/.umm.dat
/data/media/####/.wkl
/data/media/####/DTTempdat.dat
/data/media/####/DTTempdat.idx
/data/media/####/DVUserdat.cfg
/data/media/####/conlts.dat
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/test.0
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
chmod 700 /data/user/0/<Package>/tx_shell/libnfix.so
chmod 700 /data/user/0/<Package>/tx_shell/libshella-2.9.1.2.so
chmod 700 /data/user/0/<Package>/tx_shell/libufix.so
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.1.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
ps

Загружает динамические библиотеки:

BaiduMapSDK_base_v5_2_1
BaiduMapSDK_map_v5_2_1
Bugly
jcore125
libnfix
libshella-2.9.1.2
libufix
locSDK7b
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней