Adware.Gexin.21685

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) al####.u####.com:80
TCP(HTTP/1.1) adash####.man.aliy####.com:80
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) amap####.cn-hang####.oss####.####.com:80
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(HTTP/1.1) c####.g####.com:80
TCP(HTTP/1.1) o####.jd.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) gs.g####.com:80
TCP(HTTP/1.1) ap####.g####.com:80
TCP(TLS/1.0) ofo-tia####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) dxp.b####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) baichua####.al####.com:443
TCP(TLS/1.0) m####.m.jd.com:443
TCP(TLS/1.0) d####.k.jd.com:443
TCP(TLS/1.0) wap.cmpass####.com:8443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) 2####.107.1.100:443
TCP(TLS/1.0) schedul####.yo####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) secgw-n####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) www.j####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) user####.al####.com:443
TCP(TLS/1.0) def####.cn.zb.####.com:443
TCP(TLS/1.0) ke####.jd.com:443
TCP(TLS/1.0) ofo-st####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.2) 1####.250.179.195:443
TCP cash####.api.ofo.com:443
TCP cm-1####.g####.com:5225
UDP md####.google####.com:443
TCP sdk.o####.t####.####.com:5224
UDP 1####.0.56.1:137
TCP o####.api.ofo.com:443

Запросы DNS:

7j####.c####.z0.####.com
a####.man.aliy####.com
a####.u####.com
ada####.ut.ta####.com
amap####.cn-hang####.oss####.####.com
and####.google####.com
ap####.g####.com
b####.api.ofo.com
b####.g####.com
b####.g####.com
baichua####.al####.com
baichua####.ta####.com
beacon####.aliy####.com
c####.g####.com
c####.g####.com
c####.g####.com
c-h####.g####.com
cash####.api.ofo.com
cdn-sdk####.g####.com
cm-1####.g####.com
cm-1####.g####.com
co####.api.ofo.com
d####.k.jd.com
dgst####.jd.com
dxp.b####.com
gs.g####.com
h####.b####.com
h5.yo####.com
i####.360bu####.com
ke####.jd.com
log.u####.com
logse####.ofo.com
m####.m.jd.com
md####.google####.com
norma-e####.m####.com
o####.api.ofo.com
o####.jd.com
of####.ofo.com
ofo-st####.oss-cn-####.aliy####.com
ofo-tia####.oss-cn-####.aliy####.com
plb####.u####.com
res####.a####.com
s####.ofo.so
sdk-ope####.g####.com
sdk.c####.g####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sett####.crashly####.com
sett####.crashly####.com.####.8
tj.youza####.com
u####.api.ofo.com
u####.u####.com
user####.al####.com
wap.cmpass####.com
y####.al####.org

Запросы HTTP GET:

amap####.cn-hang####.oss####.####.com/sdkcoor/android/armeabi/libJni_wgs...
baichua####.al####.com:443/4.0.0.8/28168644/1.0.0/android/rule.htm
cdn-sdk####.g####.com.####.com/tdata_DNL558
cdn-sdk####.g####.com.####.com/tdata_RdS556
cdn-sdk####.g####.com.####.com/tdata_hqs030
cdn-sdk####.g####.com.####.com/tdata_uiY322
d####.c####.l####.####.com/config/hzv9.conf
d####.k.jd.com:443/js/ksdk/getUnpl.js
d####.k.jd.com:443/js/ksdk/m.keepalive.js
d####.k.jd.com:443/ksdk/mid-page.html
def####.cn.zb.####.com:443/bar/get/566e8adee0f55ad86d00119a/?pcv=####&de...
dxp.b####.com:443/autoTracker
dxp.b####.com:443/circleConfig?sdkVersion=####&appKey=####&packageName=#...
ke####.jd.com:443/console/admin/getConfigNew?kepler_version=####&kepler_...
na61-####.wagbr####.ali####.####.com:443/4.0.0.8/android/pages.htm?appKe...
norma-e####.m####.com/android/exchange/getpublickey.do
ofo-st####.oss-cn-####.aliy####.com:443/t/tt/cdicon/1.png
ofo-st####.oss-cn-####.aliy####.com:443/t/tt/tu/wph.png
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/105ea20191101120557454...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/1388c20191101115154139...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/1efaa20191101115154168...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/2d55e20191101115154277...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/3399720191101115154386...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/4049220191101115154809...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/4256420191101115154366...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/4cead20191101121022771...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/4ef4f20191101115154267...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/52bd320191101120557426...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/5e5b020191101121729868...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/639f620191101115154522...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/63e1a20191101121022961...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/774d820191101121022604...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/790c020191101120557669...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/7beac20191101115154839...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/8b34120191101121611962...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/8df8320191101121611947...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/8eec020191101115154659...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/94f5620191101121022848...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/a449020191101121022343...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/a4df020191101115154430...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/a522320191101115154297...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/b7c3f20191101121022449...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/bc7a520191101115154229...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/cd8af20191101115154399...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/d3e2c20191101115154794...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/d531920191101115154475...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/d99ed20191101115154285...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/f063c20191101132632275...
ofo-tia####.oss-cn-####.aliy####.com:443/20191101/f85f720191101115154776...
ofo-tia####.oss-cn-####.aliy####.com:443/20200114/0e07020200114104634797...
ofo-tia####.oss-cn-####.aliy####.com:443/20200114/b693720200114103745217...
ofo-tia####.oss-cn-####.aliy####.com:443/20200114/bb8f220200114104634850...
ofo-tia####.oss-cn-####.aliy####.com:443/20200114/d13e620200114113952787...
ofo-tia####.oss-cn-####.aliy####.com:443/20200114/f0bd920200114103745150...
ofo-tia####.oss-cn-####.aliy####.com:443/20200911/51fe220200911142359997...
ofo-tia####.oss-cn-####.aliy####.com:443/20210312/ec93120210312151129596...
ofo-tia####.oss-cn-####.aliy####.com:443/20210722/0fbd020210722112455900...
schedul####.yo####.com:443/v2/showcase/homepage?alias=####
sdk-ope####.g####.com/api/addr.htm
ti####.c####.l####.####.com/tdata_FhD658
user####.al####.com:443/matrix_app/android/matrix_app_config.json
user####.al####.com:443/matrix_app/android/safe_package_config.json
user####.al####.com:443/smart_link/android/alsl_switch_config.json
www.j####.com:443/dg/js/ksdk/getUnpl.js
www.j####.com:443/dg/js/ksdk/m.keepalive.js
www.j####.com:443/dg/ksdk/mid-page.html
www.j####.com:443/pop/jfs/t1/160407/26/4589/304960/600fc2ecEe46baae6/65b...
www.j####.com:443/pop/jfs/t1/163126/36/18484/89598/607708f6E0f69c3e9/128...
www.j####.com:443/pop/jfs/t1/18527/25/7288/974697/5c69214eE0e780c16/e219...
www.j####.com:443/pop/jfs/t1/207937/3/2703/219395/615407ebE360c1098/03d8...

Запросы HTTP POST:

adash####.man.aliy####.com/man/api?ak=####&s=####
al####.u####.com/app_logs
al####.u####.com:443/unify_logs
ap####.g####.com/bd
beacon####.aliy####.com/beacon/fetch/config/byappkey
c####.g####.com/api.php?format=####&t=####
def####.duals####.cn.####.com:443/umpx_internal
def####.duals####.cn.####.com:443/umpx_share
gs.g####.com/encryption/key/fetch
gs.g####.com/geshu/sdkStatistics/bd
gs.g####.com/geshu/sdkStatistics/ubi
h####.b####.com:443/app.gif
m####.m.jd.com:443/ksdk/updlist.json
norma-e####.m####.com/push/android/external/add.do
o####.jd.com/upload
res####.a####.com:443/v3/iasdkauth?key=####&ts=####&scode=####
schedul####.yo####.com:443/v3/log
sdk-ope####.g####.com/api.php?format=####&t=####
secgw-n####.wagbr####.ali####.####.com:443/saveWb.json?evt=####&pn=####&...
wap.cmpass####.com:8443/log/logReport

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/11b53a65c903c3f19940ffbd78cd8722b7953c9ac55bcdf....0.tmp
/data/data/####/11be00f72d6983576a8902b6ba93e988040aa6cc772bf21....0.tmp
/data/data/####/1aaee826e8d24bc837f8cc2487c316e7be2e30f38a3960b....0.tmp
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/1d67214ef5d7b249293e93eac6fa30a20c16f499950b8eb....0.tmp
/data/data/####/1f28af36b740f2f0ae8bb0c48c7da7f1b7dc478664402dd....0.tmp
/data/data/####/204c766018d97daebd2de15efb6d6aa56117198f48640af....0.tmp
/data/data/####/21547f0be5dbba1f26ab6441d83f0446290de1056bf4ae6....0.tmp
/data/data/####/3c64c0829984119ea54cd481488a071295b51357dc78dd5....0.tmp
/data/data/####/3e616db056d88a3623b4cf1260fffe7f2abc1fa890c3fa8....0.tmp
/data/data/####/42b3ade34950993b9467cc680805961582969bb976d315e....0.tmp
/data/data/####/44195a003f8b6ecbc0c8e52cef7b6d032c751cf7f61c873....0.tmp
/data/data/####/47cb72fae7422a7f6f4d8eefbbcf59097726358b5ec7cc1....0.tmp
/data/data/####/4f3f39d6c8839b0354133ab8526651f86dd286623ce8ead....0.tmp
/data/data/####/51cf412033e9ca6fdeec835e70689744504499f663364b5....0.tmp
/data/data/####/5a501dfb11106773b8ccba6e391188865c64060b1e2420e....0.tmp
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DBeginSession.cls_temp
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DBeginSession.json
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionApp.cls_temp
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionApp.json
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionCrash.cls_temp
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionDevice.cls_temp
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionDevice.json
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionOS.cls_temp
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionOS.json
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67DSessionUser.cls_temp
/data/data/####/616146C800FE-0001-0DAD-789DADD6B67Dkeys.meta
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DBeginSession.cls_temp
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DBeginSession.json
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DSessionApp.cls_temp
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DSessionApp.json
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DSessionDevice.cls_temp
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DSessionDevice.json
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DSessionOS.cls_temp
/data/data/####/616146D8030C-0002-0DAD-789DADD6B67DSessionOS.json
/data/data/####/624cbc140b9f0dea89bb2f96e18f276f107b051a62413c2....0.tmp
/data/data/####/65a7918275ff98661178e23dd0859661024a8ff5eca0648....0.tmp
/data/data/####/66b60915b54a3400c0eacd09e425ed6c86344c39d41ffb4....0.tmp
/data/data/####/6a92aed305cf864ce9d5f1dd137919bb85d35f81757b740....0.tmp
/data/data/####/7308b18759ee3657e36ebabef68ed2bf8808fdf500f3004....0.tmp
/data/data/####/762aec726ceb7e7504731b9dc06a54da6547b14dd9d7f37....0.tmp
/data/data/####/78b187248628dcf7f31792dfb7cd3c3c8bfa8ee265b5d12....0.tmp
/data/data/####/797751e2d01b0450cb27a7624db572a4285c28114d05463....0.tmp
/data/data/####/7efada16d03d916251ad8231def628064a0062a73f9c311....0.tmp
/data/data/####/842eb5eae2762db2e440467f0bdd578cbeb46eb323f38bb....0.tmp
/data/data/####/885a226cdbf5b9354cdd83c44f522792f70f04d524da85d....0.tmp
/data/data/####/8ad12d695d64bb154c402af8ee0c365d7b49571ff7bce23....0.tmp
/data/data/####/8c3180f2b599b5a587a78c71fb66857ef19daff18e02dd5....0.tmp
/data/data/####/8dd2b60ee8960779c11ad0b2e3832213ad6a9037439724c....0.tmp
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Cookies-journal
/data/data/####/JX0WDG83P1ZN.txtdad
/data/data/####/NBSCrashStore.xml
/data/data/####/SGMANAGER_DATA2
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/SG_INNER_DATA
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/UTCommon.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1633765076337
/data/data/####/a4f1fe89d6c965a3d506d430c2feec36cf6c43b33018319....0.tmp
/data/data/####/aab7d6ab7ebd17a0b84c79d0947cf0ea26d10241a94b5c9....0.tmp
/data/data/####/ap.Lock
/data/data/####/auth_sdk_device.xml
/data/data/####/auth_shared.xml
/data/data/####/auth_shared.xml.bak
/data/data/####/avmp_312757200.pkgInfo
/data/data/####/avmp_312757200.pkgInfo (deleted)
/data/data/####/b1d814cac029ca3e8674658253e74cc3e1dc010960cc5f1...a9d5.0
/data/data/####/b8a65832d2fe7d487db11be590a887523a7ed7ae28b69bf....0.tmp
/data/data/####/b9293bae9f2b465e430bead004964086b6a99fffdaa14f4....0.tmp
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/bc_config
/data/data/####/bf05c4b5a03365605bb5926a53d2b09e155f5ab04a4e81c....0.tmp
/data/data/####/c1589d92f57d1f8c78cef9dfc3e90597fbf563548e3e158....0.tmp
/data/data/####/c2adad253fb274f314882d6dd055462afaa7061a19adaff....0.tmp
/data/data/####/c3b830d34289963906ac1620a6a1abec90843a99b680c32....0.tmp
/data/data/####/c4ea45b932e8e8a68750fa83d54b456ac6a4f9db9d08db0....0.tmp
/data/data/####/c5d91e94724a40d774e34a98dc731ed30a5b3bc149e25b9....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.networkbench.agent.impl.v2_so.ofo.labofo.xml
/data/data/####/com.networkbench.agent.impl.v2_so.ofo.labofo.xml.bak
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDa...ml.bak
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.2.xml
/data/data/####/com.youzan.mobile.AnalyticsPrefs.xml
/data/data/####/com.youzan.mobile.AnalyticsPrefs.xml.bak
/data/data/####/config.xml
/data/data/####/config_track_sdk.xml
/data/data/####/crash_marker
/data/data/####/d332006247b7e104d32b20439232dbe3d641a1020f5f7fd....0.tmp
/data/data/####/d4fcb71a5d9124d68f5f44929215f17d8ff8b0a29c50caf....0.tmp
/data/data/####/d5820912caa1532e63a2f77d9c5263af33f444c2b242238....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNjMzNzY1MDcyMjc4;
/data/data/####/dW1weF9zaGFyZV8xNjMzNzY1MDc1NzE4;
/data/data/####/dW1weF9zaGFyZV8xNjMzNzY1MDc3NzQ0;
/data/data/####/dc54d0edfde768f466
/data/data/####/dcb457c0d4f11523dfadcfa07bfb0090dbf38b329add0b5....0.tmp
/data/data/####/dcbf796246bd79dd92
/data/data/####/dcbfef9fb2ff79fe21
/data/data/####/dcfdfb587ebfffe22e
/data/data/####/de0a7088130457da98530543ef83eb4bcf8bce0f9db7b06....0.tmp
/data/data/####/deviceid_prefs.xml
/data/data/####/events
/data/data/####/events-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/getui_sp.xml
/data/data/####/gin.db-journal
/data/data/####/gkt-journal
/data/data/####/gtc.db-journal
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_cache.xml.bak
/data/data/####/i==1.2.0&&4.0.1_1633765072634_envelope.log
/data/data/####/ias.db-journal
/data/data/####/ias_sp.xml
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/initialization_marker
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/kepler_public.xml
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/libsgavmpso-5.4.36.so.tmp.3501
/data/data/####/libsgmainso-5.4.171.so.tmp.3501
/data/data/####/libsgsecuritybodyso-5.4.99.so.tmp.3501
/data/data/####/libsgsgmiddletierso-5.4.7.so.tmp.3501
/data/data/####/libwgs2gcj.so
/data/data/####/lock.lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/main_312757200.pkgInfo
/data/data/####/metrics_guid
/data/data/####/mtj_autoTracker.js
/data/data/####/ofo_local_cache.xml
/data/data/####/ofo_local_cache.xml.bak
/data/data/####/ofo_local_cache.xml.bak (deleted)
/data/data/####/ofo_push.db
/data/data/####/ofo_push.db-journal
/data/data/####/ofo_sharePreferences.xml
/data/data/####/openudid_prefs.xml
/data/data/####/pattern_urls
/data/data/####/pref.xml
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/run.pid
/data/data/####/sa_b163cd1e-9a80-49bb-af21-abd425522ab6_1633765065946.tap
/data/data/####/securitybody_312757200.pkgInfo
/data/data/####/securitybody_312757200.pkgInfo.tmp
/data/data/####/sensorsdata.xml
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/sgFile.lock
/data/data/####/sgmiddletier_312757200.pkgInfo
/data/data/####/sgmiddletier_312757200.pkgInfo.tmp
/data/data/####/share.db-journal
/data/data/####/smart_link_sp.xml
/data/data/####/smart_link_sp.xml.bak
/data/data/####/smart_link_sp.xml.bak (deleted)
/data/data/####/so.ofo.labofo
/data/data/####/so.ofo.labofo-journal
/data/data/####/so.ofo.labofo_preferences.xml
/data/data/####/sp.lock
/data/data/####/ssoconfigs.xml
/data/data/####/ssoconfigs.xml.bak
/data/data/####/tdata_DNL558
/data/data/####/tdata_DNL558.dex
/data/data/####/tdata_DNL558.dex.flock (deleted)
/data/data/####/tdata_DNL558.jar
/data/data/####/tdata_RdS556
/data/data/####/tdata_RdS556.dex
/data/data/####/tdata_RdS556.dex.flock (deleted)
/data/data/####/tdata_RdS556.jar
/data/data/####/tdata_hqs030
/data/data/####/tdata_hqs030.dex
/data/data/####/tdata_hqs030.dex.flock (deleted)
/data/data/####/tdata_hqs030.jar
/data/data/####/tdata_uiY322.dex
/data/data/####/tdata_uiY322.dex.flock (deleted)
/data/data/####/tdata_uiY322.jar
/data/data/####/tdata_uiY3221779955850.tmp
/data/data/####/timestamp
/data/data/####/trace_circle.data
/data/data/####/track_so.ofo.labofo
/data/data/####/track_so.ofo.labofo-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/media/####/.0
/data/media/####/.1
/data/media/####/.10
/data/media/####/.11
/data/media/####/.2
/data/media/####/.3
/data/media/####/.4
/data/media/####/.4781249416745892043
/data/media/####/.5
/data/media/####/.6
/data/media/####/.7
/data/media/####/.8
/data/media/####/.9
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.lock
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/.umm.dat
/data/media/####/1633765073464.db (deleted)
/data/media/####/18d2ed21a6e7170c48de5438de9b9d8e
/data/media/####/2021-10-09.log.txt
/data/media/####/@gs_1241_so.ofo.labofo_
/data/media/####/@gs_1241_so.ofo.labofo_.lock (deleted)
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/dfe55732e3ae9e6e6f3a4348457e1ba7
/data/media/####/gkt
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/hid.dat.new
/data/media/####/so.ofo.labofo.db
/data/media/####/so.ofo.labofo_.db
/data/media/####/tdata_DNL558
/data/media/####/tdata_RdS556
/data/media/####/tdata_hqs030
/data/media/####/tdata_uiY322
/data/media/####/test.log
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/data/user/0/<Package>/files/dc54d0edfde768f466
/data/user/0/<Package>/files/dcbf796246bd79dd92
/data/user/0/<Package>/files/dcbfef9fb2ff79fe21
/data/user/0/<Package>/files/dcfdfb587ebfffe22e
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/xbin/which su
cat /sys/class/net/wlan0/address
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.smartisan.version
getprop ro.vivo.os.version
ls /
ls /sys/class/thermal

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней