Adware.Gexin.9889

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) oss.cdn.a####.com:80
TCP(HTTP/1.1) down####.1####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) h####.1####.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) ab.1####.com:3302
TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
TCP(TLS/1.0) thi####.q####.cn:443
TCP(TLS/1.0) api.a####.com:443
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) t####.c####.q####.####.com:443
TCP(TLS/1.0) h####.qktou####.com.####.com:443
TCP(TLS/1.0) cdn.aicli####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) gl####.w.kunl####.####.com:443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) c.innot####.com:443
TCP(TLS/1.0) lo####.qutou####.net:443
TCP(TLS/1.0) log.1####.com:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) a####.a####.m.####.com:443
TCP 2####.119.205.127:80
TCP ope####.m.ta####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5224
UDP 1####.168.117.1:137

Запросы DNS:

7j####.c####.z0.####.com
a####.m.ta####.com
a####.u####.com
ab.1####.com
ag####.m.ta####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
c####.baidust####.com
c####.g####.ig####.com
c-h####.g####.com
c.innot####.com
cdn.a####.com
cdn.aicli####.com
cfg.a####.com
ddd.1####.com
down####.1####.com
h####.1####.com
h####.1####.com
h####.1####.com
h####.qktou####.com
h####.qktou####.com
h5####.1####.com
i####.1####.com
lo####.qutou####.net
log.1####.com
mo####.b####.com
mobads-####.b####.com
msg.umengc####.com
oss.cdn.a####.com
pos.b####.com
qfy.innot####.com
rcv.a####.com
recall-####.1####.com
res####.a####.com
sdk.c####.ig####.com
sdk.o####.amp.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sf6-ttc####.ps####.com
st####.1####.com
sta####.1####.com
static####.qutou####.net
thi####.q####.cn
umen####.m.ta####.com
up####.sdk.jig####.cn
upd####.a####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&OSVers...
api.1####.com/app/coldStart?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/eventConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getAdConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getConfig?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/getGuide?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/app/getPatch?versionName=####&dtu=####
api.1####.com/app/start?model=####&lon=####&OSVersion=####&deviceCode=##...
api.1####.com/app/updateV2?platform=####&lon=####&OSVersion=####&deviceC...
api.1####.com/content/getDefaultChannelList?lon=####&OSVersion=####&devi...
api.1####.com/qupwd/config?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/welfare/redbagconfig?lon=####&OSVersion=####&deviceCode=##...
api.a####.com/ga?slotid=1027423&jdata={"device":{"physical_density":0.81...
api.a####.com/ga?slotid=1028298&jdata={"device":{"physical_density":0.81...
api.a####.com/ga?slotid=1029077&jdata={"device":{"physical_density":0.81...
api.a####.com/reqMotPkgLst
api.a####.com/show?CAAQcQ.####
down####.1####.com/download/qukan.3.2.0.1.001_apkfile
gl####.w.kunl####.####.com/image/sp/2018/04/12/148a91e973f72c57e313f0fe5...
gl####.w.kunl####.####.com/image/sp/2018/04/24/d924bb0a82c95083120505227...
gl####.w.kunl####.####.com/image/sp/2019/03/08/5c827330af38a.jpg?imageVi...
gl####.w.kunl####.####.com/image/sp/2019/03/08/5c827330bc122.jpg?imageVi...
gl####.w.kunl####.####.com/png/dislike.png
gl####.w.kunl####.####.com/png/lick1.png
gl####.w.kunl####.####.com/png/like_click_animation.png
gl####.w.kunl####.####.com/png/recommend_bg.png
gl####.w.kunl####.####.com/qupost/avatar/2017/11/18/899e3bb96f74916e167a...
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551772379594251884....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551772379601593046....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551772379607062422....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551788318754272464....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551788318894205605....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551788318977667821....
gl####.w.kunl####.####.com/qupost/images/2019/03/07/1551970723628140342....
gl####.w.kunl####.####.com/qupost/images/2019/03/07/1551970723643363134....
gl####.w.kunl####.####.com/qupost/images/2019/03/07/1551970723677375513....
gl####.w.kunl####.####.com/qupost/images/2019/03/08/1552049451104996907....
h####.1####.com/live/videoPoster/1559909/ccd2e76df7dface84c9ea89c1524966...
h####.1####.com/live/videoPoster/1570713/caff5df93a82aa6dff00fc68b2834a3...
i####.1####.com/module_detail/release/template/release/static/template.h...
log.1####.com/a.gif?OSVersion=####&tk=####&network=####&version=####&tim...
log.1####.com/a.gif?lon=####&OSVersion=####&deviceCode=####&error_code=#...
log.1####.com/a.gif?lon=####&OSVersion=####&deviceCode=####&userid=####&...
log.1####.com/a.gif?lon=####&index=####&op=####&OSVersion=####&deviceCod...
oss.cdn.a####.com/live/customer/1558602/25b47125404dc475cc399e4fd4c9af87...
oss.cdn.a####.com/live/customer/1558602/3822ccf2682740b222ce14f351fea4c1...
oss.cdn.a####.com/live/customer/1558602/cafe6b57825ee9a52fb7a730ba5989de...
sf6-ttc####.ps####.com.####.com/obj/ad.union.api/105d604054acd5ef1fa77e8...
sf6-ttc####.ps####.com.####.com/obj/ad.union.api/a57c85a570c6470e4f26a39...
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
ti####.c####.l####.####.com/config/hz-hzv3.conf

Запросы HTTP POST:

a####.u####.com/app_logs
ab.1####.com:3302/ab_by_sign
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.a####.com/v3/json
c-h####.g####.com/api.php?format=####&t=####
ddd.1####.com/report
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/07366dfc7174e2accfc0f8cd28260240cd17a87e2f7c92b....0.tmp
/data/data/####/0e4034662694406e996615200cbbb063676e05a62f3608c....0.tmp
/data/data/####/1004
/data/data/####/1d2fd1103974b2388fbc4477a1232f2372eb500291406f6....0.tmp
/data/data/####/320df611aed98f3582997bc22dbf14da1de376764a15694....0.tmp
/data/data/####/37c59d12a6056d0a634d54b372cb71784514f8df9c69181....0.tmp
/data/data/####/442e5cebd7c2786d7041eaa3ec631458cb70a2641cad93d....0.tmp
/data/data/####/44bdfda5e546d5be3c498e5742c728c9de8a5196444cdd4....0.tmp
/data/data/####/50b7444ac57d30fecbeff52d1ed47fdf25a86ea61cd3049....0.tmp
/data/data/####/50fae74979868957abfd14f61912db6e0fd036d62f7e846....0.tmp
/data/data/####/51428e0fad66214171542cc3e93951f61c77f748be7b941....0.tmp
/data/data/####/5633d3606a26faf1900fa744faa493d7709c26d793b2ba7....0.tmp
/data/data/####/57cbac2cf864c999859f29e45734f743c0b46b9a64f43e7....0.tmp
/data/data/####/67f76d73096b96976a7feefd2d8a67bd32a40b2d25789ec....0.tmp
/data/data/####/6f762fe74043c42dc045a6aa37c4dd077f34fb4d889ba7b....0.tmp
/data/data/####/7c96c2aad83f079a3072a99904dcc1976802de82804992a....0.tmp
/data/data/####/7d61439f5ae1869b272119d8ba097d6664818077a4255e0....0.tmp
/data/data/####/83b4381451f7c069ec6602be5ed88828a94ca8e5d75bb54....0.tmp
/data/data/####/964846eee4cb023f1318dadfd880c4aa87478d0f6b005f8....0.tmp
/data/data/####/ACCS_BINDumeng;57578e4d67e58e4c810000d2.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/JPushSA_Config.xml
/data/data/####/MANIFEST.MF
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/RAB5dL408Es5uTPVVct7r1JE
/data/data/####/RB82_mbqbkAZqkAJR0UrUuz1
/data/data/####/RBOLEQva1kjrtHbKCTQoxs0O
/data/data/####/RCCN47WpBEl8iTuk6wKKyFZg
/data/data/####/RGlLLjFc_ECMvG48dBhU968T
/data/data/####/RIjiFKHGM0NmvzHkLpWHbvWF
/data/data/####/RJC8krboiEcFjpZmToD7Cewn
/data/data/####/RJN62o-5vEtktVE4qkAS119g
/data/data/####/RKV-BNfcBkvfnh3HeJKAwDda
/data/data/####/RLP6L3DLXESwgFadKNyzLTAj
/data/data/####/RMpYsQn4eEtsv3d1Anw9wmQ9
/data/data/####/RNRRuSkkoEzlhl8cTly_yZzM
/data/data/####/RORzEVggUkJkpuAThH6Y2PWE
/data/data/####/ROjbycZYFUDqpFbpsi4A61lH
/data/data/####/ROz5YI57R0YboKjwBdhetbmE
/data/data/####/RPUbQkWvCERfpF-Xyci1cwWn
/data/data/####/ReadTimerPresenterEx
/data/data/####/SKY_SP.xml
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_download_1552099976
/data/data/####/a13217f28ebef198d5fa5beaac0ab4b9db1ee7a0068447f....0.tmp
/data/data/####/aa3cb4047aa6d81ddfaaee93a4f3254e1e8492d0ad6e03c....0.tmp
/data/data/####/accs.db-journal
/data/data/####/ad682ad31c2fdb9893d669cc67d48af208f72f9a6dbab33....0.tmp
/data/data/####/afa2d32e9f9cbee1491e883d0b7951c80ff7388b69d8d5f....0.tmp
/data/data/####/agoo.pid
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/bugly_db_-journal
/data/data/####/c80f33965a1cd46856a126d445539bcccb46c040a3c49b7....0.tmp
/data/data/####/cba552f05de61e2e2bd89a1f2b6d26a8ff936ff03dd5eee....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.jifen.qukan-journal
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.jifen.qukan_prefs.xml.bak
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/crashrecord.xml
/data/data/####/d8465f051a7df0abe652ef251d0115f08f35e36f2bd8da5....0.tmp
/data/data/####/d8e2c49184e5511b4d0fd49a3b0f4297a1d134545ad0990....0.tmp
/data/data/####/d8e95c0fdaa73909a0c99cc770f55bd62ea7b67c759f016....0.tmp
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/data_3 (deleted)
/data/data/####/ddf6bb8f38c64bc746de0f7b4600874e8e41c2cde034cac....0.tmp
/data/data/####/e1bad61562b5eca1e3807727f3ebfc869b3dcb79eea93f3....0.tmp
/data/data/####/e20b9e577580a801e27092f86fe14e22cf93ae41cd2d547....0.tmp
/data/data/####/ea886fa962e5f75da94405d380213ac31ebc5472e89ed98....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/fd232d5b09ba5e9a06d4ff40f8caaa53d2286acd992f656....0.tmp
/data/data/####/getui_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/https_html2.qktoutiao.com_0.localstorage-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/libjiagu-1385524905.so
/data/data/####/local_crash_lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/prdownloader.db-journal
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/secid
/data/data/####/security_info
/data/data/####/sensorsdata.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.acid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.acid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.74f9af2a1233161067ccef0ab406443a.cuid
/data/media/####/.79594990e265ac60591761aa24fbd681.acid
/data/media/####/.79594990e265ac60591761aa24fbd681.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.919166631283dc3099cc3b24dc440014.acid
/data/media/####/.919166631283dc3099cc3b24dc440014.cuid
/data/media/####/.953c80ff9827cbb183369e675c974bc1.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.aio.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.acid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.f4e8fb1b9b24e8d4a8e49c675baf05db.cuid
/data/media/####/.nomedia
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a9b30a9a76604aee9d018200f3908365
/data/media/####/aacout
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/cpc_ad_search
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/deviceToken
/data/media/####/f67963ce217349efa2d693641a9f74cc
/data/media/####/qtac
/data/media/####/red_dot_navigationSelected.png
/data/media/####/red_dot_navigationUnSelected.png
/data/media/####/systemccu
/data/media/####/systtk
/data/media/####/tabtkae
/data/media/####/template.html
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac
/data/media/####/wxtoatk

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57578e4d67e58e4c810000d2","utdid":"XIMqgahyGPkDAGdzx1F1oIOS","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/app_bin/daemon
chmod 755 <Package Folder>/.jiagu/libjiagu-1385524905.so
date
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
id
ls -i
ls -l
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
service call iphonesubinfo 1
sh
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/meminfo
sh -c cat /proc/mounts
sh -c cat /proc/self/maps
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh -c echo OEQ3OTkzQTJDRkZEMDQyMzIwOEFDNDE3RDUyNjlCOTQyOUM5NUQ6MkNENzA0OjJGMDk2OQ== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo OEQ3OTkzQTJDRkZEMDQyMzIwOEFDNDE3RDUyNjlCOTQyOUM5NUQ6MkNENzA0OjJGMDk2OQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo OTM5NzJBMUMwNTU1MjIyMUI4NzU1MkE3QUE1MDJDOUVDQkVGQjA6QTVDMUFFOjFEODM5QQ== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo OTM5NzJBMUMwNTU1MjIyMUI4NzU1MkE3QUE1MDJDOUVDQkVGQjA6QTVDMUFFOjFEODM5QQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RTZGOEU4QTI0MTgzRjhBODAyNkE2MEJDREYxMEQyNTgxNTUyMDk5OTc0 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo RTZGOEU4QTI0MTgzRjhBODAyNkE2MEJDREYxMEQyNTgxNTUyMDk5OTc0 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh <Package Folder>/files/RAB5dL408Es5uTPVVct7r1JE
sh <Package Folder>/files/RB82_mbqbkAZqkAJR0UrUuz1
sh <Package Folder>/files/RBOLEQva1kjrtHbKCTQoxs0O
sh <Package Folder>/files/RCCN47WpBEl8iTuk6wKKyFZg
sh <Package Folder>/files/RIjiFKHGM0NmvzHkLpWHbvWF
sh <Package Folder>/files/RJC8krboiEcFjpZmToD7Cewn
sh <Package Folder>/files/RJN62o-5vEtktVE4qkAS119g
sh <Package Folder>/files/RKV-BNfcBkvfnh3HeJKAwDda
sh <Package Folder>/files/RLP6L3DLXESwgFadKNyzLTAj
sh <Package Folder>/files/RMpYsQn4eEtsv3d1Anw9wmQ9
sh <Package Folder>/files/RNRRuSkkoEzlhl8cTly_yZzM
sh <Package Folder>/files/RORzEVggUkJkpuAThH6Y2PWE
sh <Package Folder>/files/ROjbycZYFUDqpFbpsi4A61lH
sh <Package Folder>/files/ROz5YI57R0YboKjwBdhetbmE
sh <Package Folder>/files/RPUbQkWvCERfpF-Xyci1cwWn
stat app
stat cat
stat etc
stat net
stat random
uname -a
uname -r

Загружает динамические библиотеки:

Bugly
InnoSecure
InnoSo
NativeExample
du
getuiext2
jcore118
libjiagu-1385524905
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней