Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) q####.c####.l####.####.com:80
- TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) ip.adi####.net:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ki####.ipad####.com:80
- TCP(HTTP/1.1) b####.soui####.com:80
- TCP(HTTP/1.1) ip.s####.org:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(TLS/1.0) bis####.miaosha####.com:443
- TCP(TLS/1.0) 1####.217.20.106:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) gd-s####.j####.cn:443
- TCP(TLS/1.0) ip.adi####.net:443
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) t####.j####.cn:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) bj####.j####.cn:443
- TCP(TLS/1.0) 1####.217.20.74:443
- TCP(TLS/1.2) safebro####.google####.com:443
- TCP(TLS/1.2) 2####.58.208.110:443
- TCP(TLS/1.2) 1####.217.17.142:443
- TCP(TLS/1.2) 1####.217.20.74:443
- TCP(TLS/1.2) 1####.217.168.195:443
- TCP cm-1####.ig####.com:5224
- TCP sdk.o####.t####.####.com:5224
- TCP 1####.25.50.79:7005
- UDP sis.j####.io:19000
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.exc.mob.com
- ali-s####.j####.cn
- and####.b####.qq.com
- api.ipad####.com
- b####.soui####.com
- bis####.miaosha####.com
- bj####.j####.cn
- c####.mm####.com
- c####.wee####.cn
- c-h####.g####.com
- c.c####.com
- cdn-sdk####.g####.com
- cdn.ipad####.com
- cm-1####.ig####.com
- easytom####.com
- gd-s####.j####.cn
- instant####.google####.com
- ip.adi####.net
- ip.s####.org
- ip.ta####.com
- ki####.ipad####.com
- md####.google####.com
- p####.google####.com
- s####.adi####.net
- s.j####.cn
- s23.c####.com
- safebro####.google####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.ipad####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sis.j####.io
- t####.j####.cn
- z5.c####.com
Запросы HTTP GET:
- b####.soui####.com/app/trans/705766?bookstore=####&t=####&tk=####&channe...
- b####.soui####.com/book/sso/chapter?bid=####&cid=####&envirment=####
- b####.soui####.com/h5_api/book/chapter_list?bid=####&position=####&size=...
- b####.soui####.com/h5_api/book/detail_info?bid=####
- b####.soui####.com/h5_api/product_h5_setup/config?city=####&domain=####&...
- cdn-sdk####.g####.com.####.com/tdata_EDB102
- cdn-sdk####.g####.com.####.com/tdata_HNa879
- d####.c####.l####.####.com/cover_705766_180x240
- ip.adi####.net/api/ad/ad/sendDeviceInfo
- ip.adi####.net/dspapi/ad/getH5Ad?inClient=1&product=20239&ad_channal_cod...
- ip.adi####.net/extra/information/getInformation?positionId=####&acc=####
- ip.adi####.net/extra/information/list?acc=####
- ip.adi####.net/extra/rp/cu?a=####&at=####&d=####&h=####&i=####&p=####&s=...
- ip.adi####.net/extra/rp/su?a=####&at=####&d=####&h=####&i=####&p=####&s=...
- ip.adi####.net/ip/h5/ver/control/get?type=####
- ip.s####.org/geoip
- ip.ta####.com/service/getIpInfo.php?ip=####
- ip.ta####.com/service/getIpInfo2.php?ip=####
- ki####.ipad####.com/book/getjs?productId=####&channel=####
- q####.c####.l####.####.com/config/hz-hzv6.conf
- q####.c####.l####.####.com/tdata_BAI450
- sdk.o####.p####.####.com/api/addr.htm
- ti####.c####.l####.####.com/bs/images/chasing_dots.png?ver=####
- ti####.c####.l####.####.com/bs/static/css/app.cde5d475.css
- ti####.c####.l####.####.com/bs/static/css/chunk-27e89726.10091821.css
- ti####.c####.l####.####.com/bs/static/css/chunk-2cd24d46.dbe41140.css
- ti####.c####.l####.####.com/bs/static/css/chunk-2ce55d9b.e3f93300.css
- ti####.c####.l####.####.com/bs/static/css/chunk-3a5861c9.cc975fcb.css
- ti####.c####.l####.####.com/bs/static/css/chunk-3a9e36d0.5c36a07e.css
- ti####.c####.l####.####.com/bs/static/css/chunk-45b6e9d4.c5db3e2d.css
- ti####.c####.l####.####.com/bs/static/css/chunk-493f8bd8.4df63762.css
- ti####.c####.l####.####.com/bs/static/css/chunk-4d22b4ca.2e94de06.css
- ti####.c####.l####.####.com/bs/static/css/chunk-4f8d2a24.0bedbbee.css
- ti####.c####.l####.####.com/bs/static/css/chunk-5c0a86cb.81560803.css
- ti####.c####.l####.####.com/bs/static/css/chunk-5d9c3d4d.60a684eb.css
- ti####.c####.l####.####.com/bs/static/css/chunk-6891e0b8.a1a2aa11.css
- ti####.c####.l####.####.com/bs/static/css/chunk-6ab4e262.307baf48.css
- ti####.c####.l####.####.com/bs/static/css/chunk-74d8d23e.df861e11.css
- ti####.c####.l####.####.com/bs/static/css/chunk-7c81dd9e.96e192d8.css
- ti####.c####.l####.####.com/bs/static/css/chunk-a71b30c4.bcc05bda.css
- ti####.c####.l####.####.com/bs/static/css/chunk-e6ade8bc.6d1c3679.css
- ti####.c####.l####.####.com/bs/static/css/chunk-eb98a71a.085de04b.css
- ti####.c####.l####.####.com/bs/static/css/chunk-vendors.ae7b036e.css
- ti####.c####.l####.####.com/bs/static/css/comments.9e8b777b.css
- ti####.c####.l####.####.com/bs/static/css/components.38f40172.css
- ti####.c####.l####.####.com/bs/static/css/local-book.c5a5583e.css
- ti####.c####.l####.####.com/bs/static/css/readers.d611fb78.css
- ti####.c####.l####.####.com/bs/static/css/task.4aafeb99.css
- ti####.c####.l####.####.com/bs/static/img/Last_chapter.1fcce983.png
- ti####.c####.l####.####.com/bs/static/img/a+.8086bb01.png
- ti####.c####.l####.####.com/bs/static/img/a-.ea01b2fd.png
- ti####.c####.l####.####.com/bs/static/img/banner_shh.b1af7b55.png
- ti####.c####.l####.####.com/bs/static/img/bookshelf.d7118af7.png
- ti####.c####.l####.####.com/bs/static/img/catalog.aed48c92.png
- ti####.c####.l####.####.com/bs/static/img/close.0da54d3b.png
- ti####.c####.l####.####.com/bs/static/img/gl.7c93ebf6.png
- ti####.c####.l####.####.com/bs/static/img/h5comments.5a3a8dc0.png
- ti####.c####.l####.####.com/bs/static/img/login_tip_icon.c47d1a09.png
- ti####.c####.l####.####.com/bs/static/img/night.6a5d4439.png
- ti####.c####.l####.####.com/bs/static/img/reward_end_tip_title.b559c206....
- ti####.c####.l####.####.com/bs/static/img/rp_icon_num.678b84b3.png
- ti####.c####.l####.####.com/bs/static/img/sx.4e7be487.png
- ti####.c####.l####.####.com/bs/static/img/syq.e22688a6.png
- ti####.c####.l####.####.com/bs/static/img/task_title_icon.318798a5.png
- ti####.c####.l####.####.com/bs/static/img/theme.47db62e1.png
- ti####.c####.l####.####.com/bs/static/img/tx.127028bf.png
- ti####.c####.l####.####.com/bs/static/js/app.9da7f944.js
- ti####.c####.l####.####.com/bs/static/js/chunk-27e89726.7d102d86.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2cd24d46.196f7ada.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2ce55d9b.407d5719.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0aab96.ac93d57e.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0ac448.4295f32a.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0b27b5.79d36548.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0b6359.86842b31.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0b6aec.62de134c.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0df288.79ef942d.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0e5da1.3ce68656.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0e5fac.4373afae.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0e95df.714749d8.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d0f026d.9d24b350.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d21f251.f0dd1213.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d225814.cf702461.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d225b9a.af8d43a0.js
- ti####.c####.l####.####.com/bs/static/js/chunk-2d22d014.9ed1ba84.js
- ti####.c####.l####.####.com/bs/static/js/chunk-3a5861c9.2bfdd92a.js
- ti####.c####.l####.####.com/bs/static/js/chunk-3a9e36d0.77e979d5.js
- ti####.c####.l####.####.com/bs/static/js/chunk-45b6e9d4.8f452409.js
- ti####.c####.l####.####.com/bs/static/js/chunk-493f8bd8.a60ac72d.js
- ti####.c####.l####.####.com/bs/static/js/chunk-4d22b4ca.8d13d761.js
- ti####.c####.l####.####.com/bs/static/js/chunk-4f8d2a24.c06d2ce1.js
- ti####.c####.l####.####.com/bs/static/js/chunk-5c0a86cb.45bc9556.js
- ti####.c####.l####.####.com/bs/static/js/chunk-5d9c3d4d.411dfc57.js
- ti####.c####.l####.####.com/bs/static/js/chunk-6891e0b8.68c89165.js
- ti####.c####.l####.####.com/bs/static/js/chunk-6ab4e262.784ff7ad.js
- ti####.c####.l####.####.com/bs/static/js/chunk-74d8d23e.1b1c1917.js
- ti####.c####.l####.####.com/bs/static/js/chunk-7c81dd9e.3ce82b00.js
- ti####.c####.l####.####.com/bs/static/js/chunk-a71b30c4.bd91bd9a.js
- ti####.c####.l####.####.com/bs/static/js/chunk-e6ade8bc.df2aab94.js
- ti####.c####.l####.####.com/bs/static/js/chunk-eb98a71a.9d7115a7.js
- ti####.c####.l####.####.com/bs/static/js/chunk-vendors.72ad69a7.js
- ti####.c####.l####.####.com/bs/static/js/comments.418b3b4f.js
- ti####.c####.l####.####.com/bs/static/js/components.fb832027.js
- ti####.c####.l####.####.com/bs/static/js/local-book.1cedbf58.js
- ti####.c####.l####.####.com/bs/static/js/readers.ada6e80f.js
- ti####.c####.l####.####.com/bs/static/js/task.1d81a659.js
- ti####.c####.l####.####.com/jssdk/v3/combo.bundle.js?ver=####
Запросы HTTP POST:
- a####.exc.mob.com/errconf
- and####.b####.qq.com/rqd/async?aid=####
- c-h####.g####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.artc_lock
- /data/data/####/.at_lock
- /data/data/####/.dex2oatlock
- /data/data/####/.dic_lock
- /data/data/####/.duid
- /data/data/####/.globalLock
- /data/data/####/.im_lock
- /data/data/####/.lesd_lock
- /data/data/####/.lock
- /data/data/####/.pg_lock
- /data/data/####/.pgs_lock
- /data/data/####/.updateIV.dat
- /data/data/####/.updateIV.dat_0
- /data/data/####/.updateIV.dat_1
- /data/data/####/.vpl_lock
- /data/data/####/0000000lllll_0.dex
- /data/data/####/0000000lllll_1.dex
- /data/data/####/000O00ll111l_0.dex
- /data/data/####/000O00ll111l_1.dex
- /data/data/####/00O000ll111l_0.dex
- /data/data/####/00O000ll111l_0.dex (deleted)
- /data/data/####/00O000ll111l_0.dex.flock
- /data/data/####/00O000ll111l_0.dex.flock (deleted)
- /data/data/####/00O000ll111l_1.dex
- /data/data/####/00O000ll111l_1.dex (deleted)
- /data/data/####/00O000ll111l_1.dex.flock
- /data/data/####/00O000ll111l_1.dex.flock (deleted)
- /data/data/####/01b4c0b204465c94_0
- /data/data/####/01b4c0b204465c94_1
- /data/data/####/072654e6f94acc37_0
- /data/data/####/0OO00l111l1l
- /data/data/####/0OO00l111l1l.lock
- /data/data/####/0c1e1d33d8ae3fb5_0
- /data/data/####/0c1e1d33d8ae3fb5_1
- /data/data/####/0c54d1c32a87db3c_0
- /data/data/####/0d0cf149b8393ce7_0
- /data/data/####/1002
- /data/data/####/1004
- /data/data/####/10d620ee8c773259_0
- /data/data/####/10d620ee8c773259_1
- /data/data/####/113161bbc0c7b231_0
- /data/data/####/121c1ab09006ff6b_0
- /data/data/####/12ccb086fbe69a8e_0
- /data/data/####/1773105b9a2271ad_0
- /data/data/####/185d8cdb55a3b942_0
- /data/data/####/185d8cdb55a3b942_1
- /data/data/####/27663e22f71595d6_0
- /data/data/####/28f284149e1009dd_0
- /data/data/####/28f284149e1009dd_1
- /data/data/####/2a5b9c59-f7a4-446a-bed2-b065120a883f
- /data/data/####/2add5037e1466784_0
- /data/data/####/2b830872b09c07e9_0
- /data/data/####/2b830872b09c07e9_1
- /data/data/####/2bb4da94a56cceec_0
- /data/data/####/2bb4da94a56cceec_1
- /data/data/####/2d4a5c7a30257c2b_0
- /data/data/####/2d9d96759e3d001d_0
- /data/data/####/2d9d96759e3d001d_1
- /data/data/####/2fa020a2a3b20493_0
- /data/data/####/35fa4bb9287770e3_0
- /data/data/####/377417d99a864e87_0
- /data/data/####/377417d99a864e87_1
- /data/data/####/3a95f3029fe04f02_0
- /data/data/####/3c1267225201a887_0
- /data/data/####/3f35586c-9978-45e9-8f78-1a3073988cc5
- /data/data/####/3f35586c-9978-45e9-8f78-1a3073988cc5 (deleted)
- /data/data/####/420bc391df7d3816_0
- /data/data/####/4295ff6d2060fa8e_0
- /data/data/####/45bb2b2aa9abc3ed_0
- /data/data/####/484a5713057414b2_0
- /data/data/####/48beb3ba7f9e867d_0
- /data/data/####/4edc2ecf7ce81ee7_0
- /data/data/####/5338bdb390efcaa0_0
- /data/data/####/5a9cde37d50b8688_0
- /data/data/####/5a9cde37d50b8688_1
- /data/data/####/5eaec12641455d4c_0
- /data/data/####/623a6d47-a20f-40d3-ae71-62ed67c9de58
- /data/data/####/65dcbe8a35500d7d_0
- /data/data/####/70d90142530d1edd_0
- /data/data/####/7129f1d53a2710b3_0
- /data/data/####/75572f88b090a8d2_0
- /data/data/####/76056123bcfe1266_0
- /data/data/####/7685f10d268e9813_0
- /data/data/####/77e2ccfdb263ef7d_0
- /data/data/####/7984bcc78722a3c8_0
- /data/data/####/7984bcc78722a3c8_1
- /data/data/####/7c8b105166498bec_0
- /data/data/####/810955ae68c26805_0
- /data/data/####/81e4df4cdf17c92c_0
- /data/data/####/84c66fbaa5d1f495_0
- /data/data/####/85471ee6259a9a53_0
- /data/data/####/8617ba6a-9f6e-4578-b81e-c409dd0e0669
- /data/data/####/86c423ef69de1847_0
- /data/data/####/88aad9f5c926b99a_0
- /data/data/####/88db18496f46adbe_0
- /data/data/####/894eec36b9270fee_0
- /data/data/####/8adb3739dfda3831_0
- /data/data/####/8adb3739dfda3831_1
- /data/data/####/8d0bd2138a874034_0
- /data/data/####/8d0bd2138a874034_1
- /data/data/####/91d08823d64964d5_0
- /data/data/####/924f31ed82d231f5_0
- /data/data/####/924f31ed82d231f5_1
- /data/data/####/941831601effe3bc_0
- /data/data/####/941831601effe3bc_1
- /data/data/####/95958580cc6797df_0
- /data/data/####/9659d518d5263d10_0
- /data/data/####/96e8fbc2be4ee302_0
- /data/data/####/97a4f19f33624f17_0
- /data/data/####/97fe990ab31163de_0
- /data/data/####/97fe990ab31163de_1
- /data/data/####/981dc77dd61deb73_0
- /data/data/####/98365cfb2f4706af_0
- /data/data/####/993923871eceb58a_0
- /data/data/####/9b8e9bf1804a0a6d_0
- /data/data/####/9bd3f45cc17db0c9e7720bbf35209756c29cdabdb9e8eed....0.tmp
- /data/data/####/9e2b327350676910_0
- /data/data/####/A3AEECD8.dex
- /data/data/####/A3AEECD8.dex.flock (deleted)
- /data/data/####/Cookies-journal
- /data/data/####/IpInfos.xml
- /data/data/####/IpInfos.xml.bak
- /data/data/####/Push_Page_Config.xml
- /data/data/####/ThrowalbeLog.db
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a1aad1ebdf8bdb6a_0
- /data/data/####/a1aad1ebdf8bdb6a_1
- /data/data/####/a2f1abc451c8d5a2_0
- /data/data/####/a2fe40edca892afe_0
- /data/data/####/a655fa4464f6c431_0
- /data/data/####/b5d8ffa2-4bda-45f8-ae4d-e4d4a3bb4074
- /data/data/####/b5d8ffa2-4bda-45f8-ae4d-e4d4a3bb4074 (deleted)
- /data/data/####/b828bbb8e56a17c7_0
- /data/data/####/b828bbb8e56a17c7_1
- /data/data/####/b850d0e6e79337b7_0
- /data/data/####/b850d0e6e79337b7_1
- /data/data/####/ba63d37d311c3645_0
- /data/data/####/ba63d37d311c3645_1
- /data/data/####/ba9f34031a9ebb72_0
- /data/data/####/ba9f34031a9ebb72_1
- /data/data/####/bal.catch
- /data/data/####/bf981c130853f39e_0
- /data/data/####/bugly_db_
- /data/data/####/bugly_db_-journal
- /data/data/####/bugly_db_yaq-journal
- /data/data/####/bwc.catch
- /data/data/####/c0c2bf90904255f3_0
- /data/data/####/c0c2bf90904255f3_1
- /data/data/####/c1866d2ee75f4171_0
- /data/data/####/c1bb3b4ef8336ac6_0
- /data/data/####/c27035f82ceb8314_0
- /data/data/####/c27035f82ceb8314_1
- /data/data/####/cb3b6b1c61b5e26c_0
- /data/data/####/ccc05f613b51ce33_0
- /data/data/####/ccc05f613b51ce33_1
- /data/data/####/cd095ca90be9af09_0
- /data/data/####/cn.jiguang.common.xml
- /data/data/####/cn.jiguang.common.xml.bak
- /data/data/####/cn.jiguang.sdk.address.xml
- /data/data/####/cn.jiguang.sdk.report.xml
- /data/data/####/cn.jiguang.sdk.user.profile.xml
- /data/data/####/cn.jmessage.preferences.xml
- /data/data/####/cn.jmessage.preferences.xml.bak
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.rid.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/com.tongyi.bishang.BETA_VALUES.xml
- /data/data/####/com.tongyi.bishang_preferences.xml
- /data/data/####/crashrecord.xml
- /data/data/####/crashrecord.xml.bak
- /data/data/####/d43c1bff58b08631_0
- /data/data/####/d7b2452b4f826753_0
- /data/data/####/d7bac447e36fb647_0
- /data/data/####/d7bac447e36fb647_1
- /data/data/####/dba4c1c20d952204_0
- /data/data/####/ddedf02b1ca19aa3_0
- /data/data/####/e01885189c27cb02_0
- /data/data/####/e0f8f97889a1b542_0
- /data/data/####/e0f8f97889a1b542_1
- /data/data/####/e60c6a8e3017616e_0
- /data/data/####/ec97645d0b9c
- /data/data/####/ef15709c9e856b78_0
- /data/data/####/ef96cb7dca207ee3_0
- /data/data/####/f1046921c362e982_0
- /data/data/####/f151f2b2a836dee1_0
- /data/data/####/f54189bff2e57b7c_0
- /data/data/####/f54189bff2e57b7c_1
- /data/data/####/f62c84cda895b572_0
- /data/data/####/f62c84cda895b572_1
- /data/data/####/f668b801ca7e9707_0
- /data/data/####/f6939239a61d1235_0
- /data/data/####/f7b368019c8bcf15_0 (deleted)
- /data/data/####/fbacbbfab0aa31a6_0
- /data/data/####/ff4c465c16e9f302_0 (deleted)
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/http_book.souibook.com_0.localstorage-journal
- /data/data/####/ibkad_config.xml
- /data/data/####/ibkad_config.xml.bak
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libshellx-super.2019.so
- /data/data/####/local_crash_lock
- /data/data/####/local_crash_lock (deleted)
- /data/data/####/map_record.txt
- /data/data/####/metrics_guid
- /data/data/####/mob_commons_1
- /data/data/####/mob_sdk_exception_1
- /data/data/####/native_record_lock
- /data/data/####/native_record_lock (deleted)
- /data/data/####/o0oooOO0ooOo.dat
- /data/data/####/proc_auxv
- /data/data/####/push.pid
- /data/data/####/push_stat_cache.json
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/reg_record.txt
- /data/data/####/rl.catch
- /data/data/####/rqd_record.eup
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tdata_HNa879
- /data/data/####/tdata_HNa879.dex
- /data/data/####/tdata_HNa879.dex.flock (deleted)
- /data/data/####/tdata_HNa879.jar
- /data/data/####/the-real-index
- /data/data/####/tomb_1584728819045.txt
- /data/data/####/tomb_1584728828330.txt
- /data/data/####/tomb_1584728832822.txt
- /data/data/####/tosversion
- /data/data/####/update.xml
- /data/data/####/xian_wan_sp_config_table.xml
- /data/data/####/xian_wan_sp_config_table.xml.bak
- /data/data/####/xiqu_sp_config_table.xml
- /data/data/####/xiqu_sp_config_table.xml.bak
- /data/media/####/.push_deviceid
- /data/media/####/app.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.tongyi.bishang.bin
- /data/media/####/com.tongyi.bishang.db
- /data/media/####/tdata_HNa879
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- /system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_0.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_0.dex --compiler-filter=interpret-only
- /system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_1.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_1.dex --compiler-filter=interpret-only
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.00000000000/A3AEECD8.dex --oat-fd=39 --oat-location=/data/user/0/<Package>/.11111111111/A3AEECD8.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_HNa879.jar --oat-fd=51 --oat-location=/data/user/0/<Package>/files/tdata_HNa879.dex --compiler-filter=speed
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- busybox ifconfig
- cat /proc/uid_stat/10065/tcp_rcv
- cat /proc/uid_stat/10065/tcp_snd
- cat /sys/class/net/wlan0/address
- getprop
- getprop androVM.vbox_dpi
- getprop gsm.sim.state
- getprop gsm.sim.state2
- getprop qemu.sf.fake_camera
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.debuggable
- getprop ro.genymotion.version
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.secure
- getprop ro.vivo.os.build.display.id
- logcat -d -v threadtime -s dalvikvm art zygote zygote64 OpenGLRenderer Bugly-libunwind:S
- logcat -t 1000 -v threadtime Bugly-libunwind:S
- ls /data/local
- mount
- ps
- sh
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
