Adware.Gexin.14398

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cdn-cre####.unit####.uni####.com:80
TCP(HTTP/1.1) cdn-ad####.ray####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(TLS/1.0) d1qtxr7####.cloudf####.net:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) cdn-hig####.unit####.uni####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) rep####.crashly####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) analy####.ray####.com:443
TCP(TLS/1.0) cdn.on####.mobi:443
TCP(TLS/1.0) api.a####.xyz:443
TCP(TLS/1.0) redi####.network####.com:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) auction####.ads.prd.####.com:443
TCP(TLS/1.0) ads-gam####.ads.prd.####.com:443
TCP(TLS/1.0) dc1.network####.com:443
TCP(TLS/1.0) cdn-cre####.unit####.uni####.com:443
TCP(TLS/1.0) a.d####.icu:443
TCP(TLS/1.0) fk-old-####.ray####.com:443
TCP(TLS/1.0) openins####.io:443
TCP(TLS/1.0) ads.on####.mobi:443
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) avnight####.f####.myqc####.com:443
TCP(TLS/1.0) api.z####.com.####.com:443
TCP(TLS/1.0) net.ray####.com:443
TCP(TLS/1.0) sdk.adti####.com:443
TCP sdk.o####.t####.####.com:5224
TCP zb-cent####.m.ta####.com:80
TCP zb-cent####.m.ta####.com:443
TCP c####.g####.ig####.com:5225

Запросы DNS:

7j####.c####.z0.####.com
a####.b####.qq.com
a####.man.aliy####.com
a.d####.icu
ads.on####.mobi
aexcep####.b####.qq.com
ag####.m.ta####.com
amdc####.m.ta####.com
analy####.ray####.com
and####.b####.qq.com
api.a####.xyz
api.z####.com
auc####.unit####.uni####.com
avnight####.f####.myqc####.com
c####.g####.ig####.com
c-h####.g####.com
cdn-ad####.ray####.com
cdn-cre####.unit####.uni####.com
cdn-hig####.unit####.uni####.com
cdn.on####.mobi
co####.unit####.uni####.com
d1qtxr7####.cloudf####.net
dc1.network####.com
e.crashly####.com
hy####.ray####.com
m.adti####.com
net.ray####.com
openins####.io
plb####.u####.com
pub-####.qin####.com
publish####.unit####.uni####.com
redi####.network####.com
rep####.crashly####.com
sdk-ope####.g####.com
sdk.adti####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
set####.ray####.com
sett####.crashly####.com
ssl.google-####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
web####.unit####.uni####.com

Запросы HTTP GET:

cdn-ad####.ray####.com/cdn-adn/v2/dmp/19/03/02/05/40/5c79a6ded6c0f.png
cdn-ad####.ray####.com/cdn-adn/v2/offersync/19/03/05/14/25/5c7e165e78651...
cdn-ad####.ray####.com/cdn-adn/vn/19/03/05/14/38/d85ba1ce054dd25fc6a7b63...
cdn-ad####.ray####.com/cdn-adn/vn/19/03/05/14/39/529c143af821c48834b4036...
cdn-ad####.ray####.com/rv-zip-2019/0327/mini-d6e87858954a85664c30431f675...
cdn-ad####.ray####.com/rv-zip-2019/0327/tpl1-aa4da2c8c0a39d8897b79c2428a...
cdn-ad####.ray####.com/rv-zip-2019/0327/tpl2-1b4603b9cb2f164451b0caa643d...
cdn-ad####.ray####.com/rv-zip-2019/0418/endv4-64a37d4499ce1e9d92dfccf02f...
cdn-ad####.ray####.com/rv-zip-2019/0523/3like.v4-ac93047e7ae389fe98f67c0...
cdn-ad####.ray####.com/rv/endv4.html?mof=####&ec_id=####&rv_tid=####&tpl...
cdn-ad####.ray####.com/rv/endv4.html?mof=####&unit_id=####&sdk_version=#...
cdn-cre####.unit####.uni####.com/assets/5ce40be06b247f00257872dc/6587ac0...
cdn-cre####.unit####.uni####.com/assets/5ce40be06b247f00257872dc/cf69da6...
cdn-cre####.unit####.uni####.com/assets/5ce40be2cb745b0026e0769f/m31-100...
cdn-cre####.unit####.uni####.com/store-icons/b8b4862d-7c39-4671-a239-f65...
qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/config/hz-hzv6.conf
t####.c####.q####.####.com/tdata_Gfv491
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_RTc910
t####.c####.q####.####.com/tdata_TPC259

Запросы HTTP POST:

aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/0e40ef20691944fbb101a104d4351bd0
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395BeginSession.json
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionApp.json
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionDevice.cls
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionDevice.json
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionOS.json
/data/data/####/5CED36AE0195-0001-08F1-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36AF0194-0001-092E-10E57524D395.cls_temp
/data/data/####/5CED36AF0194-0001-092E-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36AF0194-0001-092E-10E57524D395BeginSession.json
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionApp.json
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionCrash.cls_temp
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionDevice.json
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionOS.json
/data/data/####/5CED36AF0194-0001-092E-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395BeginSession.json
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395SessionApp.json
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395SessionDevice.json
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395SessionOS.json
/data/data/####/5CED36B9036E-0002-08F1-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395BeginSession.json
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395SessionApp.json
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395SessionDevice.json
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395SessionOS.json
/data/data/####/5CED36BB0144-0001-0AAA-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395.cls_temp
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395BeginSession.json
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionApp.json
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionCrash.cls_temp
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionDevice.json
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionOS.json
/data/data/####/5CED36BF002D-0001-0B1C-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395BeginSession.json
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395SessionApp.json
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395SessionDevice.json
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395SessionOS.json
/data/data/####/5CED36CC01A0-0002-0B1C-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395.cls_temp
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395BeginSession.json
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionApp.json
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionCrash.cls_temp
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionDevice.json
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionOS.json
/data/data/####/5CED36CF02BF-0001-0C93-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395BeginSession.json
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395SessionApp.json
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395SessionDevice.json
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395SessionOS.json
/data/data/####/5CED36DB0242-0002-0C93-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395.cls_temp
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395BeginSession.json
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionApp.json
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionCrash.cls_temp
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionDevice.json
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionOS.json
/data/data/####/5CED36DF02BF-0001-0DDC-10E57524D395SessionUser.cls_temp
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395BeginSession.cls_temp
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395BeginSession.json
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395SessionApp.cls_temp
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395SessionApp.json
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395SessionDevice.cls_temp
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395SessionDevice.json
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395SessionOS.cls_temp
/data/data/####/5CED36E9014F-0002-0DDC-10E57524D395SessionOS.json
/data/data/####/ACCS_BINDumeng;5caafe983fc1953cd5001754.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/AliveLog.txt
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/FM_config.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/StrategyConfig
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/UUID.xml
/data/data/####/UnityAdsCache-92d4c650b3350ff763f71a0f425f4440d...f8.mp4
/data/data/####/UnityAdsCache-9dd163fc999a19d90bb941b8e647b3889...34.jpg
/data/data/####/UnityAdsCache-ac526d2c5d7f45685dd4c8b1c9bb5517d...82.jpg
/data/data/####/UnityAdsCache-b56a75de616976d2a6bce799d1aa7e39c...ff.png
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/UnityAdsTest.txt
/data/data/####/UnityAdsWebApp.html
/data/data/####/a691328cbd134165b2a12a1d6a944d3e
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/announce.xml
/data/data/####/bugly_db_legu-journal
/data/data/####/c_pkg.xml
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.google.android.gms.analytics.prefs.xml
/data/data/####/com.networkbench.agent.impl.v2_tv.i999.xml
/data/data/####/com.networkbench.agent.impl.v2_tv.i999.xml.bak
/data/data/####/core.xml
/data/data/####/crash_log_sp.xml
/data/data/####/crash_marker
/data/data/####/cv.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MDQ5OTAzODkw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MDQ5OTIwMTI0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MDQ5OTM2MzYx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU5MDQ5OTUyNDQx;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTU5MDQ5OTI5ODgw;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1NTkwNDk5MjA3OTA=;
/data/data/####/e319a2d4310840abbf5ebb43d9f147f3
/data/data/####/e75e401ec3274ce7825eac2d62d42b72
/data/data/####/e93a3a5e6f5b4c95a546953c818b6585
/data/data/####/eudemon
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fd145caa77b3
/data/data/####/gaClientId
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/google_analytics_v4.db-journal
/data/data/####/gx_sp.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&3.4.0_1559049903973_envelope.log
/data/data/####/i==1.2.0&&3.4.0_1559049920167_envelope.log
/data/data/####/i==1.2.0&&3.4.0_1559049936421_envelope.log
/data/data/####/i==1.2.0&&3.4.0_1559049952576_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.l.xml
/data/data/####/libshella-2.9.1.2.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mintegral.msdk.db-journal
/data/data/####/mintegral.xml
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/rawApiConfig.xml
/data/data/####/run.pid
/data/data/####/sa_0ae617da-f3e2-4155-a1e3-785bb449cbb5_1559049919250.tap
/data/data/####/sa_54a439bb-c004-4391-989f-ecc7b3bb3390_1559049906767.tap
/data/data/####/sa_56d75177-53c5-4c90-9f62-cead1a993155_1559049902734.tap
/data/data/####/sa_9d2cb289-2384-48a7-8b82-c2acbfb83de7_1559049952783.tap
/data/data/####/sa_a536e472-fa8b-4b55-ae16-fef3e87acd3a_1559049937951.tap
/data/data/####/sa_b542fc23-2d71-4e7a-a194-0c72715bb2e0_1559049922197.tap
/data/data/####/sa_d330457a-059f-411f-8eff-8698a34a5ba8_1559049967063.tap
/data/data/####/security_info
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/share_date.xml
/data/data/####/share_date.xml.bak (deleted)
/data/data/####/shell_config
/data/data/####/tdata_Gfv491
/data/data/####/tdata_Gfv491.jar
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_RTc910
/data/data/####/tdata_RTc910.jar
/data/data/####/tdata_TPC259
/data/data/####/tdata_TPC259.jar
/data/data/####/uij
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/media/####/-183460530
/data/media/####/.DS_Store
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/0bf843a5a34a44060e1bd1380ced3b8d.html
/data/media/####/0f9e688e29674a86f5377ae0d3b88360.zip
/data/media/####/14fbdb523b64ff891ab6453410facf84.zip
/data/media/####/1d70c3aaf4db7849b7908fb7b390c5ad
/data/media/####/37cedb858c1ae7c6f761675240d58fbe.zip
/data/media/####/3like.v4.html
/data/media/####/4a560404f15bc208a27646d4309a4dbe.zip
/data/media/####/671383996b432ab0c1cc29d16122a166.zip
/data/media/####/996168120
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/OnewaySdkWebApp.html
/data/media/####/a1de72731f97b743ffaf1061fef9f078.zip
/data/media/####/app.db
/data/media/####/b67a00e50b6dbb1349a36d4e228cd8f3.html
/data/media/####/bbcbeac74c7d36d224697bcc27b6dbb4
/data/media/####/circle.4ff7.png
/data/media/####/circle.png
/data/media/####/close.png
/data/media/####/close_v2.png
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/common.min.js
/data/media/####/cv9fdx
/data/media/####/deviceToken
/data/media/####/endv4.html
/data/media/####/endv4.js
/data/media/####/endv4.scss
/data/media/####/f6f9dcbae42701646dad1ba34156374a.zip
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/icon-mtg.7962.png
/data/media/####/icon-mtg.png
/data/media/####/loading.gif
/data/media/####/logo-black.png
/data/media/####/logo-gray.7b49.png
/data/media/####/logo-gray.png
/data/media/####/mini.html
/data/media/####/privacy.png
/data/media/####/rv_bg_0.jpg
/data/media/####/rv_bg_1.jpg
/data/media/####/rv_bg_2.jpg
/data/media/####/sound_close.png
/data/media/####/sound_off_v2.png
/data/media/####/sound_open.png
/data/media/####/sound_open_v2.png
/data/media/####/star-gray.bccb.png
/data/media/####/star-gray.png
/data/media/####/star-yellow.070f.png
/data/media/####/star-yellow.png
/data/media/####/star.png
/data/media/####/star1.png
/data/media/####/subscripts.0971.png
/data/media/####/subscripts.png
/data/media/####/sysid.dat
/data/media/####/tdata_Gfv491
/data/media/####/tdata_MkX219
/data/media/####/tdata_RTc910
/data/media/####/tdata_TPC259
/data/media/####/test.log
/data/media/####/tpl1.html
/data/media/####/tpl1.js
/data/media/####/tpl2.html
/data/media/####/tpl2.js
/data/media/####/tv.i999.bin
/data/media/####/tv.i999.db
/data/media/####/user-gray.072c.png
/data/media/####/user-gray.png

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5caafe983fc1953cd5001754","utdid":"XO02r8Z0k7gDAGdzx1EoVXXq","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.Service.PushService 23556 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.1.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
mount
ps
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.Service.PushService 23556 300 0

Загружает динамические библиотеки:

Bugly
getuiext2
libnfix
libshella-2.9.1.2
libufix
nfix
tnet-3.1
ufix

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней