Adware.Gexin.10488

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) 1####.29.29.29:53
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) sdk.o####.amp.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) oss.cdn.a####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) ab.1####.com:3302
TCP(TLS/1.0) h####.qktou####.com:443
TCP(TLS/1.0) cdn.aicli####.com:443
TCP(TLS/1.0) api.a####.com:443
TCP(TLS/1.0) t####.c####.q####.####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) gl####.w.kunl####.####.com:443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) lo####.qutou####.net:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) a####.a####.m.####.com:443
TCP(TLS/1.0) 1####.217.20.110:443
TCP 2####.119.215.163:80
TCP ope####.m.ta####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5224
UDP 1####.168.131.1:137

Запросы DNS:

7j####.c####.z0.####.com
a####.m.ta####.com
a####.u####.com
ab.1####.com
ag####.m.ta####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.aicli####.com
cfg.a####.com
ddd.1####.com
h####.1####.com
h####.1####.com
h####.1####.com
h####.qktou####.com
h####.qktou####.com
h5####.1####.com
i####.1####.com
lo####.qutou####.net
log.1####.com
msg.umengc####.com
oss.cdn.a####.com
pub-####.qin####.com
qfy.innot####.com
rcv.a####.com
recall-####.1####.com
res####.a####.com
sdk.c####.ig####.com
sdk.o####.amp.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.1####.com
umen####.m.ta####.com
umengj####.m.ta####.com
up####.sdk.jig####.cn
upd####.a####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&device...
api.1####.com/app/coldStart?lon=####&device_code=####&OSVersion=####&dev...
api.1####.com/app/getAdConfig?lon=####&device_code=####&OSVersion=####&d...
api.1####.com/app/getConfig?lon=####&device_code=####&OSVersion=####&dev...
api.1####.com/app/getGuide?lon=####&device_code=####&OSVersion=####&devi...
api.1####.com/app/getPatch?versionName=####&dtu=####
api.1####.com/app/start?model=####&lon=####&device_code=####&OSVersion=#...
api.1####.com/app/updateV2?platform=####&lon=####&OSVersion=####&deviceC...
api.1####.com/content/getDefaultChannelList?lon=####&device_code=####&OS...
api.1####.com/welfare/redbagconfig?lon=####&device_code=####&OSVersion=#...
api.a####.com/ga?slotid=1029077&jdata={"device":{"physical_density":0.81...
api.a####.com/reqMotPkgLst
api.a####.com/show?CAAQXw.####
api.a####.com/trace?iclicashsid=####&op3=####&opt_androidid=####&opt_bra...
api.a####.com/trace?op1=####&op2=####&op3=####&opt_v=####&t=####&
gl####.w.kunl####.####.com/image/sp/2018/04/12/148a91e973f72c57e313f0fe5...
gl####.w.kunl####.####.com/image/sp/2018/04/24/d924bb0a82c95083120505227...
gl####.w.kunl####.####.com/lw/img/2019/03/18/c63251bc40668c941f20ad15790...
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551797705848412655....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551797705850642138....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551797705852381736....
gl####.w.kunl####.####.com/qupost/images/2019/03/16/1552725611149247493....
gl####.w.kunl####.####.com/qupost/images/2019/03/16/1552725611162085776....
gl####.w.kunl####.####.com/qupost/images/2019/03/16/1552725611166816197....
gl####.w.kunl####.####.com/qupost/images/2019/03/17/1552815851917249384....
gl####.w.kunl####.####.com/qupost/images/2019/03/17/1552815851964221397....
gl####.w.kunl####.####.com/qupost/images/2019/03/17/1552815851989197196....
i####.1####.com/module_detail/release/template/release/static/template.h...
log.1####.com/a.gif?OSVersion=####&tk=####&network=####&version=####&tim...
log.1####.com/a.gif?lon=####&device_code=####&OSVersion=####&deviceCode=...
oss.cdn.a####.com/live/customer/1542903/1fb36ea1152440e9160fc7ea8e460f75...
oss.cdn.a####.com/live/customer/1542903/50fd5058eccf473f666b9d14a4b47bf4...
oss.cdn.a####.com/live/customer/1542903/d5176e1e23e50bf017bc792ad156a2d5...
oss.cdn.a####.com/live/videoPoster/1559909/ccd2e76df7dface84c9ea89c15249...
oss.cdn.a####.com/live/videoPoster/1578309/d9d28ea2a05c2d04952319fe282d4...
qin####.com.www.####.com/tdata_EDT369
sdk.o####.amp.####.com/api.htm?format=####&t=####
t####.c####.q####.####.com/tdata_AXX896
t####.c####.q####.####.com/tdata_BAI450
t####.c####.q####.####.com/tdata_Fus136
ti####.c####.l####.####.com/config/hz-hzv3.conf

Запросы HTTP POST:

a####.u####.com/app_logs
ab.1####.com:3302/ab_by_sign
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.a####.com/v3/json
c-h####.g####.com/api.php?format=####&t=####
ddd.1####.com/report
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/24b23490469b949386b34089715c7fa93c0b307fae537ef....0.tmp
/data/data/####/376205a85d95046ad377cabad1cdb1553c5fac421cfb4fd....0.tmp
/data/data/####/39ee06275425e691b9aceefa381cc5854fdd216d732ede3....0.tmp
/data/data/####/634868e4ce018c49076ef2fe8f2c90c79ef117c5ef33846....0.tmp
/data/data/####/6a949b1e0caf4147164dc6b6fea38b897c2bab6eb26e4cb....0.tmp
/data/data/####/70ea37100d6f2e015d54cc69a8d71143a083e73fc348155....0.tmp
/data/data/####/7c96c2aad83f079a3072a99904dcc1976802de82804992a....0.tmp
/data/data/####/8de0a74ecb0688177ca3aa55a192d1c74b9b6fb10bdf440....0.tmp
/data/data/####/9041f00f91f4a7b1d22aafdb088ced697e16f36847ca8a9....0.tmp
/data/data/####/ACCS_BINDumeng;57578e4d67e58e4c810000d2.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/RBEsE0XMR0TYm6oP2C_OdmQd
/data/data/####/RBV2eojMF0YnhZFfTtTQ6R0u
/data/data/####/RDr-kHwt4UY8j5bvsB-Ot2yh
/data/data/####/REFQXKe5zEzptog2MuKqR7bC
/data/data/####/RERyJm3rBk-jt8qoR3tUFZPz
/data/data/####/REgJT07MU05crpEXLQSNTP4A
/data/data/####/RF47_yKWH0C4jR1UG8eP8_L8
/data/data/####/RITyTThPr0a2pHGSCId3Dtsa
/data/data/####/RIY9mOfWykKqiCbx4JYd1g1_
/data/data/####/RJhEzH407E1NqMuLyI5aUx1Z
/data/data/####/RMLm_WijKkhFuY4TXAwcDgy9
/data/data/####/RMP1Vx7oBkZlojnnkpX7Br28
/data/data/####/RMkxu6kr8Ur4m40y0zIo3lXD
/data/data/####/RNKsSZHWPkpIockxaFWfCXqo
/data/data/####/RNUvg1VX4E0yqG8ulo1-y1iw
/data/data/####/RPMaYU-utETUkCeM4QdTO7Zj
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_download_1552929137
/data/data/####/accs.db-journal
/data/data/####/ad682ad31c2fdb9893d669cc67d48af208f72f9a6dbab33....0.tmp
/data/data/####/afdc184c24519a37cb2842ef2bc0d5ef2f712c7b3c90b8b....0.tmp
/data/data/####/agoo.pid
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/b5307d55ef15d7e29f217446e137056bca887211b4f42dc....0.tmp
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.jifen.qukan-journal
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.jifen.qukan_prefs.xml.bak
/data/data/####/com.jifen.qukan_prefs.xml.bak (deleted)
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/crashrecord.xml
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db288d15af70
/data/data/####/e9d5966bcfb1da5bfcac5210adb5f2943b6e5ecc825f798....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/libjiagu-1385524905.so
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/prdownloader.db-journal
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/secid
/data/data/####/security_info
/data/data/####/sensorsdata.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/tdata_AXX896
/data/data/####/tdata_AXX896.jar
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_Fus136
/data/data/####/tdata_Fus136.jar
/data/data/####/tempfile
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.acid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.79594990e265ac60591761aa24fbd681.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.919166631283dc3099cc3b24dc440014.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.aio.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.nomedia
/data/media/####/23c72310b21c4159b34b36dc43183197
/data/media/####/27ecd02fb7348e99b249f2e2d0c28bd6
/data/media/####/668e0162820646eb993edc96d02e0305
/data/media/####/958c09a94cff84a7f537a85b9397825f
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/aacout
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/config
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/deviceToken
/data/media/####/ef1111ffca26221882ea0af2db6bedf3
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/qtac
/data/media/####/red_dot_navigationSelected.png
/data/media/####/red_dot_navigationUnSelected.png
/data/media/####/systemccu
/data/media/####/systtk
/data/media/####/tabtkae
/data/media/####/tdata_AXX896
/data/media/####/tdata_BAI450
/data/media/####/tdata_Fus136
/data/media/####/template.html
/data/media/####/test.log
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac
/data/media/####/wxtoatk

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57578e4d67e58e4c810000d2","utdid":"XI/Rauhq27MDAGdzx1GMENrB","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.service.GTCoreService 24479 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/app_bin/daemon
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu-1385524905.so
date
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
id
ls -i
ls -l
ls /dev/socket
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/devices
sh -c cat /proc/meminfo
sh -c cat /proc/mounts
sh -c cat /proc/partitions
sh -c cat /proc/self/maps
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh -c echo NDhDMTA3N0Q5NTUzOUYwRkE5NzZGN0VFNzYwRDZGMTExOTRBMjQ6RkQyOTFDOjM3NzZGRA== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo NDhDMTA3N0Q5NTUzOUYwRkE5NzZGN0VFNzYwRDZGMTExOTRBMjQ6RkQyOTFDOjM3NzZGRA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo NzFDNzlDNDFEQjBDQzhCMTcyODM2REVGNDcyQTQyNkMyRURCOUY6NEUwOEFCOjA0RjE0Mw== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo NzFDNzlDNDFEQjBDQzhCMTcyODM2REVGNDcyQTQyNkMyRURCOUY6NEUwOEFCOjA0RjE0Mw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RkEyREIyRUE3RUE1QUNENUExOUYxNTcxQzNDM0Q3NEQxNTUyOTI5MTM5 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo RkEyREIyRUE3RUE1QUNENUExOUYxNTcxQzNDM0Q3NEQxNTUyOTI5MTM5 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh <Package Folder>/files/RBEsE0XMR0TYm6oP2C_OdmQd
sh <Package Folder>/files/RBV2eojMF0YnhZFfTtTQ6R0u
sh <Package Folder>/files/RDr-kHwt4UY8j5bvsB-Ot2yh
sh <Package Folder>/files/REFQXKe5zEzptog2MuKqR7bC
sh <Package Folder>/files/RERyJm3rBk-jt8qoR3tUFZPz
sh <Package Folder>/files/REgJT07MU05crpEXLQSNTP4A
sh <Package Folder>/files/RF47_yKWH0C4jR1UG8eP8_L8
sh <Package Folder>/files/RITyTThPr0a2pHGSCId3Dtsa
sh <Package Folder>/files/RIY9mOfWykKqiCbx4JYd1g1_
sh <Package Folder>/files/RJhEzH407E1NqMuLyI5aUx1Z
sh <Package Folder>/files/RMLm_WijKkhFuY4TXAwcDgy9
sh <Package Folder>/files/RMP1Vx7oBkZlojnnkpX7Br28
sh <Package Folder>/files/RMkxu6kr8Ur4m40y0zIo3lXD
sh <Package Folder>/files/RNKsSZHWPkpIockxaFWfCXqo
sh <Package Folder>/files/RNUvg1VX4E0yqG8ulo1-y1iw
sh <Package Folder>/files/RPMaYU-utETUkCeM4QdTO7Zj
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.service.GTCoreService 24479 300 0
stat app
stat cat
stat etc
stat net
stat random
uname -a
uname -r

Загружает динамические библиотеки:

Bugly
InnoSecure
InnoSo
NativeExample
du
getuiext2
jcore118
libjiagu-1385524905
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней