Adware.Gexin.17285

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) qfy.innot####.com:80
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) cfg.a####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) h####.1####.com:80
TCP(HTTP/1.1) m####.3g.qq.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) qfc.innot####.com:80
TCP(HTTP/1.1) apk.1####.com:80
TCP(HTTP/1.1) rcv.a####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) st####.1####.com.####.com:80
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) l####.cmpass####.com:9443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) co####.cmpass####.com:443
TCP(TLS/1.0) cdn.a####.com.####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) static####.qutou####.net:443
TCP(TLS/1.0) message####.1####.com:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5226
UDP 1####.168.119.1:137

Запросы DNS:

7j####.c####.z0.####.com
a####.man.aliy####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.shu####.cn
api.w####.com
apk.1####.com
c-h####.g####.com
cdn.a####.com
cfg.a####.com
cm-1####.ig####.com
co####.cmpass####.com
cpc-st####.1####.com
daa.shu####.cn
dai.shu####.cn
ddd.1####.com
h####.1####.com
i####.1####.com
l####.cmpass####.com
l####.tbs.qq.com
log.1####.com
m####.3g.qq.com
message####.1####.com
qfc.innot####.com
qfy.innot####.com
rcv.a####.com
recall-####.1####.com
res####.a####.com
sdk-glo####.a####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.1####.com
static####.qutou####.net
upd####.a####.com

Запросы HTTP GET:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&tuid=#...
api.1####.com/app/coldStart?lon=####&tuid=####&device_code=####&OSVersio...
api.1####.com/app/coldStart?lon=####&tuid=####&device_code=####&plugins=...
api.1####.com/app/getAdConfig?lon=####&tuid=####&device_code=####&OSVers...
api.1####.com/app/getCloudPluginV3?os=####&lon=####&tuid=####&device_cod...
api.1####.com/app/getConfig?lon=####&tuid=####&device_code=####&OSVersio...
api.1####.com/app/getGuide?lon=####&tuid=####&device_code=####&OSVersion...
api.1####.com/app/getResource?os=####&lon=####&tuid=####&device_code=###...
api.1####.com/app/start?model=####&tuid=####&OSVersion=####&from=####&tk...
api.1####.com/component/getFeComponentInfo?name=####&currtime=####&sign=...
api.1####.com/content/getDefaultChannelList?lon=####&tuid=####&device_co...
api.1####.com/remain/getIncreaseRead?lon=####&tuid=####&device_code=####...
apk.1####.com/qukan_resource_emoji_244_302.apk
cfg.a####.com/reqMotPkgLst
h####.1####.com/qukan_resource_emoji_244_302.apk
h####.1####.com/qukan_resource_level_897_295.apk
h####.1####.com/search_middle/release/middle/static/release/middle.zip?l...
i####.1####.com/module_detail/release/template/release/static/template.z...
i####.1####.com/module_detail/release/template/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip....
log.1####.com/a.gif?lon=####&tuid=####&device_code=####&OSVersion=####&d...
log.1####.com/a.gif?tuid=####&OSVersion=####&tk=####&network=####&versio...
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_LRe817
q####.c####.l####.####.com/tdata_OxN092
q####.c####.l####.####.com/tdata_bca864
q####.c####.l####.####.com/tdata_yFl369
rcv.a####.com/trace?op1=####&op2=####&op3=####&opt_v=####&t=####
st####.1####.com.####.com/image/sp/2019/06/04/5cf5d99d6d9c7.png
st####.1####.com.####.com/image/sp/2019/08/18/5d583d539b000.jpg?imageVi#...
st####.1####.com.####.com/image/sp/2019/08/18/5d583d539caec.jpg?imageVi#...
st####.1####.com.####.com/image/sp/2019/08/18/5d583d539d18b.jpg?imageVi#...
st####.1####.com.####.com/lw/img/2019/08/12/6d4a421d83103874fa8eff0cf306...
st####.1####.com.####.com/lw/img/2019/08/12/8dcc4b04b7ad5c67c6c7de165925...
st####.1####.com.####.com/lw/img/2019/08/12/e7fa96cb1de91a9bcd8bd12340eb...
st####.1####.com.####.com/lw/img/2019/08/17/189c5b473db1584180580cd07836...
st####.1####.com.####.com/qupost/avatar/2017/07/26/e9de955dc5c6fd6f084b1...
st####.1####.com.####.com/qupost/avatar/2018/03/13/824e4a3b67ca60762da5d...
st####.1####.com.####.com/qupost/images/2019/08/17/1566002920458354815.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566032408381120218.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566032408528556082.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566032408532207764.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566033634118411458.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566033634147711381.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566033634190939762.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566049089695897931.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566049102985388497.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566049112632284347.j...

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.1####.com/member/isDeviceReport
api.1####.com/operate/resource/openScreen
c-h####.g####.com/api.php?format=####&t=####
cfg.a####.com/req?aid=####
ddd.1####.com/report
l####.tbs.qq.com/ajax?c=####&k=####
m####.3g.qq.com/
qfc.innot####.com/report/v1
qfy.innot####.com/report/v1
sdk-ope####.g####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/0df678a7f3143bbd019b845ec9cebd2d
/data/data/####/1004
/data/data/####/1273315c98dc93daad755a2deb80e7a9bf615f2ff19c07e....0.tmp
/data/data/####/31a73eea107bed3e40b7a714fd388e8dad034a5f1ebcf54....0.tmp
/data/data/####/33dc66fec7e7ba152c7b57c1582d22a3
/data/data/####/3bc2a9c98575c5b0f15dc44155ddaba8
/data/data/####/4077e5503ef4b24525f37558ff2a91f7
/data/data/####/4f6f7cce76c1c7ae2c90613d6118ab55e0b5026f057a543....0.tmp
/data/data/####/53e04345727d00ad66c79d76867af6234c33a177855e6be....0.tmp
/data/data/####/578B62A16DA3AC930921316D40FC750B.so
/data/data/####/5c0251ab95b2fe23d91eaca169a1aa10d5d6cc89668a2a4....0.tmp
/data/data/####/5c5618199b769ea76111c72c1159d02f
/data/data/####/5c5618199b769ea76111c72c1159d02f.tmp
/data/data/####/5da5b3044a11caadb5089407d32a17d396c86de2c93b351....0.tmp
/data/data/####/7df06928118406ec392296de37d370838622f482f5dc61a....0.tmp
/data/data/####/7e78d79200e8112826994e4d8aa4f911
/data/data/####/7e78d79200e8112826994e4d8aa4f911.tmp
/data/data/####/826323f8e625037fca9ee615af2eb214.ttf
/data/data/####/8b80d1f1454364d02480201d347645e9e34492d1cc60850....0.tmp
/data/data/####/94d629bb19e544eb9f015c7121178dfa63d273a01d6beaf....0.tmp
/data/data/####/9f35e08a2dfd48e4863e906f61dcf7c6dd4b2968b1ec656....0.tmp
/data/data/####/ACCS_SDK.xml
/data/data/####/ACemark.i
/data/data/####/ACopenid.i
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/InnoEndTime.i
/data/data/####/Inno_xjl.i
/data/data/####/MessageStore.db
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room
/data/data/####/QK_room-journal
/data/data/####/QK_room-shm
/data/data/####/QK_room-wal
/data/data/####/SupportABImpl.xml
/data/data/####/T-75Z-FaSJDyxNVErZEtlU_QTIrBMZ1o
/data/data/####/T-V6Er7SuoZgkRJLQ6vNDkEtNoWkZt-j
/data/data/####/T-ukRKACpnHAB_EorpW9METwDUSAbCVO
/data/data/####/T028wkAM3VyUSw9JCbkA0EnfRRHVLMKy
/data/data/####/T1534EOcemlex7SAjre4Y0VQAOgxwq9L
/data/data/####/T2tdab1OXEoPV2LPHbUXb0q-iC-V36bW
/data/data/####/T3A-U2w7ii_SsnUNZohFpE0WmhSTaNy1
/data/data/####/T3N1smi-PH0Il3ZsrJDRskhcboJyk9cZ
/data/data/####/T4FDeNV0CSkqdQ3VKJdYk0hMVPBpBKm_
/data/data/####/T4HhGA-HFmECKOUao6VnsEFv2gTyvNHB
/data/data/####/T4I1DvO4vGP-JX9I9Lx2U0dLHnBLPw1j
/data/data/####/T4gL1yWy4AJLMO1iJIksuUYpSuTu87xv
/data/data/####/T5Tl4kgtCQYVm5YU8LkapkS5zFjSfYC9
/data/data/####/T7lz3BAV7fE1its3xrXDqkOZDBWhLrWK
/data/data/####/T7reJE0BvtPIxx_yXaUw4ki7qOACzkVA
/data/data/####/T9qD8xzEmmSyWZlYH41RqkjUgus0wB8x
/data/data/####/TMSPropertiesb_d_pre.xml
/data/data/####/TMSPropertiesw_s_c.xml
/data/data/####/T_6Ot1Uc5OgDwcMYj40_-0AhCOkG65dF
/data/data/####/T_9o37GLyaisGYPAobTt20_GXhmWHFMi
/data/data/####/TwWsfD1yZRuUUO4uAocArkvNacpJslFx
/data/data/####/TyXvhf41YX-YKEPSHY0hTUGoHSp3-qKg
/data/data/####/TyYE6jJ73od7EpJS6JfJxk7eMVrfbakG
/data/data/####/_aisdk_local.dex
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_s_base_switch.xml
/data/data/####/a4924e836173cf7fc28a31a39d60ef9d4e6913d480e05d0....0.tmp
/data/data/####/a9400f1d69ce074a74ad9d773117d3335dd6183d0f559af....0.tmp
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/adfa04472e77aac424f5b0eb780b98bfb404e321a60aab6....0.tmp
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/appRunTime.i
/data/data/####/avatar_default-5610d054.png
/data/data/####/ba32c19d7e3856110f62d20bc036264d.0.tmp
/data/data/####/ba32c19d7e3856110f62d20bc036264d.1.tmp
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/c1e7916b2395039ae326f75c821ac5cd9d2518866cfec3c....0.tmp
/data/data/####/c8404d2c0186f69f899217b49e1013a3c92370db328a3b5....0.tmp
/data/data/####/cmd_data_tracker_v2.db
/data/data/####/cmd_data_tracker_v2.db-journal
/data/data/####/cmd_data_tracker_v2.db_pushservice
/data/data/####/cmd_data_tracker_v2.db_pushservice-journal
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.iclicash.advlib.xml.bak (deleted)
/data/data/####/com.jifen.acReportCount.i
/data/data/####/com.jifen.acacid.i
/data/data/####/com.jifen.accuid.i
/data/data/####/com.jifen.accuid2.i
/data/data/####/com.jifen.acncuid.i
/data/data/####/com.jifen.opopenidcom.jifen.qukan.i
/data/data/####/com.jifen.qkbase.web.template.source.SourceManager.xml
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan.xml (deleted)
/data/data/####/com.jifen.qukan.xml.bak
/data/data/####/com.jifen.qukan.xml.bak (deleted)
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/common.536c570e.js
/data/data/####/common.56725196.js
/data/data/####/common.9c88e62c.css
/data/data/####/common.aa0a2cf4.css
/data/data/####/common.acbf1d6f.css
/data/data/####/common.f5e3c832.js
/data/data/####/config.json
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/d04a57521a2f7850152103b022e13aeccbb04ae50764026....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTY2MDcxMjI4NzE1;
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_tracker_v2.db
/data/data/####/data_tracker_v2.db-journal
/data/data/####/data_tracker_v2.db_pushservice
/data/data/####/data_tracker_v2.db_pushservice-journal
/data/data/####/de5b8d8b41582d2f75114de868ee3c70eabfd410118a0c3....0.tmp
/data/data/####/debug.conf
/data/data/####/dn_163
/data/data/####/download.zip
/data/data/####/download_upload
/data/data/####/e26a6d3294a07c90b350e5fd8f135bcb078cd479e37d21f....0.tmp
/data/data/####/e8b36168f13c9f58ae37509c2d9bd0b9.0.tmp
/data/data/####/e8b36168f13c9f58ae37509c2d9bd0b9.1.tmp
/data/data/####/emoji.apk
/data/data/####/emoji.cfg
/data/data/####/emoji.dex
/data/data/####/emoji.md5
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f0ae3b08c18d63bd7d38932ef8d0377b288661fa2298f66....0.tmp
/data/data/####/f4747c234b0f608a33b61a13613e44a9418a6b419aa6118....0.tmp
/data/data/####/f4747c234b0f608a33b61a13613e44a9418a6b419aa6118...6abf.0
/data/data/####/fb64117c959a735b2f7f36095560fa8ed9754568f012d15....0.tmp
/data/data/####/finch.db
/data/data/####/finch.db-journal
/data/data/####/first_page_fy.xml
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_cache.xml.bak (deleted)
/data/data/####/i==1.2.0&&3.9.37.000.0806.1948_1566071227855_envelope.log
/data/data/####/ic_return-c01af319.png
/data/data/####/ic_search-a9054d83.png
/data/data/####/icon-delete-7e1541c7.png
/data/data/####/icon-history-28be26f0.png
/data/data/####/icon-hotnews-3b31a624.png
/data/data/####/icon_article-77ec0e08.png
/data/data/####/icon_close_search-bf54bcc6.png
/data/data/####/icon_hot-fccf250e.png
/data/data/####/icon_more-9568d56c.png
/data/data/####/icon_picture-03fc07e6.png
/data/data/####/icon_play-bcdf2dfb.png
/data/data/####/icon_qutoutiaohao-98fbbebd.png
/data/data/####/icon_success-fac4a5d6.png
/data/data/####/icon_video-567efe5a.png
/data/data/####/icon_vip-d40ce791.png
/data/data/####/icon_wemedia_more-897cdcb9.png
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/innoBattery.i
/data/data/####/innoBm.i
/data/data/####/innoMacs.i
/data/data/####/innoMacs.i (deleted)
/data/data/####/inno_YKsuccessTime.i
/data/data/####/inno_acidSour.i
/data/data/####/inno_acidSour.i (deleted)
/data/data/####/inno_cuidSour.i
/data/data/####/inno_dbcreat.i
/data/data/####/inno_ipv6.i
/data/data/####/inno_ipv6.i (deleted)
/data/data/####/inno_isDir.i
/data/data/####/inno_last_soFErr.i
/data/data/####/inno_ncuid.i
/data/data/####/inno_ot.i
/data/data/####/inno_soMd5.i
/data/data/####/inno_soName.i
/data/data/####/inno_successdate_nt.i
/data/data/####/innotechBlackApps.i
/data/data/####/innotechBlackFile.i
/data/data/####/innotechBlackFileVersion.i
/data/data/####/innotechBlackUp.i
/data/data/####/innotechBlackUpVersion.i
/data/data/####/innotechBlackVersion.i
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/level.apk
/data/data/####/level.dex
/data/data/####/level.md5
/data/data/####/libijkffmpeg.so
/data/data/####/libijkffmpeg.so.md5
/data/data/####/libijkplayer.so
/data/data/####/libijkplayer.so.md5
/data/data/####/libijksdl.so
/data/data/####/libijksdl.so.md5
/data/data/####/libjiagu-1385524905.so
/data/data/####/libquid.so
/data/data/####/libxyvodsdk.so
/data/data/####/libxyvodsdk.so.md5
/data/data/####/lite_qkbase.xml
/data/data/####/loading-6525f20e.gif
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/main_metadata
/data/data/####/main_metadata.bak
/data/data/####/middle.0b932444.css
/data/data/####/middle.a4ab3173.js
/data/data/####/middle.html
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/noactivity-eaac7382.png
/data/data/####/noresult-e375458a.png
/data/data/####/open_screen_image.png
/data/data/####/pdm.db
/data/data/####/pdm.db-journal
/data/data/####/pref.xml
/data/data/####/proc_monitor_local_rec_main.xml
/data/data/####/proc_monitor_local_rec_push.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_app_optsp.xml
/data/data/####/qk_push_sp.xml
/data/data/####/qk_push_sp.xml.bak (deleted)
/data/data/####/run.pid
/data/data/####/search_middle.zip
/data/data/####/security_info
/data/data/####/so.zip
/data/data/####/ssoconfigs.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/statistic_all_new_log.db_pushservice
/data/data/####/statistic_all_new_log.db_pushservice-journal
/data/data/####/sys_log_1566071197255299.txt
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_LRe817
/data/data/####/tdata_LRe817.jar
/data/data/####/tdata_OxN092
/data/data/####/tdata_OxN092.jar
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.jar
/data/data/####/tdata_yFl369
/data/data/####/tdata_yFl369.jar
/data/data/####/temp_jclip.i
/data/data/####/temp_ogrder.i
/data/data/####/temp_ogvd.i
/data/data/####/temp_ogver.i
/data/data/####/tempfile
/data/data/####/template.47713dc8.css
/data/data/####/template.65ab0161.css
/data/data/####/template.8405f2b4.js
/data/data/####/template.c3a45211.js
/data/data/####/template.html
/data/data/####/timer_ab.xml
/data/data/####/timer_rewards.xml
/data/data/####/tmsdk_dualsim_shark.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/vendor.0678e785.js
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/weibo_sdk_aid1
/data/data/####/wifi_signal_table
/data/data/####/wifi_signal_table-journal
/data/data/####/zipPre.bfde96c6.js
/data/media/####/.2e1b3.openidcom.jifen.qukan
/data/media/####/.48504.acid
/data/media/####/.5454a.openidcom.jifen.qukan
/data/media/####/.79594.cuid2
/data/media/####/.80662.acid
/data/media/####/.8e8b2.ncuid
/data/media/####/.98ff3.cuid2
/data/media/####/.98ff3.openidcom.jifen.qukan
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.aio.dat
/data/media/####/.b11dd.cuid
/data/media/####/.b11dd.cuid2
/data/media/####/.c3418.acid
/data/media/####/.com.jifen.ac.ReportCount
/data/media/####/.com.jifen.ac.acid
/data/media/####/.com.jifen.ac.cuid
/data/media/####/.com.jifen.ac.cuid2
/data/media/####/.com.jifen.ac.ncuid
/data/media/####/.com.jifen.op.openidcom.jifen.qukan
/data/media/####/.e84e3.cuid
/data/media/####/.e84e3.ncuid
/data/media/####/.e8b74.cuid
/data/media/####/.nomedia
/data/media/####/.quid
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a38579f9747b93a04b757e18de46a51c
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/cf_lk_2.dat
/data/media/####/cf_st_2.dat
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/crash-2019-08-17.log
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tbslog.txt
/data/media/####/tdata_LRe817
/data/media/####/tdata_OxN092
/data/media/####/tdata_bca864
/data/media/####/tdata_yFl369
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/app_bin/daemon
chmod 700 <Package Folder>/files/gdaemon_20161017
date
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
getprop ro.smartisan.version
getprop ro.vivo.os.version
id
logcat -d -v threadtime
ls -i
ls -l
ls -l /system/xbin/su
ls /dev/socket
ls /sys/class/thermal
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/devices
sh -c cat /proc/meminfo
sh -c cat /proc/mounts
sh -c cat /proc/partitions
sh -c cat /proc/self/maps
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh -c echo NEEzRTgzRkU0QjRFNzM5MjBGODg4NkE1MjUwRTk3MDI5ODMzM0Q6RDg0NEY1OjBBQURDOA== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo NEEzRTgzRkU0QjRFNzM5MjBGODg4NkE1MjUwRTk3MDI5ODMzM0Q6RDg0NEY1OjBBQURDOA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo OEY5QTY2MDEzMjI2MERBQzBGRTcyREJBNTQ0OUQ3QzUxNDg2MkY6OUI0NjcwOkU3QkQ5Mw== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo OEY5QTY2MDEzMjI2MERBQzBGRTcyREJBNTQ0OUQ3QzUxNDg2MkY6OUI0NjcwOkU3QkQ5Mw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RTBEMTczOEFCQUI5NDdEMTVDQUJCRUY5RDE1RDM2RDkxNTY2MDcxMjI0 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo RTBEMTczOEFCQUI5NDdEMTVDQUJCRUY5RDE1RDM2RDkxNTY2MDcxMjI0 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh <Package Folder>/files/T-75Z-FaSJDyxNVErZEtlU_QTIrBMZ1o
sh <Package Folder>/files/T-V6Er7SuoZgkRJLQ6vNDkEtNoWkZt-j
sh <Package Folder>/files/T-ukRKACpnHAB_EorpW9METwDUSAbCVO
sh <Package Folder>/files/T028wkAM3VyUSw9JCbkA0EnfRRHVLMKy
sh <Package Folder>/files/T1534EOcemlex7SAjre4Y0VQAOgxwq9L
sh <Package Folder>/files/T2tdab1OXEoPV2LPHbUXb0q-iC-V36bW
sh <Package Folder>/files/T3A-U2w7ii_SsnUNZohFpE0WmhSTaNy1
sh <Package Folder>/files/T3N1smi-PH0Il3ZsrJDRskhcboJyk9cZ
sh <Package Folder>/files/T4FDeNV0CSkqdQ3VKJdYk0hMVPBpBKm_
sh <Package Folder>/files/T4HhGA-HFmECKOUao6VnsEFv2gTyvNHB
sh <Package Folder>/files/T4I1DvO4vGP-JX9I9Lx2U0dLHnBLPw1j
sh <Package Folder>/files/T4gL1yWy4AJLMO1iJIksuUYpSuTu87xv
sh <Package Folder>/files/T5Tl4kgtCQYVm5YU8LkapkS5zFjSfYC9
sh <Package Folder>/files/T7lz3BAV7fE1its3xrXDqkOZDBWhLrWK
sh <Package Folder>/files/T9qD8xzEmmSyWZlYH41RqkjUgus0wB8x
sh <Package Folder>/files/T_6Ot1Uc5OgDwcMYj40_-0AhCOkG65dF
sh <Package Folder>/files/T_9o37GLyaisGYPAobTt20_GXhmWHFMi
sh <Package Folder>/files/TwWsfD1yZRuUUO4uAocArkvNacpJslFx
sh <Package Folder>/files/TyXvhf41YX-YKEPSHY0hTUGoHSp3-qKg
sh <Package Folder>/files/TyYE6jJ73od7EpJS6JfJxk7eMVrfbakG
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat app
stat cat
stat etc
stat net
stat random
uname -a

Загружает динамические библиотеки:

Bugly
InnoSecure
InnoSo
NativeExample
du
getuiext3
libTmsdk-2.0.8-dual-mfr
libijkffmpeg
libijkplayer
libijksdl
libjiagu-1385524905

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней