Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) mcf-htt####.cc####.com.cn:80
- TCP(HTTP/1.1) sdkco####.p####.ott.####.com:80
- TCP(HTTP/1.1) co####.v####.51t####.com:80
- TCP(HTTP/1.1) p####.q####.cn.####.net:80
- TCP(HTTP/1.1) custom####.v####.51t####.com:80
- TCP(HTTP/1.1) recom####.v####.51t####.com:80
- TCP(HTTP/1.1) i.g####.cn.####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) pin####.qq.com:80
- TCP(HTTP/1.1) apk.upg####.v####.####.com:80
- TCP(HTTP/1.1) 1####.29.29.29:80
- TCP(HTTP/1.1) g####.v####.51t####.com:80
- TCP(HTTP/1.1) m####.p####.ott.####.com:80
- TCP(HTTP/1.1) channel####.v####.51t####.com:80
- TCP(HTTP/1.1) g.dtv.cn.####.com:80
- TCP(HTTP/1.1) pl####.v####.51t####.com:80
- TCP(HTTP/1.1) l####.l.ott.####.com:80
- TCP(HTTP/1.1) h####.w####.v####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) 1####.254.116.116:80
- TCP(HTTP/1.1) qq.i####.com:80
- TCP(HTTP/1.1) mcf-dow####.cc####.com.cn:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) epg.v####.51t####.com:80
- TCP(HTTP/1.1) 1####.67.23.252:80
- TCP(HTTP/1.1) dp3.p####.ott.####.com:80
- TCP(HTTP/1.1) bt####.p####.ott.####.com:80
- TCP(HTTP/1.1) ip.v####.51t####.com:80
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) bt####.p####.ott.####.com:443
- TCP(TLS/1.0) api.tog.51t####.com:443
- TCP(TLS/1.0) mt####.qq.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5224
- TCP 1####.96.200.28:11863
- UDP 1####.177.93.178:8000
- UDP 1####.168.128.254:1863
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.u####.com
- a####.umengc####.com
- and####.b####.qq.com
- api.tog.51t####.com
- apk.upg####.v####.####.com
- bt####.p####.ott.####.com
- c####.g####.ig####.com
- c-h####.g####.com
- cdn.v####.51t####.com
- channel####.v####.51t####.com
- co####.v####.51t####.com
- custom####.v####.51t####.com
- dp3.p####.ott.####.com
- epg.v####.51t####.com
- g####.v####.51t####.com
- g.dtv.cn.####.com
- h####.w####.v####.####.com
- i.g####.cn
- ip.v####.51t####.com
- j####.v####.51t####.com
- l####.l.ott.####.com
- l####.l.ott.####.com
- m####.p####.ott.####.com
- m.i####.com
- mt####.p####.ott.####.com
- mt####.qq.com
- p####.q####.cn
- pin####.qq.com
- pl####.v####.51t####.com
- pub-####.qin####.com
- recom####.v####.51t####.com
- regi####.v####.51t####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sdkco####.p####.ott.####.com
- t####.v####.51t####.com
- tv.ott.v####.####.com
- vv.p####.ott.####.com
Запросы HTTP GET:
- apk.upg####.v####.####.com/api/check_device_id?device_id=####&version_co...
- apk.upg####.v####.####.com/api/register?version_code=####&isp=####&provi...
- apk.upg####.v####.####.com/upgrade/query?name=####&versioncode=####&vers...
- channel####.v####.51t####.com/api/v1/channel_type.json?isp=####&province...
- channel####.v####.51t####.com/api/v1/channels?isp=####&province=####&cit...
- co####.v####.51t####.com/api/api_config?package=####&version_code=####&v...
- co####.v####.51t####.com/api/v1/common_parameters?device_id=####
- co####.v####.51t####.com/api/v1/online_parameters?package=####&version_c...
- dp3.p####.ott.####.com/kvcollect?BossId=####&Pwd=####&osVer=####&serial=...
- dp3.p####.ott.####.com/livemsg?clip=####&coverid=####&openudid=####&plat...
- epg.v####.51t####.com/epg/v1/2019_05_09.json
- g####.v####.51t####.com/api/v1/program_info?version_code=####&device_id=...
- g####.v####.51t####.com/api/v1/recommend_subject?device_id=####&resoluti...
- g.dtv.cn.####.com/x/k=4006123&p=2hvjx&ns=__IP__&nx=1&sn=__SN__&ni=__IESI...
- h####.w####.v####.####.com/api_cli/get_stat?id=####&force=####
- i.g####.cn.####.com/qqlive/img/jpgcache/files/qqvideo/0/0s79svkh53jmrga_...
- i.g####.cn.####.com/qqlive/img/jpgcache/files/qqvideo/3/3l8tkwulnp88n95_...
- i.g####.cn.####.com/qqlive/img/jpgcache/files/qqvideo/a/aoc0f4wxx0lagzg_...
- i.g####.cn.####.com/qqlive/img/jpgcache/files/qqvideo/l/l1jc8hzubf6wz99_...
- i.g####.cn.####.com/qqlive/img/jpgcache/files/qqvideo/o/o660llk6wfo7ncw_...
- i.g####.cn.####.com/qqlive/img/jpgcache/files/qqvideo/q/qvotel33959sp9d_...
- i.g####.cn.####.com/qqlive/img/jpgcache/files/qqvideo/w/wi8e2p5kirdaf3j_...
- ip.v####.51t####.com/v3/iplookup
- l####.l.ott.####.com/i-tvbin/singlepay/get_ott_flag?guid=####&Q-UA=####&...
- l####.l.ott.####.com/i-tvbin/upgrade_apk/get_app_upgrade_info?tv_cgi_ver...
- l####.l.ott.####.com/kvcollect?BossId=####&Pwd=####&osVer=####&serial=##...
- l####.l.ott.####.com/livemsg?o=####&chid=####&pf=####&btoid=####&reportt...
- m####.p####.ott.####.com/commdatav2?cmd=####&version=####&channel_id=###...
- m####.p####.ott.####.com/getmfomat?model=####&network_type=####&sysver=#...
- mcf-dow####.cc####.com.cn/plugin/AdFilter-201905071106.jar
- mcf-htt####.cc####.com.cn/metro/background/1483611908379.png
- mcf-htt####.cc####.com.cn/metro/background/1492678795909.png
- mcf-htt####.cc####.com.cn/metro/background/1494313863885.png
- mcf-htt####.cc####.com.cn/metro/background/1494315844690.png
- mcf-htt####.cc####.com.cn/metro/background/1511007966964.png
- mcf-htt####.cc####.com.cn/metro/background/1511007995945.png
- mcf-htt####.cc####.com.cn/metro/background/1511008042542.png
- mcf-htt####.cc####.com.cn/metro/background/1511008060248.png
- mcf-htt####.cc####.com.cn/metro/background/1511008082088.png
- mcf-htt####.cc####.com.cn/metro/background/1511008104955.png
- mcf-htt####.cc####.com.cn/metro/background/1511008156181.png
- mcf-htt####.cc####.com.cn/metro/background/1511008180094.png
- mcf-htt####.cc####.com.cn/metro/background/1516356435262.jpg
- mcf-htt####.cc####.com.cn/metro/background/1523590631215.jpg
- mcf-htt####.cc####.com.cn/metro/background/1549079121778.jpg
- mcf-htt####.cc####.com.cn/metro/background/1555408676659.jpg
- mcf-htt####.cc####.com.cn/metro/background/1556000166049.jpg
- mcf-htt####.cc####.com.cn/metro/background/1557039635528.jpg
- mcf-htt####.cc####.com.cn/metro/background/1557132231451.jpg
- mcf-htt####.cc####.com.cn/metro/background/1557310544620.jpg
- mcf-htt####.cc####.com.cn/metro/background/201801/1516356121876.jpg
- mcf-htt####.cc####.com.cn/metro/cloud_mediatube_splash.json?resolution=#...
- mcf-htt####.cc####.com.cn/metro/splashs/1556086381062.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1556520865211.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557043460215.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557112077691.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557124787949.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557199746176.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557296681211.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557298587098.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557307178442.jpg
- mcf-htt####.cc####.com.cn/metro/splashs/1557308192078.jpg
- mcf-htt####.cc####.com.cn/v1/layouts/5a783a01e2adcbb36fe606b9?resolution...
- p####.q####.cn.####.net/media_img/0/850471548148960/0
- p####.q####.cn.####.net/media_img/0/null1510566731/0
- p####.q####.cn.####.net/media_img/0/null1513413679/0
- p####.q####.cn.####.net/media_img/0/null1515383265/0
- p####.q####.cn.####.net/vcover_vt_pic/0/1dk10przonplpjet1461744209.jpg/260
- p####.q####.cn.####.net/vcover_vt_pic/0/2rkxu64sykl2z6q1556251039/260
- p####.q####.cn.####.net/vcover_vt_pic/0/4fjc5c42cu1f5u41525334955/260
- p####.q####.cn.####.net/vcover_vt_pic/0/6ql0vqq1huc2kdb1545966209/260
- p####.q####.cn.####.net/vcover_vt_pic/0/7fy62c3bq4kdi071514975133/260
- p####.q####.cn.####.net/vcover_vt_pic/0/c24wvadeqv6m8u91509000532/260
- p####.q####.cn.####.net/vcover_vt_pic/0/fg2rrj2aqligfrk1557024527/260
- p####.q####.cn.####.net/vcover_vt_pic/0/kbtyp6nmkyijbhc1556416366/260
- p####.q####.cn.####.net/vcover_vt_pic/0/l19x9qoetxc5rh81541150858/260
- p####.q####.cn.####.net/vcover_vt_pic/0/mpe6grfd2veu2i91538108411/260
- p####.q####.cn.####.net/vcover_vt_pic/0/qzs905424x6qgvk1542354797/260
- p####.q####.cn.####.net/vcover_vt_pic/0/re9w4tpuinr8qxx1557313274/260
- p####.q####.cn.####.net/vcover_vt_pic/0/tg1xaxedocf4w2v1534318605/260
- p####.q####.cn.####.net/vcover_vt_pic/0/x770htnnmkqms9b1547434260/260
- p####.q####.cn.####.net/vcover_vt_pic/0/xp56z4adc46uk2k1537579993/260
- pl####.v####.51t####.com/clean_config.json
- pl####.v####.51t####.com/plugin_player_config.json
- pl####.v####.51t####.com/plugin_super_config.json
- qin####.com.www.####.com/tdata_EDT369
- qq.i####.com/cfg/appkey-c59d142ca1f42c23
- recom####.v####.51t####.com/api/v1/program_recommend?device_id=####&vers...
- sdkco####.p####.ott.####.com/commdatav2?platform=####&os=####&qqlog=####...
- sdkco####.p####.ott.####.com/i-tvbin/cfg/get_cfg?protocol_version=####&u...
- sdkco####.p####.ott.####.com/i-tvbin/sys/check_sys_info?otype=####&randn...
- sdkco####.p####.ott.####.com/i-tvbin/user_info/get_apk_functions?Q-UA=##...
- sdkco####.p####.ott.####.com/kvcollect?BossId=####&Pwd=####&osVer=####&s...
- t####.c####.q####.####.com/config/hz-hzv6.conf
- t####.c####.q####.####.com/tdata_Gfv491
- t####.c####.q####.####.com/tdata_MkX219
- t####.c####.q####.####.com/tdata_ZvO248
- t####.c####.q####.####.com/tdata_zzW503
Запросы HTTP POST:
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async?aid=####
- bt####.p####.ott.####.com/kvcollect
- bt####.p####.ott.####.com/mkvcollect
- bt####.p####.ott.####.com/mkvcollect?a=####&s=####&k=####&n=####
- c-h####.g####.com/api.php?format=####&t=####
- custom####.v####.51t####.com/collect
- dp3.p####.ott.####.com/dynamic/
- dp3.p####.ott.####.com/getvinfo
- dp3.p####.ott.####.com/qqvideo/
- g####.v####.51t####.com/api/layout/cell_update?version_code=####&device_...
- m####.p####.ott.####.com/mkvcollect?a=####&s=####&k=####&n=####
- pin####.qq.com/request
- qq.i####.com/hmts2s?_t=####&_z=####&from=####&_ua=####
- qq.i####.com/rec/se?_iwt_t=####&sv=####
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- sdkco####.p####.ott.####.com/checktime
- sdkco####.p####.ott.####.com/kvcollect
- sdkco####.p####.ott.####.com/mkvcollect?a=####&s=####&k=####&n=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1749238835
- /data/data/####/-334210207.tmp
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/02f97aaa2b358e9de97494679df0148f87c92b5f4db5aef....0.tmp
- /data/data/####/0cc9c34a5e5fea2fd0ad7c926e0b85d41ec1512b111351a....0.tmp
- /data/data/####/0dff2849b2543480472ee59f7ba6a8890b9cf87b001e843....0.tmp
- /data/data/####/1004
- /data/data/####/1041a84131de0558defb34cf30f72961698831295865b5a....0.tmp
- /data/data/####/1073db20136b8b53f8c2885effcf5ee2e20080909c2f9e4....0.tmp
- /data/data/####/116bf74b20d06bfff40913ea57cf2073d581586af1eee85....0.tmp
- /data/data/####/1433571038
- /data/data/####/184814892
- /data/data/####/1c050710313793424f8d80f05b65844062e4a3a305e3fe5....0.tmp
- /data/data/####/1c050710313793424f8d80f05b65844062e4a3a305e3fe5...d1d9.0
- /data/data/####/1e0f6ab7db6f20f8b158fa1f8a7779e18ced7fa31aa8d64....0.tmp
- /data/data/####/2019_05_09
- /data/data/####/22d65b7ecdaa7ff63f537069ea8bcc3ba047c69199ea878....0.tmp
- /data/data/####/234d953c969900673e2bdc741f81a356c80399fbbc2629a....0.tmp
- /data/data/####/248cccc50a94
- /data/data/####/2dde0134b9215674b0085373ce1cb3850c001db7e080a26....0.tmp
- /data/data/####/312605458
- /data/data/####/34712AC09995CCA102F6891A28EA4DA8
- /data/data/####/398967747
- /data/data/####/3b8283088af570bf65bc61909e7b275e3d32b6ecf601ae4....0.tmp
- /data/data/####/3d98b7741b4d83d57d529077192027393fdd8d1f580caba....0.tmp
- /data/data/####/483ab87b1588420351fbcfa568759e66fb61ee525c89511....0.tmp
- /data/data/####/54338a016f4a10c8f8b5245b2a2f9b822f6efe9658424fb....0.tmp
- /data/data/####/5937e4dc51e2b997a4ec1ebb22a22866f876a91fd2a2a8a....0.tmp
- /data/data/####/5EC26AF62A33BC5F0192D47B1AF5B1AB
- /data/data/####/621256866
- /data/data/####/65627d7ac392fd4a15afdaf45e89392a03e7b731853801c....0.tmp
- /data/data/####/6db4e6289828ed75181d93d609af90cdd764d8574dee5fd....0.tmp
- /data/data/####/709f4510d5ed6534d9215e508f9b2831946002066af0548....0.tmp
- /data/data/####/75a285d7b4e51acac43b4d398930979c4ae290b33b3f97b....0.tmp
- /data/data/####/7ffee617a915c70022df72b2371b94dc5ab232cf260103e....0.tmp
- /data/data/####/80cf8d1e61ee45e76ce7438bd20e56a79926d37cf1ae780....0.tmp
- /data/data/####/8f71efac20cccc27f12d0ade0ffb66ad45bd9d76d4a17a3....0.tmp
- /data/data/####/921475012
- /data/data/####/96C551AB1373402F04E5108E80561773
- /data/data/####/99f429c2ce116566842bfb428417632023c1f94904083d5....0.tmp
- /data/data/####/9d13c9a09e69336c54b8c43a720de97562d971d96a41522....0.tmp
- /data/data/####/9e11ef232e15b2d3e7d09547d7c861dd145816b1c0fa943....0.tmp
- /data/data/####/ADCORE_MANAGER.xml
- /data/data/####/DefaultStatisticAgent.jar
- /data/data/####/TogicFilter.jar
- /data/data/####/V126_url_paramters.json
- /data/data/####/a24c5ff6cfdc719dde3d6fbe177257b40cc48386d043d54....0.tmp
- /data/data/####/ac76fd4d7c61ef705659cadc28db82a7b0c6f3ec8c2c976....0.tmp
- /data/data/####/ad.CookiePrefsFile.xml
- /data/data/####/ads.service.AdConfiguration.xml
- /data/data/####/ads.service.AppConfiguration.xml
- /data/data/####/ads.service.PlayedAdList.xml
- /data/data/####/ads.utility.Utils.xml
- /data/data/####/b0548ebffa627aabfccaa7f161db20cba0c41266607bb39....0.tmp
- /data/data/####/bugly_db_ktsdk-journal
- /data/data/####/c942207ff7855ee7520844008d0cee94c678a20d4cf8afe....0.tmp
- /data/data/####/cache2_03E0519094F558CEB99AC4FB96B86AB3
- /data/data/####/cache2_096D421A2A10FD71C83132EEE6DFC229
- /data/data/####/cache2_0995506A517CD625DD33E66E16F48F52
- /data/data/####/cache2_0CE04F35114310BA8497A5F73C30E8CD
- /data/data/####/cache2_0DFA0F1205C35D119A6279D4734231DF
- /data/data/####/cache2_11B8C979A3093ADBA9E3071AAFCC05AB
- /data/data/####/cache2_2562B418E351DEE31240BEE717A9D3F5
- /data/data/####/cache2_27361E626107C07C9CC43BA885CD3445
- /data/data/####/cache2_3E13EDA7698645D8693E14E9250061AA
- /data/data/####/cache2_44583BF026E49ED2BF8D008B1FE7CD21
- /data/data/####/cache2_4A9A5627E5F091278C90D5C575A8D0A2
- /data/data/####/cache2_4DF2A0D53BAF47526EF39A19DCE6750E
- /data/data/####/cache2_4FF79F320794B0E99A40197C112C9FE0
- /data/data/####/cache2_5146A22B587F2C4632F8845A5B9272F0
- /data/data/####/cache2_52B609F5721D381225571F1DD857496C
- /data/data/####/cache2_5C7F7BB376C59A1D708A90134109AE8C
- /data/data/####/cache2_60B4ED2A464D3D092C5260B3C4CD9EE3
- /data/data/####/cache2_6D0DDD30CC4D43BAD313A18932739BA9
- /data/data/####/cache2_75EC6F5F91A23935277A9A8636F6924F
- /data/data/####/cache2_76D170CAEE72D593B0043194ABDE0B20
- /data/data/####/cache2_7F6F50132367CFC2166F400D224AF352
- /data/data/####/cache2_835C3E91EFC65F7209CDDD8F020C3A37
- /data/data/####/cache2_85D1D93067CA33114494005AA9E92FF1
- /data/data/####/cache2_872917233E2B7B0BA23107A6635CFFA3
- /data/data/####/cache2_916F2DC02B9226A2B0512F9C13D54D18
- /data/data/####/cache2_952D8A004613F921B38663F2824258F4
- /data/data/####/cache2_96F254D503185A9E3DD95AEE8D0317A4
- /data/data/####/cache2_9A1C1E9DEA3832ED1F574F14CD5F5465
- /data/data/####/cache2_9B78CD457649C44DD40595BB799E3F3B
- /data/data/####/cache2_A40C75BF0CC1DE576D18E9E268C1353B
- /data/data/####/cache2_BB9DA3A406BE8F7515BAC574F1847F6B
- /data/data/####/cache2_BD69ABF48D8B1738784C831253070BA0
- /data/data/####/cache2_C0C124C695CE5F0DBC53117A158FE94A
- /data/data/####/cache2_C41F8602FBC2F649CE300B97C07BAC93
- /data/data/####/cache2_D08DD0767FFA645A7A70953F5B0D25E1
- /data/data/####/cache2_D1158BA1C64C599D9CD4E80A45042D5F
- /data/data/####/cache2_D1245FA177F1A152F22B75939F16ADA6
- /data/data/####/cache2_DD63354B13CE97321571657CC62A7D99
- /data/data/####/cache2_DF5A6FC9CA039E84788D66C9548FB236
- /data/data/####/cache2_E2935BFF40BCD5B3F6A9E281E93B83B4
- /data/data/####/cache2_E799AF174F576B951932254EB2E0466A
- /data/data/####/cache2_EC8ACB09A3940EA9393C854AEDF0B402
- /data/data/####/cache2_F67343783651F6D6629F37CE94B3CD17
- /data/data/####/cache2_FFE1B239465F19EC3C96436EEDA6C0C3
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cde1be56b4e4557cc21dab95f49607dc441c848f2c256af....0.tmp
- /data/data/####/cde2f13d150535b9a46355db83c23524ac7860c13f55791....0.tmp
- /data/data/####/clean_task.xml
- /data/data/####/com.tencent.ads.main.appadconfig.xml
- /data/data/####/com.tencent.ads.main.patch.xml
- /data/data/####/com.tencent.ads.main.patch.xml.bak (deleted)
- /data/data/####/com.tencent.ads.main.tadstore.xml
- /data/data/####/com.togic.livevideo.mid.world.ro.xml
- /data/data/####/com.togic.livevideo_mdau.xml
- /data/data/####/com.togic.livevideo_preferences.xml
- /data/data/####/com.togic.livevideoodk_pri_pre_db.xml
- /data/data/####/com.togic.livevideoplayer_odk_pri_pre_db.xml
- /data/data/####/common_parameters.json
- /data/data/####/commoncfgmanager.xml
- /data/data/####/crashrecord.xml
- /data/data/####/d52567bb0cb5b64cdb688302d7ab2afb3deeb6c42cd18d6....0.tmp
- /data/data/####/default_categories_cache.json
- /data/data/####/e4087c5feddc9b4e3ccedaf8af25b0fd52d809d00f9be60....0.tmp
- /data/data/####/efd78ab188b742e0d6e648d73f46bef43879e2d57d14d9f....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f004379e2377c072e3f15990933ffc357c315a1f26cbd79....0.tmp
- /data/data/####/f9c3faf4b0f6fb3e0209c2940d52900a025802095d48f1a....0.tmp
- /data/data/####/fa1a960f1b0e9ca7ffb82f7f997d6c7e63f053a44a05d43....0.tmp
- /data/data/####/fc7d9f5d2af7e4b2b98ae57cd1ca6fa2d0d37dcfebab7ed....0.tmp
- /data/data/####/fcf6ae36480756936e04127b39fe73ec121b1f5be7c8230....0.tmp
- /data/data/####/first_sign_app_pref.xml
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/home_page_statistics.xml
- /data/data/####/http___cdn_video_51togic_com_metro_splashs_1556...pg.jpg
- /data/data/####/http___cdn_video_51togic_com_metro_splashs_1557...pg.jpg
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/last_modify_list.xml
- /data/data/####/libjiagu1173487462.so
- /data/data/####/live_tv_pref.xml
- /data/data/####/livetv.db-journal
- /data/data/####/local_crash_lock
- /data/data/####/log.mmap2
- /data/data/####/metro_pref.xml
- /data/data/####/mta_sdk_pref.xml
- /data/data/####/multi_process_list.xml
- /data/data/####/multidex.version.xml
- /data/data/####/objects.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/paramters.xml
- /data/data/####/path_statistics_file.xml
- /data/data/####/plugin_info.xml
- /data/data/####/plugin_setting.xml
- /data/data/####/podk_com.togic.livevideo_boss_cmd_vv_20190509.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/statistic.db-journal
- /data/data/####/tdata_Gfv491
- /data/data/####/tdata_Gfv491.jar
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_ZvO248
- /data/data/####/tdata_ZvO248.jar
- /data/data/####/tdata_zzW503
- /data/data/####/tdata_zzW503.jar
- /data/data/####/tencent_odk_com.togic.livevideo_5425CD0A4B7F3D8...ournal
- /data/data/####/tencent_odk_player_com.togic.livevideo_5425CD0A...ournal
- /data/data/####/tencentaccount.db
- /data/data/####/tencentaccount.db-journal
- /data/data/####/tog_pref.xml
- /data/data/####/togic_db_pref.xml
- /data/data/####/togic_event_count.xml
- /data/data/####/togic_setting.json
- /data/data/####/togic_video.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_cache_1557362734001.env
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/unisdk.jar
- /data/data/####/unisdk.xml
- /data/data/####/unisdk_init_info_pref.xml
- /data/data/####/webview.db-journal
- /data/media/####/.mid.txt
- /data/media/####/.mid.txt1000001
- /data/media/####/.nomedia
- /data/media/####/.report.dat
- /data/media/####/TogicFilter.jar
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.togic.livevideo.bin
- /data/media/####/com.togic.livevideo.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/globalInfo.ini
- /data/media/####/log.xlog
- /data/media/####/prepush_config.data
- /data/media/####/ps.dat
- /data/media/####/tdata_Gfv491
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_ZvO248
- /data/media/####/tdata_zzW503
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.togic.common.GTPush.GeiTuiPushService 24912 300 0
- cat /sys/class/net/eth0/address
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- getprop
- getprop ro.product.cpu.abi
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.togic.common.GTPush.GeiTuiPushService 24912 300 0
Загружает динамические библиотеки:
- Bugly-ktsdk
- PlayerCore_x86
- TxCodec_x86
- ckeygenerator
- getuiext2
- httpdns
- libjiagu1173487462
- marsxlog
- p2pproxy
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-NONE-PKCS1PADDING
Использует следующие алгоритмы для расшифровки данных:
- 1
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
