Android.Packed.26643

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Tool.SilentInstaller.3.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

1####.####.154
1####.####.155
1####.####.235
a####.####.cn
czftsh####.com
dkcf####.com
e####.####.cn
eho####.com
g####.####.cn
go####.com
go####.nl
i####.####.cn
j####.com
m####.####.cn
m####.####.com
m####.com
ngeq####.com
ope####.####.cn
osks####.com
p####.####.cn
p####.####.com
pnp####.com
pro####.####.cn
r####.####.com
s####.####.cn
s####.####.com
sh####.####.com
st####.####.cn
t####.com
u####.####.cn
z####.com
zyqmhuj####.com

Запросы HTTP GET:

1####.####.154/index.html
1####.####.155/index.html
1####.####.235/index.html
a####.####.cn/intf.php?method=####&devtype=####&m1=####&m2=####&_t=####&...
czftsh####.com/15018499827069.html
dkcf####.com/15018499692100.html
eho####.com/15018499823366.html
g####.####.cn/sdkv2/local?u=####&uid2=####&sign=####&version=####&news_s...
go####.com/
go####.nl/?gfe_rd=####&ei=####
i####.####.cn/wsm/attach/get?pjt=####&key=####&raw_file_name=####&file_n...
j####.com/15018499827067.html
m####.####.cn/baohe/list?version=####&toid=####&pst=####&os=####&vc=####...
m####.####.com/7QFMxW7QMlHaFZ1TiIgCSSxm-idRzfABmrFR2SOS_9AXVCml0J4rfGpTt...
m####.####.com/cfg/appkey-cf6b551afe338f43
m####.com/15018499730483.html
ngeq####.com/150184999901012.html
ope####.####.cn/AppStore/getIsUpdate?ext=####&pname=####&sr=####&mysrc=#...
osks####.com/15018499704632.html
p####.####.com/bdm/174_174_/t0104361d8d6d38e4b2.png
p####.####.com/dmfd/128_128_80/t01a5406fd6263a40cb.jpg
p####.####.com/dr/160_160_/t010a9112f18d6947ed.png
p####.####.com/dr/160_160_/t01db43cc5509adb595.png
p####.####.com/dr/160_160_/t01e104c3f0d04071a0.png
p####.####.com/t01234826968a35ce00.png
p####.####.com/t015bc663cd1ebd76a9.png
p####.####.com/t0180e9262f0b036868.png
p####.####.com/t01ad27ccd868731063.png
p####.####.com/t01bb6912aca33f6f96.png
p####.####.com/t01bcd77932846e7d4c.png
p####.####.com/t01bed22d225a375da4.png
p####.####.com/t01eb3a945d46a26481.jpg
pnp####.com/150185000065515.html
pro####.####.cn/profile/setting/getsetting?os=####&vc=####&v=####&md=###...
r####.####.com/360baohe/download.php?resurl=####&m=####&m2=####&nt=####&...
s####.####.cn/appstore/info.htm?method=####&os=####&vc=####&v=####&md=##...
s####.####.cn/dmfd/182_136_/t0140dc9d5b71e60af2.jpg?size=####
s####.####.cn/sdkv2/city?u=####&uid2=####&sign=####&version=####&news_sd...
s####.####.com/!3496398b/zepto.min.js
s####.####.com/static/3675c70f40c0dbaa.js
s####.####.com/static/474a11a36fac0e49.js
s####.####.com/static/4df44a62b43b9417.js
sh####.####.com/161226/fdfd489a2beac3a3abcbe1c6441d7c76/libimagepipeline...
st####.####.cn/wsm/attach/get?pjt=####&key=####&raw_file_name=####&file_...
t####.com/150185001266916.html
u####.####.cn/user/sqid?u=####&uid2=####&sign=####&version=####&device=#...
z####.com/15018499767565.html
zyqmhuj####.com/150184999872511.html

Запросы HTTP POST:

e####.####.cn/b/pv?&st=####&m2=####&model=####&mid=####
p####.####.cn/pstat/plog.php

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/Plugin/####/Signature_0.key
<Package Folder>/Plugin/####/base-1.apk
<Package Folder>/Plugin/####/base-1.dex
<Package Folder>/Plugin/####/libupdate-jni-1.0.1.2002.so
<Package Folder>/SaveMyselfPlugin/####/plugin.apk.temp
<Package Folder>/app_MsPlugins/com.qihoo360.mobilesafe.news.apk
<Package Folder>/app_MsPlugins/com.qihoo360.mobilesafe.recommend.apk
<Package Folder>/app_Plugins/<Package>.battery.apk
<Package Folder>/app_Plugins/com.qihoo360.mobilesafe.authguider.apk
<Package Folder>/app_Plugins/com.qihoo360.mobilesafe.clean.apk
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/app_plugins_v3/plugin.tmp
<Package Folder>/cache/####/042AF3D18169DE45936810501E3362F6.apk.temp
<Package Folder>/cache/####/042AF3D18169DE45936810501E3362F6.apk.temp!
<Package Folder>/cache/####/<Package>.battery10210_plugin_suffic.apk
<Package Folder>/cache/####/<Package>.battery10210_plugin_suffic.apk.temp!
<Package Folder>/cache/####/QP.png
<Package Folder>/cache/####/com.qihoo360.mobilesafe.authguider153_plugin_suffic.apk.temp
<Package Folder>/cache/####/com.qihoo360.mobilesafe.authguider153_plugin_suffic.apk.temp!
<Package Folder>/cache/####/com.qihoo360.mobilesafe.clean103_plugin_suffic.apk.temp
<Package Folder>/cache/####/com.qihoo360.mobilesafe.clean103_plugin_suffic.apk.temp!
<Package Folder>/cache/####/com.qihoo360.mobilesafe.news129_plugin_suffic.apk.temp
<Package Folder>/cache/####/com.qihoo360.mobilesafe.news129_plugin_suffic.apk.temp!
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/event.zip
<Package Folder>/cache/####/index
<Package Folder>/cache/####/index.html
<Package Folder>/cache/####/so_imagepipelineappstore_2.apk.temp
<Package Folder>/cache/####/so_imagepipelineappstore_2.apk.temp!
<Package Folder>/databases/_ire-journal
<Package Folder>/databases/account.db
<Package Folder>/databases/account.db-journal
<Package Folder>/databases/download5.db-journal
<Package Folder>/databases/filelist.db-journal
<Package Folder>/databases/ignoreupdate_appinfo.db
<Package Folder>/databases/ignoreupdate_appinfo.db-journal
<Package Folder>/databases/new_downloads.db
<Package Folder>/databases/new_downloads.db-journal
<Package Folder>/databases/update_history.db
<Package Folder>/databases/update_history.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/downloadStat.json
<Package Folder>/file_prefs/####/festival_setting
<Package Folder>/file_prefs/####/freezer
<Package Folder>/file_prefs/####/key_local_status
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/2F702962C39E4CC30E30D9185219B13B
<Package Folder>/files/####/QHA_JSON_PERSISTER_3416a75f4cea9109507cacd8e2f2aefc
<Package Folder>/files/####/Y29tLnFpaG9vLmFwcHN0b3Jl
<Package Folder>/files/####/Y29tLnFpaG9vLmFwcHN0b3Jl (deleted)
<Package Folder>/files/####/Y29tLnFpaG9vLmFwcHN0b3Jl.tick.lock
<Package Folder>/files/####/clean_floatwin_doing_bg.png
<Package Folder>/files/####/clean_floatwin_icon_doing.png
<Package Folder>/files/####/finalcore.jar
<Package Folder>/files/####/finalcore.jar.tmp
<Package Folder>/files/####/floatwin_calculate_normal.png
<Package Folder>/files/####/floatwin_cb_normal.png
<Package Folder>/files/####/floatwin_cb_selected.png
<Package Folder>/files/####/floatwin_clock_normal.png
<Package Folder>/files/####/floatwin_detail_icon.png
<Package Folder>/files/####/floatwin_flashlight_normal.png
<Package Folder>/files/####/floatwin_flashlight_pressed.png
<Package Folder>/files/####/floatwin_mobile_data_normal.png
<Package Folder>/files/####/floatwin_mobile_data_pressed.png
<Package Folder>/files/####/floatwin_seekbar.png
<Package Folder>/files/####/floatwin_top_bg.png
<Package Folder>/files/####/floatwin_wifi_normal.png
<Package Folder>/files/####/floatwin_wifi_pressed.png
<Package Folder>/files/####/pic_1.png
<Package Folder>/files/####/pic_2.png
<Package Folder>/files/####/pic_3.png
<Package Folder>/files/####/pic_4.png
<Package Folder>/files/####/pic_5.png
<Package Folder>/files/####/pic_6.png
<Package Folder>/files/####/pic_7.png
<Package Folder>/files/####/pic_8.png
<Package Folder>/files/####/pic_9.png
<Package Folder>/files/imagepipelineappstore_2.so
<Package Folder>/files/p-n-news.jar
<Package Folder>/files/p-n-recommend.jar
<Package Folder>/files/personal_center_setting_new
<Package Folder>/files/plugin_v3.lock
<Package Folder>/files/tools_cache_new
<Package Folder>/files/uninstallRetainJson
<Package Folder>/files<Package Folder>/####/042AF3D18169DE45936810501E3362F6.zip
<Package Folder>/localApkInfo.json
<Package Folder>/shared_prefs/AppOpsGuide.xml
<Package Folder>/shared_prefs/AppStoreNotificationSharedPref.xml
<Package Folder>/shared_prefs/BaoHe_only_pref.xml
<Package Folder>/shared_prefs/BaoHe_only_pref.xml.bak
<Package Folder>/shared_prefs/Daemon_Only_Pref.xml
<Package Folder>/shared_prefs/LifeHelper.xml
<Package Folder>/shared_prefs/MATSharedPreferences.xml
<Package Folder>/shared_prefs/MATSharedPreferences.xml.bak
<Package Folder>/shared_prefs/MINI360EMS.xml
<Package Folder>/shared_prefs/MINI360EMS.xml.bak
<Package Folder>/shared_prefs/MINI360EMS.xml.bak (deleted)
<Package Folder>/shared_prefs/PermissionMap.xml
<Package Folder>/shared_prefs/QH_DeviceSDK.xml
<Package Folder>/shared_prefs/QH_SDK_M2.xml
<Package Folder>/shared_prefs/QH_SDK_UserData.xml
<Package Folder>/shared_prefs/QH_SDK_UserData.xml.bak
<Package Folder>/shared_prefs/QH_SDK_UserData3416a75f4cea9109507cacd8e2f2aefc.xml
<Package Folder>/shared_prefs/QH_SDK_sessionID.xml
<Package Folder>/shared_prefs/antihijack_config.xml
<Package Folder>/shared_prefs/antihijack_config.xml.bak
<Package Folder>/shared_prefs/app_start_time.xml
<Package Folder>/shared_prefs/app_usage_history.xml
<Package Folder>/shared_prefs/app_usage_history_for_notification.xml
<Package Folder>/shared_prefs/app_usage_history_for_notification.xml.bak
<Package Folder>/shared_prefs/auth_guide_config_sdk.xml
<Package Folder>/shared_prefs/auth_guide_config_sdk.xml.bak
<Package Folder>/shared_prefs/battery.xml
<Package Folder>/shared_prefs/charge_screen_config.xml
<Package Folder>/shared_prefs/clear_shortcut.xml
<Package Folder>/shared_prefs/connect_config.xml
<Package Folder>/shared_prefs/crash.xml
<Package Folder>/shared_prefs/event_config.xml
<Package Folder>/shared_prefs/face_detect_local_pref.xml
<Package Folder>/shared_prefs/festival.xml
<Package Folder>/shared_prefs/float_win_config.xml
<Package Folder>/shared_prefs/float_win_config.xml.bak
<Package Folder>/shared_prefs/game_box.xml
<Package Folder>/shared_prefs/game_redirect.xml
<Package Folder>/shared_prefs/keep_alive_config.xml
<Package Folder>/shared_prefs/launch_foreground_mgr.xml
<Package Folder>/shared_prefs/manage_exam_pref.xml
<Package Folder>/shared_prefs/manage_exam_pref.xml.bak
<Package Folder>/shared_prefs/msplugin_zhushou.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/mysoft_drag_config.xml
<Package Folder>/shared_prefs/mysoft_smart_sort_config.xml
<Package Folder>/shared_prefs/new_one_line_stat.xml
<Package Folder>/shared_prefs/news_local_config.xml
<Package Folder>/shared_prefs/news_sdk_location.xml
<Package Folder>/shared_prefs/news_sdk_scene_day_theme_status.xml
<Package Folder>/shared_prefs/news_sdk_scene_theme_status.xml
<Package Folder>/shared_prefs/news_sdk_status.xml
<Package Folder>/shared_prefs/newssdk_policy_pref_1.2.4.xml
<Package Folder>/shared_prefs/newssdk_policy_pref_1.2.4.xml.bak
<Package Folder>/shared_prefs/newssdk_policy_status.xml
<Package Folder>/shared_prefs/plugins.xml
<Package Folder>/shared_prefs/save_myself_config.xml
<Package Folder>/shared_prefs/scene_channel_status.xml
<Package Folder>/shared_prefs/sdk_config.xml
<Package Folder>/shared_prefs/share_data.xml
<Package Folder>/shared_prefs/share_data.xml.bak
<Package Folder>/shared_prefs/share_data_<Package>;PluginP01.xml
<Package Folder>/shared_prefs/share_data_<Package>;PluginP01.xml.bak
<Package Folder>/shared_prefs/share_data_<Package>;critical.xml
<Package Folder>/shared_prefs/share_data_<Package>;critical.xml.bak
<Package Folder>/shared_prefs/share_data_<Package>;download.xml
<Package Folder>/shared_prefs/share_data_<Package>;download.xml.bak
<Package Folder>/shared_prefs/share_data_com.qihoo.daemon.xml
<Package Folder>/shared_prefs/share_data_com.qihoo.daemon.xml.bak
<SD-Card>/.sfp/.sfp
<SD-Card>/.testf
<SD-Card>/360/####/.nomedia
<SD-Card>/360/####/08dd0969f7764e491bd1e7e265a2a001.0.tmp
<SD-Card>/360/####/2b9f0507b6b536235f88879b064d723b.0.tmp
<SD-Card>/360/####/2da6af319cdcfc396c52b39a5e1145d0.0.tmp
<SD-Card>/360/####/2fc545ed2920b7f3b07806699d9d89dd.0.tmp
<SD-Card>/360/####/3416a75f4cea9109507cacd8e2f2aefc
<SD-Card>/360/####/6L1
<SD-Card>/360/####/6L1 (deleted)
<SD-Card>/360/####/78b471e1ccab19d3440cb102b7b7269f.0.tmp
<SD-Card>/360/####/9831e8471fac30d1ad94733f8c8270b4.0.tmp
<SD-Card>/360/####/a8ec827ebcd128da738cfa5a79af9c85.0.tmp
<SD-Card>/360/####/ba49387b8b453ba7dbfc7c9d09fbca99.0.tmp
<SD-Card>/360/####/bac0982c5226a40f80594b90dbec3ce4.0.tmp
<SD-Card>/360/####/cYd
<SD-Card>/360/####/cYd (deleted)
<SD-Card>/360/####/d2dce0f3e4988959cc16b710f7e36d57.0.tmp
<SD-Card>/360/####/eLO
<SD-Card>/360/####/eLO (deleted)
<SD-Card>/360/####/journal.tmp
<SD-Card>/360/####/sx.record
<SD-Card>/360/####/sx2.record
<SD-Card>/360/####/sx2.record.lock
<SD-Card>/360/.deviceId
<SD-Card>/360Log/downloadLog_delegate
<SD-Card>/360Log/downloadLog_main
<SD-Card>/360Log/downloadLog_p2p
<SD-Card>/360Log/downloadLog_statMan
<SD-Card>/Android/####/-13758700231184799363
<SD-Card>/Android/####/-1960151943-804841429
<SD-Card>/Android/####/-928502959-1358113224
<SD-Card>/Android/####/-LJW64qJOv-nkwq2yJfHlV6ghoE.1581043443.tmp
<SD-Card>/Android/####/-dlqN9Xqk9IAuR9Y1Zr3uuVB1Hs.-129256590.tmp
<SD-Card>/Android/####/-nUkdNv2tg1WGOthXnMYl-dWNmQ.181476656.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/10gn7lewj4preocut6hedorjb
<SD-Card>/Android/####/11XDaXjHreCVDR4F6g2vacxwXYs.1513986376.tmp
<SD-Card>/Android/####/1432048538-1358113224
<SD-Card>/Android/####/228wxveb27naolqju13522u5m
<SD-Card>/Android/####/2kp6o9s249n9t1u9inwzd0f22
<SD-Card>/Android/####/329g6k8itwy4rrtja9fj6wcb
<SD-Card>/Android/####/3PX5ckaldhuDs2qDJ_gtHSyfG94.-1472257244.tmp
<SD-Card>/Android/####/4gozo663w9bszyay6djuqjfg0
<SD-Card>/Android/####/560002864367897460
<SD-Card>/Android/####/5YDf7NbKu5rq9Rto9_X4ejXiHUM.2010028770.tmp
<SD-Card>/Android/####/5tz0n7FaIAMFXpPtsRe429IiPjM.1556218303.tmp
<SD-Card>/Android/####/5vk7d2clrvm2lpj8xsyyqpvh5
<SD-Card>/Android/####/63jqc6ln5chvhcg25a61doiyw
<SD-Card>/Android/####/6thzNNfh0S3-5RAgxPmmt4xcVc8.413143643.tmp
<SD-Card>/Android/####/6v8r3n8cqjfaubt94a045eoc6
<SD-Card>/Android/####/711845266-1165391598
<SD-Card>/Android/####/75nvy1rfahxtav37ny9j9c3zz
<SD-Card>/Android/####/79pyc92t9cyzvdingcunspq8
<SD-Card>/Android/####/7adcxryqd8a5vujwa1pywzl1p
<SD-Card>/Android/####/7mNZpoqcWz0V9urLgEB7VWvfF1c.-1474953887.tmp
<SD-Card>/Android/####/9WEAyGcQTTWN0nKQcgrRWbbFydU.-751280074.tmp
<SD-Card>/Android/####/BWr5S5Yi-cYoIFzrkBGwiN6TC2A.1203274181.tmp
<SD-Card>/Android/####/C0Axki7zDXxCH-p2PKh72XSrA58.-243130409.tmp
<SD-Card>/Android/####/DUFQ_x0L28N-VFe25epC8UsGE50.1448300754.tmp
<SD-Card>/Android/####/EzzM3la60FAlb3_iqolSiPJl4Nw.749569225.tmp
<SD-Card>/Android/####/FvGFH8zIizxMaHZ2mYaelLkfnZs.1032271604.tmp
<SD-Card>/Android/####/G3e4hGLkscSP7MkfAxjXsEKRzcA.641245156.tmp
<SD-Card>/Android/####/GmCfvj4qzk2Ust3cFNiqTdUU66I.-1550944333.tmp
<SD-Card>/Android/####/K3JUuVldvplADsHwmd98-P-irFw.-1657489446.tmp
<SD-Card>/Android/####/KcwVHQcPdqxj5GNIyXHouaRS-SU.-138609864.tmp
<SD-Card>/Android/####/KroKdY2ZEYoZD7cQ1Ndq7oRM4qs.1609019289.tmp
<SD-Card>/Android/####/LKhpL15sdaZSxFds5hpoX9HmFTk.-1333807241.tmp
<SD-Card>/Android/####/LUvWQyPYjqbXFb_IhrmB2UAa13g.-1317234610.tmp
<SD-Card>/Android/####/Lk6-CTtsJ54YgNacT9WYE85o1Ug.-781504477.tmp
<SD-Card>/Android/####/LkCwWZHbGVdMGTS4oP9SQWQB8yY.-1561682849.tmp
<SD-Card>/Android/####/MdtrncwuzyMsjKZ50JS7Ov01lGc.-1730471188.tmp
<SD-Card>/Android/####/NAjcVN_YUpKWx85gV6hRdh-2DJg.-211074303.tmp
<SD-Card>/Android/####/ONn__OqEAAqGPvG3DUsbGaP7YvM.1165105780.tmp
<SD-Card>/Android/####/OsTMkoB_hTNwR9sxrTC7br5fdD4.-922827850.tmp
<SD-Card>/Android/####/OvZCq6DSZTIkm4Zb3SDYKj-9vBc.1010774961.tmp
<SD-Card>/Android/####/QS3YVMmK-3dOHI8hZfbzpkQ-2IE.1768680647.tmp
<SD-Card>/Android/####/RbJAxop_xrHEmMp6jrx6cvhp_ak.-321450985.tmp
<SD-Card>/Android/####/S_--g8GaHKP_eJqqujjs5DgjMvM.1769127162.tmp
<SD-Card>/Android/####/TIblDR9Utjuu0cAew0q5G9otWu8.260847064.tmp
<SD-Card>/Android/####/U8M37AYPUpqUiYWC3uzLggwjgxI.1077811802.tmp
<SD-Card>/Android/####/Uez1In6cttgameOPza6FZ2P6aME.448861873.tmp
<SD-Card>/Android/####/WBNgmp_-OfTCsPmtpCcGcDMs-2w.1203118683.tmp
<SD-Card>/Android/####/XEjyd9-Uibp7h4qAVsOUk6e_nNE.1092229861.tmp
<SD-Card>/Android/####/Y9TXV3XY4Q6kS3kjszG1r0UzjyQ.-2053919607.tmp
<SD-Card>/Android/####/Z1BE0UuBnL0uzpKZuhT6zEBP-E0.-1633903506.tmp
<SD-Card>/Android/####/_atNp2iiSLchgbva62rcrD9O81M.1016248784.tmp
<SD-Card>/Android/####/bz6a4-KfvY-KLBTVYNv7Nzfv-RU.-1550903538.tmp
<SD-Card>/Android/####/cYULAyOl3aCuPWimL8vqpk0UJJk.2124104685.tmp
<SD-Card>/Android/####/d2S8p22FQnk1HClfvPSdrcLhOL8.-1375483143.tmp
<SD-Card>/Android/####/eVATgwU4rsi3GuJsRLPAROKdy4o.1224731720.tmp
<SD-Card>/Android/####/ejkq2t7olbkcdjh7f0eri1ab
<SD-Card>/Android/####/fOpfF0Ok-U4uNE_9sKAR70o5QFU.-432175503.tmp
<SD-Card>/Android/####/gTvDzx38B8ma-TiAMAmEValzX1U.-1320297521.tmp
<SD-Card>/Android/####/gWiIC5axtW-cqKzxOJTTWEBy3PU.-1861822778.tmp
<SD-Card>/Android/####/hA3UTYuxQGhY8z87NTpvjvyfAoc.489324414.tmp
<SD-Card>/Android/####/ii6R89En8hjju_nMASFVjfzWpIc.1755768619.tmp
<SD-Card>/Android/####/izKyOccCUrmmyZak48ZD_OAJl24.1284964844.tmp
<SD-Card>/Android/####/kTI0DsPG1Tyu09OPXihOvGoMKY4.-2007676591.tmp
<SD-Card>/Android/####/ka85dw5z0cjbjxmhxh8dkjfh
<SD-Card>/Android/####/kqSR_nyvtO3tcIf8S4dPIM88LV8.-297152620.tmp
<SD-Card>/Android/####/l2G8VHn1dK0EqFEFoUW16yFfL1c.-2119799873.tmp
<SD-Card>/Android/####/lQGd5d5ZYO0VG0wOWo0boX1jtMc.-1046397787.tmp
<SD-Card>/Android/####/mC7R4Pg-nuznKD6R04qP7aGwmyw.447799390.tmp
<SD-Card>/Android/####/mb1gIKLvS1OcPa5eh7kdJ90wMgY.-533393812.tmp
<SD-Card>/Android/####/mu2y72bM0cyd3OrgBALPkV3GNXI.-1095710345.tmp
<SD-Card>/Android/####/oUSglg84vfvBIH57W5mVa0YBMDQ.-218166999.tmp
<SD-Card>/Android/####/oj2cxTgvkvuoBFWBGYnhPinGLSE.-564521539.tmp
<SD-Card>/Android/####/pV94PTQzvKqiozch2P5ywZItkCA.-1232470124.tmp
<SD-Card>/Android/####/q5D_m6qUDFS_wqttQLdM5zt7xfw.-139152625.tmp
<SD-Card>/Android/####/qndt2BTlrLWT5wa3nqwZa_pylPo.-2096157485.tmp
<SD-Card>/Android/####/rE0BgQBHRzuBWmaDRZ5mVPGQXt4.1579471150.tmp
<SD-Card>/Android/####/tXFM_4f1Wijr5Gw7eronzAUhHYo.1032672364.tmp
<SD-Card>/Android/####/u34vKNtsDmSLta293VfEt7ltrOA.-1068700481.tmp
<SD-Card>/Android/####/uR5nShy3Zwn88suI6uuuERn3xRk.1722569630.tmp
<SD-Card>/Android/####/wSKP6gKfLYJAtx1KcZV8n3xeCiQ.761084137.tmp
<SD-Card>/Android/####/wWO5RX2TJATl0Anlxow2__eekhU.-1168529110.tmp
<SD-Card>/Android/####/x_DVlGdNVvKZa0z3HosTjcrqDwk.1300697196.tmp
<SD-Card>/Android/####/yRH-YRTU0YrGuQQc5HwPjhZAH8Q.-1537599689.tmp
<SD-Card>/Android/####/yolRpzeygoZSJW2O2zMw-BCoMgo.1306264733.tmp
<SD-Card>/Android/####/ypoWf_IqZg3BIekYCJMeiHOY0l8.-1121176454.tmp
<SD-Card>/Android/####/zZ2PH7--EVm0099WpS9QO0dk_Ic.-181208443.tmp
<SD-Card>/Android/####/zaP9BQbwzeoFMPtgI34NOjtWt48.725374949.tmp
<SD-Card>/Android/####/zca2hSG0nM2Yfdz5oFNHBUs-LT0.2078221559.tmp

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 106.120.160.207
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 111.13.66.125
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 182.118.31.99
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.88
/system/bin/sh
app_process / <Package>.rootcommand.persistent.CoreDaemon --nice-name=<Package>_CoreDaemon --daemon
app_process /system/bin com.android.commands.pm.Pm list packages
cat /proc/version
chmod 755 <Package Folder>/.jiagu/libjiagu.so
pm list packages
ps

Загружает динамические библиотеки:

CoreDaemon
imagepipelineappstore_2
libjiagu
uninstall-feedback

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о настроках APN.

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней