Adware.Gexin.13042

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) s####.m.img####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) cdn.4399yo####.439####.net:80
TCP(HTTP/1.1) m####.4399yo####.439####.net:80
TCP(SSL/3.0) a.img####.com:443
TCP(SSL/3.0) g####.4####.com:443
TCP(SSL/3.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) f1.img####.com:443
TCP(TLS/1.0) fs.img####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) m####.439####.net:443
TCP(TLS/1.0) ptl####.4####.com:443
TCP(TLS/1.0) ptl####.330####.net:443
TCP(TLS/1.0) g####.4####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) cdn.4399yo####.439####.net:443
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.net:5224

Запросы DNS:

7j####.c####.z0.####.com
a.4####.cn
a.img####.com
aexcep####.b####.qq.com
and####.b####.qq.com
c####.g####.ig####.com
c-h####.g####.com
cdn.4399yo####.com
e.crashly####.com
f1.img####.com
fs.img####.com
g####.4####.com
log.u####.com
m####.439####.net
m####.4399yo####.com
mt####.go####.com
plb####.u####.com
ptl####.330####.net
ptl####.4####.com
s####.m.img####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sett####.crashly####.com
sj2.img####.com
u####.u####.com

Запросы HTTP GET:

cdn.4399yo####.439####.net/app/android/v3.1/game-detail.html?gameId=####
m####.4399yo####.439####.net/app/android/v3.1/custom-FootMenu.html
m####.4399yo####.439####.net/app/android/v3.1/custom-protocol.html?flag=...
m####.4399yo####.439####.net/app/android/v3.1/face-list.html
m####.4399yo####.439####.net/app/android/v3.1/feed-list.html?lastTime=##...
m####.4399yo####.439####.net/app/android/v3.1/game-homeRec.html
m####.4399yo####.439####.net/app/android/v3.1/game-tabTvList.html?gameId...
m####.4399yo####.439####.net/app/android/v3.1/game-topRec.html
m####.4399yo####.439####.net/app/android/v3.1/home-background.html
m####.4399yo####.439####.net/app/android/v3.1/home-getConfig.html?appVer...
m####.4399yo####.439####.net/app/android/v3.1/home-hot.html
m####.4399yo####.439####.net/app/android/v3.1/home-popAd.html?start_firs...
m####.4399yo####.439####.net/app/android/v3.1/home-searchHot.html
m####.4399yo####.439####.net/app/android/v3.1/level-step.html
m####.4399yo####.439####.net/app/android/v3.1/push-updatePushId.html?pla...
m####.4399yo####.439####.net/app/android/v3.1/rss-isUpdate.html?lastTime...
m####.4399yo####.439####.net/app/android/v3.1/tvPage-hot.html?room_ids=#...
m####.4399yo####.439####.net/downloader/youpai/tools/resource_20171205.5...
t####.c####.q####.####.com/config/hz-hzv6.conf
t####.c####.q####.####.com/tdata_Gfv491
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_ZvO248
t####.c####.q####.####.com/tdata_zzW503

Запросы HTTP POST:

aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
m####.4399yo####.439####.net/app/android/v2.2/feedback-getMessage.html
m####.4399yo####.439####.net/app/android/v3.1/app-getUdid.html
m####.4399yo####.439####.net/app/android/v3.1/user-isDyed.html
s####.m.img####.com/trace/<Package>/1.0/4399Game/.config?version=####
s####.m.img####.com/trace/<Package>/1.0/xiaomi/
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1769862752193252826
/data/data/####/.imprint
/data/data/####/.policy
/data/data/####/007746ef83c1a58521c69d20a942f091c4d9560a783f8dc....0.tmp
/data/data/####/0133a6c218f91f01555de81d5a3c43799737110b705144e....0.tmp
/data/data/####/05f754d6c64c7ba7e629d789e81d0457a758c13ae35b0d9....0.tmp
/data/data/####/072fe060a330d42092a9a438371dcbc57c973d206c78a50....0.tmp
/data/data/####/07ee1d239efe5ffe58e2866f1f04d7dfffeb35d59f7786a....0.tmp
/data/data/####/091d2043800b6974e08281c747e5f28168298772e57a987....0.tmp
/data/data/####/0a81dbff223cc02c7fd37e900892fb6bea9f01e2a33bef4....0.tmp
/data/data/####/0d98a8190b2379c929f9caa608dad819f1624b6235ebde6....0.tmp
/data/data/####/0e8529b53353c67a65cc2450b1e1f15556ae269e7030a50....0.tmp
/data/data/####/0ee58285cf08070594c960d169ffff330b085cfd08417a3....0.tmp
/data/data/####/1.png
/data/data/####/10.png
/data/data/####/11.png
/data/data/####/110f62ce9e3fc1d9215cedd7caf9e9d02d4ee46e92b7f92....0.tmp
/data/data/####/12.png
/data/data/####/121a9dcfcf7a966b2feb5598b583d3ed62c85d637e50876....0.tmp
/data/data/####/128ee1f976c069521b5989fe5ab85e28a5bfcdb0739b307....0.tmp
/data/data/####/13.png
/data/data/####/14.png
/data/data/####/15.png
/data/data/####/1516606873
/data/data/####/16.png
/data/data/####/16210ac256b6f6c76658931df02122180c01c2bb7c7e4f9....0.tmp
/data/data/####/1678467419-1345754950
/data/data/####/17.png
/data/data/####/18.png
/data/data/####/1823a03d58adfde6d1274296ef4b66cae712ec65aa95db1....0.tmp
/data/data/####/19.png
/data/data/####/1a230d68b38be5cc66c476865f79ce8c81229ea314c7ca9....0.tmp
/data/data/####/2.png
/data/data/####/20.png
/data/data/####/21.png
/data/data/####/21f78c218c3f314f9281090eec6c3d2358cbd2958ab117f....0.tmp
/data/data/####/22.png
/data/data/####/2288a5d3968a55efa19ec58b28e5366302cc0d44bc62919....0.tmp
/data/data/####/23.png
/data/data/####/24.png
/data/data/####/24e3e1f79aee7fcc08f09acb1be33fc76f70f356cecd2be....0.tmp
/data/data/####/25.png
/data/data/####/26.png
/data/data/####/260ba1d690dddf8eed0d7771e4b4c5ac15e137e8e18ca20....0.tmp
/data/data/####/27.png
/data/data/####/28.png
/data/data/####/28a3b4d6b0a0d2dea3de02e30dd2f30aa548dec14c7e41c....0.tmp
/data/data/####/29.png
/data/data/####/29f03914458851518b16cefb79c91bfecb71c024f72124a....0.tmp
/data/data/####/2a076f69fdc65531c6463096d777417d76fa85218781979....0.tmp
/data/data/####/2a978e80263bba0e4b24c9235ae4e4d1f891518b89d8410....0.tmp
/data/data/####/2b0e3ba0fd9797ca0e40437c01e39b7095509a4a9a66da3....0.tmp
/data/data/####/2bfd06fe51f9d1838d0179b7c942a7c41e877f2f86cccb6....0.tmp
/data/data/####/2c34a3b86917c05c0a4b68c982f648a85d195e8ab9754f2....0.tmp
/data/data/####/2ca0276cb0348928a9fbdbf2d630076d84f1253d15b9c10....0.tmp
/data/data/####/2cafd24ee917b8bd9feec067cec0fd32781e2db4053170d....0.tmp
/data/data/####/2e237185511e20002841e9ca3c795d43b545e1af1226ee6....0.tmp
/data/data/####/2f12fa756e5d2bafa8c1c771130aae7f98a37ce20402b80....0.tmp
/data/data/####/3.mp3
/data/data/####/3.png
/data/data/####/30.png
/data/data/####/31.png
/data/data/####/32.png
/data/data/####/322ecdc52c8b78380a36452c4c21a52e4728fcf5a9d9961....0.tmp
/data/data/####/33.png
/data/data/####/333cd0e7ce45d404324fbfc007cc17df0bd4b91b17cb392....0.tmp
/data/data/####/34.png
/data/data/####/34697510d1f28bd25d7460c0ddd1388dfcc35b3efd05120....0.tmp
/data/data/####/35.png
/data/data/####/35562aef224ad0dd1eebbba1a96a412fad0cc8adb7ae40d....0.tmp
/data/data/####/36.png
/data/data/####/37.png
/data/data/####/3768174cbb423074657aac5741815c9da55f8daa88d679b....0.tmp
/data/data/####/37fbd6d58860ad49db16f7438f8ac51237602ed165cecf6....0.tmp
/data/data/####/38.png
/data/data/####/384c9ae3cd05cde5654e6b20205887e57c62ef6606b9984....0.tmp
/data/data/####/39.png
/data/data/####/39b61af4401939cba5d62ea3318149ea78e8efac2709ac0....0.tmp
/data/data/####/3a4583a56cf9e6015a609f31da2f824443c838f9ff21a53....0.tmp
/data/data/####/3ca4ccc9124b0f253b3b6e349a12b573464c54c0be6488c....0.tmp
/data/data/####/3ee18428278d176713d5e1f55b7ff6f082c86d078b0a7a3....0.tmp
/data/data/####/3f1c0b40ca6ed44e2e3b7213ca3d0cec253c6e3eab704bc....0.tmp
/data/data/####/3f237b363dde5068474fb868b2ace1c3c4eefcf54c626e0....0.tmp
/data/data/####/4.mp3
/data/data/####/4.png
/data/data/####/40.png
/data/data/####/41.png
/data/data/####/42.png
/data/data/####/420c149ade2a7d7a91fd07bc2b713146b7e92c87c1b98b5....0.tmp
/data/data/####/43.png
/data/data/####/44.png
/data/data/####/4418c5c6477876f727fd41839e7d469c286c13f6be1ea81....0.tmp
/data/data/####/45.png
/data/data/####/4554ae9e17eb5b40eec4f9475e7e918266987d0f3a11e8c....0.tmp
/data/data/####/46.png
/data/data/####/47.png
/data/data/####/48.png
/data/data/####/49.png
/data/data/####/49eb5d93d49c11e77e0ddbe167e927983fd2df8f18e0f87....0.tmp
/data/data/####/4b7ee4c5c2a143beeb989e0e027713774785e20fd2fe3a6....0.tmp
/data/data/####/4d87b4a5775ea8184d38505f5a15b446140abfa862a8798....0.tmp
/data/data/####/5.mp3
/data/data/####/5.png
/data/data/####/50.png
/data/data/####/51.png
/data/data/####/51b932a4bc2c46992a1e151c6dc54820b251092ebec7cdf....0.tmp
/data/data/####/52.png
/data/data/####/520216bf06bd3a0a6727303efc994d5fc1ad212fef7647f....0.tmp
/data/data/####/53.png
/data/data/####/54.png
/data/data/####/546c496007e5c27aac6ccef1d0e61ccc1f72e78635dbc4c....0.tmp
/data/data/####/55.png
/data/data/####/554fc5bb23a6ba8d08c10d5b35d344bdf4e85f3b4d32304....0.tmp
/data/data/####/56.png
/data/data/####/57.png
/data/data/####/573515126da0afe9b630c643c7f0505533f70412a163e6b....0.tmp
/data/data/####/57752162715c4cc59132206a9f96d85f079ad998fc4651f....0.tmp
/data/data/####/578919d18b63dae1425286b9ca80807961a7138d2a3d380....0.tmp
/data/data/####/58.png
/data/data/####/59.png
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8BeginSession.cls_temp
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8BeginSession.json
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8SessionApp.cls_temp
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8SessionApp.json
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8SessionDevice.cls_temp
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8SessionDevice.json
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8SessionOS.cls_temp
/data/data/####/5CC8EC7E02F2-0001-0902-115AA8EDDDE8SessionOS.json
/data/data/####/5a55dd77538882ead6e2ba7989ff6b7a2d80242daa4ef42....0.tmp
/data/data/####/6.png
/data/data/####/60.png
/data/data/####/6024383ba354fedb387e0db6d7240ddd5474b32fa7ed02f....0.tmp
/data/data/####/602616120a73fc2385a78f2a3155dabd387c73436480847....0.tmp
/data/data/####/604cbf198d7877838d14b5567e84710a9837b93ece32b25....0.tmp
/data/data/####/605f160e8647daf1afbc15fe63d2dd5dfd36724f561d5ea....0.tmp
/data/data/####/61.png
/data/data/####/62.png
/data/data/####/620aa672d26c97891a4523f044c6a2779950c9640ffe2a6....0.tmp
/data/data/####/626558d890534a5a077853b5eb3b20d168b31c2122447ef....0.tmp
/data/data/####/66.png
/data/data/####/68546d1b39736301d11686d8ce2f7521efc1851479aea2a....0.tmp
/data/data/####/6bb58e7118c48eeef8aee49f9016ad10790de0d098c7e2c....0.tmp
/data/data/####/6c7a19ac2fca374d277b25006717420223e6d50bc4acfa0....0.tmp
/data/data/####/6d83f84a4e4f531a78c8db2048fb57150b0cbf31461d821....0.tmp
/data/data/####/6e5109c3cc80aebfa7db3d9cb705e55097886443f4a1687....0.tmp
/data/data/####/7.png
/data/data/####/700bea676c6a7dcb06e556e526820baefb1ea9f2e7ab109....0.tmp
/data/data/####/706b8c3fd1c5417b1935930dcecaf3b28bf811a27402ce3....0.tmp
/data/data/####/7193477e4f9d02f22a0165f3f723c79e6cc273d05163879....0.tmp
/data/data/####/72b760f07e90c2443847dd1fd3ef6c89bd283ba8539d782....0.tmp
/data/data/####/7645ed2631d9f4d13a2b5ec0df53f8dcd8084673c6510f0....0.tmp
/data/data/####/778b80a058ece04f6b2dcb241b64fec09f721f9113fe33e....0.tmp
/data/data/####/78eb7368eda10537d2d5efcd655284ef605a55bcea4e95c....0.tmp
/data/data/####/7952ae65bf375abecf4c366bcbc21fdf9122d8fbe9de9ad....0.tmp
/data/data/####/795ea8d2bf28e1ec64aeb5e0a3f912b56c6eef568ea1962....0.tmp
/data/data/####/7976a7225770f2c59466581ff4535d3c3d5214ceadc94ff....0.tmp
/data/data/####/7a0a20ac234fd606f8acf413b7554e320f9aa98d83f7775....0.tmp
/data/data/####/7c17eda8743fca049e390c9b9f55f3c6b720dab28795d70....0.tmp
/data/data/####/7f7c1feaf5f1cfde9eefce9c942dd74b2f529a4f638cca3....0.tmp
/data/data/####/8.png
/data/data/####/811a90290b1a1cceb7916d1d40afac264efdbd35ad03691....0.tmp
/data/data/####/863806fdf9def09c04737d8035d154996264c35c42a5970....0.tmp
/data/data/####/883b5ee718fb8594707bb608b2e4393ed4f18cb6ff28d8e....0.tmp
/data/data/####/8d6cd601d339719728714602e1c5474ad72cc17b43d8ea0....0.tmp
/data/data/####/9.png
/data/data/####/9221c580f908a897047798f933f72f803d3ecc679a3f9a6....0.tmp
/data/data/####/92cd8b5b1905a3eeb5eccaae058c49cc8f1235f72db5f73....0.tmp
/data/data/####/92efea09d421191a5586d55dee01d199cd35f0b45f2ac49....0.tmp
/data/data/####/93740067a4603d13fff78ac8e357c6cb8e60f0e607ff996....0.tmp
/data/data/####/974d8cf2edb52aa75b9f54de9f20294a37c5d3c37f9ac88....0.tmp
/data/data/####/9a8b97217e299566812067b1ced35b381104b5ab8e45faf....0.tmp
/data/data/####/9c203878503f32ecd471c19d94bf523f3ba9652735b7983....0.tmp
/data/data/####/9e99848da6df9c2fd76fc2f63e3005b0b559dd77b5f2d87....0.tmp
/data/data/####/MultiDex.lock
/data/data/####/MyAnalytics_VERSION_INFO.xml
/data/data/####/MyAnalytics_device_id.xml
/data/data/####/MyAnalytics_general_config.xml
/data/data/####/MyAnalytics_send_config.xml
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/YouPai_emoji.json
/data/data/####/a1c6db82c2d5c30acd0447e35d96c8eb4063761e93a1c7b....0.tmp
/data/data/####/a33b23816ef1e42b7b5ad154d275a4544bf71b1cb1ddd0f....0.tmp
/data/data/####/a401b97d70b61b4a8f93a9bc9f44b191f1ef064705bc8a6....0.tmp
/data/data/####/a468a9ce32af2178df7be7e5a3f13e5a8d5074523636d23....0.tmp
/data/data/####/a5714ba5802b54c2f793c22f44368197dd3276662628635....0.tmp
/data/data/####/a584e017b5e0a504f4f99ca1a3ab924e9866aa3efccb43e....0.tmp
/data/data/####/a==8.0.2&&3.1.2.39_1556671616337_envelope.log
/data/data/####/abadb0648539ee5d5bc6b047975995bdff18605f33d4bd6....0.tmp
/data/data/####/aeec1a20a34f74c8a204ac32be555397958fbf52cdd0516....0.tmp
/data/data/####/b06328bb9054dbf8551cdb207f3f16892634aaaf13e1395....0.tmp
/data/data/####/b0fb2e41183d6b309bfb1f2d2f63f59a9797ebb526b065a....0.tmp
/data/data/####/b129e6e62cebec7852fbd1e84f3ba1155cd33c3e0921b89....0.tmp
/data/data/####/b6dfde449b9c67ebab983f3051921c5ec712074b043dadb....0.tmp
/data/data/####/b7ebf6cf472a95eecdf4571966f3b4eb838b1bcc45274d4....0.tmp
/data/data/####/b8bd0800ddf94fbe6c4131c2454e756eb815d04aa55ec67....0.tmp
/data/data/####/b8f1d5d45a993bad4a29348a15ddda0ee434d9b9ed0167b....0.tmp
/data/data/####/b9c04a2245c982218692e353e0af57bbde6397b04d2ac09....0.tmp
/data/data/####/bbedacb5ca42011af7942f8c8e013f51ee012525c982e0b....0.tmp
/data/data/####/bd1da9727e44079ef9ad69288a9475a4504c6495c75832e....0.tmp
/data/data/####/bda5b746a835b6bd7fd310bdb60103002c39d71b6700a42....0.tmp
/data/data/####/be86b4a0ad5d6f61f02a78c4c177f15d5b7d0cab79104ef....0.tmp
/data/data/####/bugly_db_legu-journal
/data/data/####/c1e1729d3ea4a87a891e8da20e19109d347b775df51826d....0.tmp
/data/data/####/c3a9218a414e89f66cb3c664d4851755ec52d49a44dc13a....0.tmp
/data/data/####/c3e0baf895bb79c853a8435cbc4fa54ebdba6881620f5a7....0.tmp
/data/data/####/c41272f4992a13625823ecb1e18eb8613bdba4b8c2cddac....0.tmp
/data/data/####/c451d5fd761f50a776bb10b090eb80f9d53717601920ad9....0.tmp
/data/data/####/c4844458b9976277045a40321b67c4ba6a27e312511a9f2....0.tmp
/data/data/####/c4a967b82135a57e453c627caf75b43674d76b8d51ebf19....0.tmp
/data/data/####/c53d8635ea956b228795ec0b7ac2a9fcedc5f5730d7f894....0.tmp
/data/data/####/c70a633fe7742b059b49937a999abc3a0e235254a26acc7....0.tmp
/data/data/####/cf866b94ff1a89096587626bbb86fb2abf273d1ce03d876....0.tmp
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.m4399.youpai_preferences.xml
/data/data/####/crashlytics-userlog-5CC8EC7E02F2-0001-0902-115A...mp.tmp
/data/data/####/d1244fe098f2ba8c4e15fdb9fe5663751c61ec82d5614de....0.tmp
/data/data/####/d2e7617d244cb34009efe5a70b3a69b1655f5d613c8ecb2....0.tmp
/data/data/####/d387ee886d73a6c53198b56e5c82a555e575c5c65be8d03....0.tmp
/data/data/####/d4516fcd1dde995c507cc6132a4dd0b0b6ac08ae6db1155....0.tmp
/data/data/####/d514ad4bdd0801091cae6b810852cb55a38814601a573de....0.tmp
/data/data/####/d6e993e8bcf4c9fbca03d8d770406ce130737441f4f3e39....0.tmp
/data/data/####/d7fa92db58e05a9423f6719cd2e8c284fddacdaa75e8de3....0.tmp
/data/data/####/d904d688fde50cbe7263e89d515fe6f36e04f5a496c88dc....0.tmp
/data/data/####/d9de174b5a25e7aadbfc3cd30cadf54805f222183905081....0.tmp
/data/data/####/d9ea15ee7a90572ab5b02875f5ad4260d5591c026ef48aa....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU2NjcxNjE0Nzk5;
/data/data/####/dW1weF9zaGFyZV8xNTU2NjcxNjM0NDYx;
/data/data/####/dW1weF9zaGFyZV8xNTU2NjcxNjM0NTA1;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/ddcd1aaaf9da7772aaef2420fdb2c0c3d8cfc8c5e42fbb5....0.tmp
/data/data/####/description
/data/data/####/e1d32f1efee90edfd1c248bb5b4add85f11af11f00950c9....0.tmp
/data/data/####/e63a4919eb0825f316364ba41fa5e2e7892ec9a42c1d7c4....0.tmp
/data/data/####/e67ac1997803e46bf525645912b7d718e5a08d2f7016efb....0.tmp
/data/data/####/e9fcd032296df33add27fcea00d494d13ea9d5fe4fd5a38....0.tmp
/data/data/####/ea08434a687a41406c2c0ca0e5f1c787ce5c8ae858ac244....0.tmp
/data/data/####/emoji.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f0e0fa73418942db6e10cf06a5a6922b049de3b9795eca2....0.tmp
/data/data/####/f23c80e4c2fc64a20f075446436addff1e93468fff8a138....0.tmp
/data/data/####/f3627a39fd1b782499880e918991167865c72dcb5063fa7....0.tmp
/data/data/####/f4631688d9e984246aac0779e9f2966549e48d3cfe080b5....0.tmp
/data/data/####/f6bd807808beb361865be2f332bef37b793da098c796e6e....0.tmp
/data/data/####/f72115671f9fd30015062982971e5c2f684d8eaf5abdf07....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/fa1ef1cdc5fca18db861d3a39c4842065576d3c4341924b....0.tmp
/data/data/####/fb87a1ecc65440f376f22e79d59c8efb8d451a21709c5fa....0.tmp
/data/data/####/fdfee969f36e0dc1d792382a76d2305515f9a3798129b16....0.tmp
/data/data/####/fe7990c87c256b32e74d274dcf5415b87e883e951341598....0.tmp
/data/data/####/feedbackConfig.xml
/data/data/####/ff4bd8898e5c44f6b14ac685b5e679a75ba5411f137b5be....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/home_tab_config.xml
/data/data/####/i==1.2.0&&3.1.2.39_1556671614871_envelope.log
/data/data/####/icon.png
/data/data/####/im.db-journal
/data/data/####/index
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.m.xml
/data/data/####/journal.tmp
/data/data/####/launchPicture.xml
/data/data/####/libnfix.so
/data/data/####/libshella-3.0.0.0.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/resource.zip
/data/data/####/run.pid
/data/data/####/sa_e25c6fc5-5e65-43a2-a88f-29b170c95ced_1556671615113.tap
/data/data/####/sa_ff1bdf41-971e-4588-85a1-50650a943644_1556671625656.tap
/data/data/####/security_info
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/share.db-journal
/data/data/####/statistics_agent_cached_com.m4399.youpai
/data/data/####/switch_config.xml
/data/data/####/t==8.0.2&&3.1.2.39_1556671615893_envelope.log
/data/data/####/tdata_Gfv491
/data/data/####/tdata_Gfv491.jar
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_ZvO248
/data/data/####/tdata_ZvO248.jar
/data/data/####/tdata_zzW503
/data/data/####/tdata_zzW503.jar
/data/data/####/temp_-1112807464_handled
/data/data/####/temp_-1140054328_handled
/data/data/####/temp_-1364123686_handled
/data/data/####/temp_-1378886599_handled
/data/data/####/temp_-1445490554_handled
/data/data/####/temp_-1526110254_handled
/data/data/####/temp_-1753958418_handled
/data/data/####/temp_-1895638860_handled
/data/data/####/temp_-1953066146_handled
/data/data/####/temp_-1970290183_handled
/data/data/####/temp_-1988535289_handled
/data/data/####/temp_-2001336953_handled
/data/data/####/temp_-366702702_handled
/data/data/####/temp_-524372368_handled
/data/data/####/temp_-683676868_handled
/data/data/####/temp_-749314477_handled
/data/data/####/temp_-77808902_handled
/data/data/####/temp_-952283477_handled
/data/data/####/temp_-997255413_handled
/data/data/####/temp_1014060044_handled
/data/data/####/temp_1035961375_handled
/data/data/####/temp_1085266976_handled
/data/data/####/temp_1144883256_handled
/data/data/####/temp_1305862625_handled
/data/data/####/temp_1473116242_handled
/data/data/####/temp_1598509405_handled
/data/data/####/temp_1670042251_handled
/data/data/####/temp_1678774443_handled
/data/data/####/temp_1800016420_handled
/data/data/####/temp_1882583064_handled
/data/data/####/temp_1913457981_handled
/data/data/####/temp_1968756044_handled
/data/data/####/temp_2063000268_handled
/data/data/####/temp_229248641_handled
/data/data/####/temp_297372699_handled
/data/data/####/temp_334039044_handled
/data/data/####/temp_347777491_handled
/data/data/####/temp_34883394_handled
/data/data/####/temp_548317734_handled
/data/data/####/temp_661276023_handled
/data/data/####/temp_761355657_handled
/data/data/####/temp_7769672_handled
/data/data/####/temp_778649972_handled
/data/data/####/temp_889961755_handled
/data/data/####/temp_96709747_handled
/data/data/####/type_game_select.png
/data/data/####/type_game_unselect.png
/data/data/####/type_home_select.png
/data/data/####/type_home_unselect.png
/data/data/####/type_mine_select.png
/data/data/####/type_mine_unselect.png
/data/data/####/type_mycircle_select.png
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/youpai.db-journal
/data/data/####/youpaiConfig.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.disys
/data/media/####/.systemudid
/data/media/####/.test.txt
/data/media/####/.umm.dat
/data/media/####/ad.data
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.m4399.youpai.bin
/data/media/####/com.m4399.youpai.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tdata_Gfv491
/data/media/####/tdata_MkX219
/data/media/####/tdata_ZvO248
/data/media/####/tdata_zzW503
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.push.GTPushService 24400 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-3.0.0.0.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
mount
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.push.GTPushService 24400 300 0

Загружает динамические библиотеки:

Bugly
getuiext2
ijkffmpeg
ijkplayer
ijksdl
libnfix
libshella-3.0.0.0
libufix
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней