Android.Packed.53242

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.392.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) sdk.api.o####.####.cn:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) a####.cw####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) qzones####.g####.cn.####.com:80
TCP(HTTP/1.1) m.cw####.com:80
TCP(HTTP/1.1) t####.3g.qq.com:80
TCP(HTTP/1.1) log.cw####.com:80
TCP(HTTP/1.1) luna-im####.qq.com.####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) sdk-re####.hyrai####.com:80
TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) aj.hyrai####.com:443
TCP(TLS/1.0) all.t####.httpdn####.####.net:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) ali-s####.j####.cn:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) gd-s####.j####.cn:443
TCP(TLS/1.0) sf1-ttc####.ps####.com:443
TCP(TLS/1.0) ce3e####.j####.cn:443
TCP(TLS/1.0) mi.g####.qq.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) s####.e.qq.com:443
TCP(TLS/1.0) t####.m.qq.com:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) bds.sn####.com:443
TCP(TLS/1.0) to####.ctobsn####.com:443
TCP(TLS/1.0) t####.j####.cn:443
TCP(TLS/1.0) me.x####.com:443
TCP(TLS/1.0) a####.shu####.cn:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) d####.shu####.cn:443
TCP(TLS/1.0) bj####.j####.cn:443
TCP(TLS/1.0) daa.shu####.cn:443
TCP(TLS/1.2) 1####.217.17.46:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 1####.217.19.195:443
TCP 1####.232.25.184:7007
UDP sis.j####.io:19000
TCP m####.3g.qq.com:443

Запросы DNS:

60.162.95.####.arpa
a####.cw####.com
a####.shu####.cn
aj.hyrai####.com
ali-s####.j####.cn
and####.b####.qq.com
av1.x####.com
bds.sn####.com
bj####.j####.cn
c####.x####.com
ce3e####.j####.cn
d####.shu####.cn
daa.shu####.cn
dai.shu####.cn
dcc.shu####.cn
dig.b####.net
down####.shu####.cn
down####.shu####.cn.####.8
easytom####.com
gd-s####.j####.cn
imgc####.qq.com
is.sn####.com
l####.tbs.qq.com
log.cw####.com
m####.3g.qq.com
m.cw####.com
me.x####.com
mi.g####.qq.com
mo####.shu####.cn
p####.google####.com
p####.ugd####.com
qzones####.g####.cn
s####.e.qq.com
s####.sn####.com
s.j####.cn
sdk-re####.hyrai####.com
sdk.api.o####.####.cn
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
sis.j####.io
t####.3g.qq.com
t####.j####.cn
t####.m.qq.com
tel####.shu####.cn
to####.ctobsn####.com
un####.shu####.cn
www.google####.com

Запросы HTTP GET:

a####.cw####.com/ad/conf?app_id=####
luna-im####.qq.com.####.com/gdt/0/DAA4Vo1AUAALQABPBem-82BjVPtgdS.jpg/0?c...
luna-im####.qq.com.####.com/gdt/0/DAA7a7oAQ4AeAABoBevlwoBgkOKUoZ.png/0?c...
luna-im####.qq.com.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/pr...
m.cw####.com/client/img/v1/task/分享.png
m.cw####.com/client/img/v1/task/刮刮卡.png
m.cw####.com/client/img/v1/task/填写邀请码.png
m.cw####.com/client/img/v1/task/大转盘.png
m.cw####.com/client/img/v1/task/提现.png
m.cw####.com/client/img/v1/task/摇钱树.png
m.cw####.com/client/img/v1/task/猜大小.png
m.cw####.com/client/img/v1/task/累计看视频.png
m.cw####.com/client/img/v1/task/绑定手机.png
m.cw####.com/client/img/v1/task/达标赛.png
m.cw####.com/client/img/v1/task/运动.png
m.cw####.com/client/img/v1/task/邀请.png
qzones####.g####.cn.####.com/qzone/biz/gdt/mob/sdk/v2/android03/js-relea...
sdk-re####.hyrai####.com/hyadxsdk/100020038/hy_adx_sdk.jar
sf6-ttc####.ps####.com.####.com/img/web.business.image/202004085d0d0656f...
t####.3g.qq.com/cw.html

Запросы HTTP POST:

a####.cw####.com/bind/dlid
a####.cw####.com/channel/ver
a####.cw####.com/conf
a####.cw####.com/day_init
a####.cw####.com/push/info
a####.cw####.com/step/info
a####.cw####.com/v2/task
a####.cw####.com/visitor
a####.cw####.com/wallet
and####.b####.qq.com/rqd/async?aid=####
l####.tbs.qq.com/ajax?c=####&k=####
log.cw####.com/a
s####.e.qq.com/activate
sdk.api.o####.####.cn/stat?support=####&md=####&tm=####&mf=####&pn=####&...

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1127729055-1266689676
/data/data/####/.bak
/data/data/####/.cl
/data/data/####/.jg.ic
/data/data/####/.jg.store.report_cf
/data/data/####/.turing.dat
/data/data/####/05338fa793f7a2ea6f56676b3b34f17d651c81622e463a5...7d90.0
/data/data/####/0c91edf92ca64021b5274ffe30a8f9ab383efe8b0f6fa36....0.tmp
/data/data/####/1004
/data/data/####/1021689741840853517
/data/data/####/1589834675765_3221
/data/data/####/1589834676007_3221
/data/data/####/1589834676631_3221
/data/data/####/1589834679635_3309
/data/data/####/1589834681032_3221
/data/data/####/1589834681395_3221
/data/data/####/1589834682003_3221
/data/data/####/1589834683581_3309
/data/data/####/1589834684065_3309
/data/data/####/1589834684267_3309
/data/data/####/1589834737639_3221
/data/data/####/1589834803849_3221
/data/data/####/1a2701a2a4089611_0
/data/data/####/1c52d3b2-3687-4c98-bfdb-4f927f51bb49
/data/data/####/1df7b1e4a0daa83d43edb5b384cee8f87ecdeafeef9a2ea....0.tmp
/data/data/####/2cd0abd2994dd73e0079056ca2a7d5079b68467df58f741....0.tmp
/data/data/####/2f98dd50-8de0-4d46-a401-24878f33ccbf
/data/data/####/3221.yaqcookie
/data/data/####/324da9daa1a5a3f8554c95457bf4ac8c
/data/data/####/324da9daa1a5a3f8554c95457bf4ac8c.tmp
/data/data/####/39285EFA.dex
/data/data/####/39285EFA.dex.flock (deleted)
/data/data/####/40805.dat
/data/data/####/482893c18cde2f6e262cd9ca5b84003d06773562d4dcffb....0.tmp
/data/data/####/59810cdf-3c65-4ce8-9c79-e2d36afe5ab1
/data/data/####/752501e96b0f2264eb49876f4acb2774cb44d3221cdd07e....0.tmp
/data/data/####/7b4258c4328b3b69_0
/data/data/####/7b4258c4328b3b69_1
/data/data/####/7f48b4fff7cac7db8f54d54f0b163d1cabba5b2d566d543....0.tmp
/data/data/####/95121afbe7e7012b_0
/data/data/####/974bc2a6-efc9-4318-b9d0-de520234ba05
/data/data/####/9e774a48c4391643c8a7b6a391890d455ab698938c97e03....0.tmp
/data/data/####/9eabb37fb4c74b2b4d2bcadae0730b7da6b54e290cb9fa1....0.tmp
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/BuglySdkInfos.xml
/data/data/####/Cookies-journal
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/IpInfos.xml
/data/data/####/Push_Page_Config.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_cloudcontrol1.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/WalkStepCount.db-journal
/data/data/####/Web Data
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/XiaoZi_Walk.xml
/data/data/####/XiaoZi_Walk.xml.bak
/data/data/####/a5302700-f439-4e52-b967-9933260e7f91
/data/data/####/b11bcc4a8129e2c45c31b9da5c38516ba0dfa59a13c41f3....0.tmp
/data/data/####/b7ffcaa737112c6ea171638e3d597365b4e50ca8d791aa5...8551.0
/data/data/####/b924fcf12b3a05142ab48e0aab8f2455fede2f0bfd47ffe....0.tmp
/data/data/####/bal.catch
/data/data/####/ban.catch
/data/data/####/bc2b622a-9bd9-4662-b963-a7dc9ffc41e0
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bugly_db_-journal
/data/data/####/bwc.catch
/data/data/####/bytedance_downloader.db-journal
/data/data/####/cid
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/cn.jiguang.common.xml
/data/data/####/cn.jiguang.common.xml.bak
/data/data/####/cn.jiguang.prefs.xml
/data/data/####/cn.jiguang.sdk.address.xml
/data/data/####/cn.jiguang.sdk.report.xml
/data/data/####/cn.jiguang.sdk.share.profile.xml
/data/data/####/cn.jiguang.sdk.user.profile.xml
/data/data/####/cn.jiguang.sdk.user.profile.xml.bak
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.config.xml
/data/data/####/cn.jpush.config.xml.bak
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/cn.jpush.preferences.v2.xml.bak
/data/data/####/com.qq.e.sdkconfig.xml
/data/data/####/com.qq.e.sdkconfig.xml.bak
/data/data/####/com.zhongfu.app.walk_dna.xml
/data/data/####/com.zhongfu.app.walk_preferences.xml
/data/data/####/com.zhongfu.app.walk_prefs.xml
/data/data/####/com.zhongfu.app.walk_prefs.xml.bak
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/cube_ptr_classic_last_update.xml
/data/data/####/de3de48a-4ece-447e-ab52-8f23c2e65684
/data/data/####/debug.conf
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/download_upload
/data/data/####/du.lock
/data/data/####/e960e778-5b19-4c1b-a7c8-6b31410cb000
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.dex
/data/data/####/gdt_plugin.dex.flock (deleted)
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.next.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_stat.db
/data/data/####/gdt_stat.db-journal
/data/data/####/gdt_suid
/data/data/####/hy_adx_sdk.dex
/data/data/####/hy_adx_sdk.dex.flock (deleted)
/data/data/####/hy_adx_sdk.jar
/data/data/####/index
/data/data/####/iv
/data/data/####/journal
/data/data/####/libMMANDKSignature.730300b3.so
/data/data/####/libjiagu.so
/data/data/####/libturingau.730300b3.so
/data/data/####/libyaqbasic.730300b3.so
/data/data/####/libyaqpro.730300b3.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/metrics_guid
/data/data/####/mpdc
/data/data/####/native_record_lock
/data/data/####/proc_auxv
/data/data/####/push_stat_cache.json
/data/data/####/rl.catch
/data/data/####/salt
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/security_info
/data/data/####/sk.xml
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_push_time.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdid.xml
/data/data/####/the-real-index
/data/data/####/tms_base.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/tt_sp_app_list.xml
/data/data/####/tt_sp_app_list.xml.bak
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/turingfd_conf_105498_34_audienceMini.xml
/data/data/####/turingfd_conf_105498_34_audienceMini.xml.bak
/data/data/####/turingfd_protect_105498_34_audienceMini.xml
/data/data/####/update.xml
/data/data/####/update_lc
/data/data/####/webview_data.lock
/data/data/####/xian_wan_sp_config_table.xml
/data/data/####/yaq.730300b3.sec
/data/data/####/yaq2.730300b3.sec
/data/data/####/yaq3_0.730300b3.sec
/data/data/####/yaqsdkcookie
/data/media/####/..ccdid
/data/media/####/..ccvid
/data/media/####/.3deaedc28469674418c57af6b7cc832b
/data/media/####/.ZHVzY2Lk
/data/media/####/._android.dat
/data/media/####/._system.dat
/data/media/####/.ccdid
/data/media/####/.ccvid
/data/media/####/.duid
/data/media/####/.n_a
/data/media/####/.n_b
/data/media/####/.n_c
/data/media/####/.n_d
/data/media/####/.turing.dat
/data/media/####/4d29639a37e58723b0741a323c76858e.tmp
/data/media/####/ZHVzY2Lk
/data/media/####/_android.dat
/data/media/####/_system.dat
/data/media/####/da48d872719fbc49bcfb42e7596c9f0c.tmp
/data/media/####/duid
/data/media/####/n_a
/data/media/####/n_b
/data/media/####/n_c
/data/media/####/n_d
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof
/data/user_de/####/move_to_de_records.xml

Другие:

Запускает следующие shell-скрипты:

/data/user/0/<Package>/files/cid
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.00000000000/39285EFA.dex --oat-fd=35 --oat-location=/data/user/0/<Package>/.11111111111/39285EFA.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_e_qq_com_plugin_8eebcb5202bf0a93fbd86d5dc32e701c/gdt_plugin.jar --oat-fd=188 --oat-location=/data/user/0/<Package>/app_e_qq_com_dex/gdt_plugin.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/1.2.10/hy_adx_sdk.jar --oat-fd=168 --oat-location=/data/user/0/<Package>/app_odex/hy_adx_sdk.dex --compiler-filter=speed
/system/bin/df
/system/bin/getprop
chmod 777 /data/user/0/<Package>/cache/Download
chmod 777 /data/user/0/<Package>/files/cid
date
getprop
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
grep u0_a65
id
ip link
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
netstat -apn
ping -c 3 -w 10 mobile.shuzilm.cn
ping -c 3 -w 10 telecom.shuzilm.cn
ping -c 3 -w 10 unicom.shuzilm.cn
ps
service call iphonesubinfo 1
sh
sh -c echo 0brezpSGcJ5Xr89hSkpnbPpf00XFLms6 > <SD-Card>/../../../../../..<SD-Card>/Android/ZHVzY2Lk
sh -c echo MUE0MzhFQUU2Qjk2ODU1OTEwRTU3NTZBOUVBRkJDOEZhM2FjZTMxZDI3Mzg0YmI5ODE2YjNlMjZlNGI2OGMxaAo= > <SD-Card>/../../../../../..<SD-Card>/.duid
sh -c echo MUE0MzhFQUU2Qjk2ODU1OTEwRTU3NTZBOUVBRkJDOEZhM2FjZTMxZDI3Mzg0YmI5ODE2YjNlMjZlNGI2OGMxaAo= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/duid
sh -c echo MjVENTVBRDI4M0FBNDAwQUY0NjRDNzZENzEzQzA3QUQxMjM0NTY3OA== > <SD-Card>/../../../../../..<SD-Card>/.n_a
sh -c echo MjVENTVBRDI4M0FBNDAwQUY0NjRDNzZENzEzQzA3QUQxMjM0NTY3OA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_a
sh -c echo N0d8I1Rjg3NEQyRDMyRTg0OTFGQzk5NDVGMUU4MEZBNTUwYnJlenBTR2NKNVhyODloU2twbmJQcGYwMFhGTG1zNg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ZHVzY2Lk
sh -c echo NEE3RDFFRDQxNDQ3NEU0MDMzQUMyOUNDQjg2NTNEOUIwMDAw > <SD-Card>/../../../../../..<SD-Card>/.n_c
sh -c echo NEE3RDFFRDQxNDQ3NEU0MDMzQUMyOUNDQjg2NTNEOUIwMDAw > <SD-Card>/../../../../../..<SD-Card>/.n_d
sh -c echo NEE3RDFFRDQxNDQ3NEU0MDMzQUMyOUNDQjg2NTNEOUIwMDAw > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_c
sh -c echo NEE3RDFFRDQxNDQ3NEU0MDMzQUMyOUNDQjg2NTNEOUIwMDAw > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_d
sh -c echo QTQ1NDE4MDAxMEUyNjdDQUVEOEE0NjgzREMwRUIwQTEyMDE5MDgwMTAwMDE= > <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c echo QTQ1NDE4MDAxMEUyNjdDQUVEOEE0NjgzREMwRUIwQTEyMDE5MDgwMTAwMDE= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo QzZCODhDMEU5QkVDRkZCMENFRjlDMEI3QzQ4M0MwMjdENTAyNDc6NjA5ODU4OjRFQzgwMg== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo QzZCODhDMEU5QkVDRkZCMENFRjlDMEI3QzQ4M0MwMjdENTAyNDc6NjA5ODU4OjRFQzgwMg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo RDBCNTk5QjlGNDU2MkI4NTU3MUE3Qzk0NzRCMzE2NjN5QWdTdXM0c3pzQ1RqbWFmOThUc0Q1YWd1M25vRzBvdDNVdlhkT1RVM2pVa3d3L1UyakdqTGZtVFdIb0hzeFNBUGJKVG1GaS80bHBJZEk3aUdXc3hob0tkdnRScm5EbmM0SEFMOEhjNnA2VWJxUG1TamY4Y2xmWHAwak1vOVlNaHpBOUVkcU9mSkcyeEFOcVlnMWlDRXVFYmFvY3dIb0JPVk9wMWFaTStydlVzYk5ja0lnbnY4VmQycVpQbWVWVzE= > <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c echo RDBCNTk5QjlGNDU2MkI4NTU3MUE3Qzk0NzRCMzE2NjN5QWdTdXM0c3pzQ1RqbWFmOThUc0Q1YWd1M25vRzBvdDNVdlhkT1RVM2pVa3d3L1UyakdqTGZtVFdIb0hzeFNBUGJKVG1GaS80bHBJZEk3aUdXc3hob0tkdnRScm5EbmM0SEFMOEhjNnA2VWJxUG1TamY4Y2xmWHAwak1vOVlNaHpBOUVkcU9mSkcyeEFOcVlnMWlDRXVFYmFvY3dIb0JPVk9wMWFaTStydlVzYk5ja0lnbnY4VmQycVpQbWVWVzE= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c echo RTEwQURDMzk0OUJBNTlBQkJFNTZFMDU3RjIwRjg4M0UxMjM0NTY= > <SD-Card>/../../../../../..<SD-Card>/.n_b
sh -c echo RTEwQURDMzk0OUJBNTlBQkJFNTZFMDU3RjIwRjg4M0UxMjM0NTY= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_b
sh -c ps | grep u0_a65

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RC4-ECB-NoPadding
RSA-ECB-NoPadding
RSA-ECB-OAEPWithSHA256AndMGF1Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
desede-CBC-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об активных администраторах устройства.

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней