Android.Packed.28509

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Click.171.origin
Android.RemoteCode.93.origin
Android.Xiny.197

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) real####.icec####.org:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) dpl.b####.com:80
TCP(HTTP/1.1) c7.la4.down####.####.com:7080
TCP(HTTP/1.1) g####.u####.com:80
TCP(HTTP/1.1) c4.la4.down####.####.com:7080
TCP(HTTP/1.1) face####.com-pri####.win:80
TCP(HTTP/1.1) f####.cdn.1####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) o####.d####.9####.com:80
TCP(HTTP/1.1) wild####.9appsin####.com.####.net:80
TCP(HTTP/1.1) c2.la4.down####.####.com:7080
TCP(HTTP/1.1) po####.9####.com:80
TCP(HTTP/1.1) c2.la2.down####.####.com:7080
TCP(HTTP/1.1) s####.9####.com:80
TCP(HTTP/1.1) c5.la4.down####.####.com:7080
TCP(HTTP/1.1) c14.la2.down####.####.com:7080
TCP(HTTP/1.1) c12.la2.down####.####.com:7080
TCP(HTTP/1.1) sl####.1####.com:8111
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) c1.la4.down####.####.com:7080
TCP(HTTP/1.1) api.9####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) u####.b####.com:80
TCP(HTTP/1.1) tra####.onver####.club:80
TCP(HTTP/1.1) c11.la2.down####.####.com:7080
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) c13.la2.down####.####.com:7080
TCP(HTTP/1.1) c6.la4.down####.####.com:7080
TCP(HTTP/1.1) pl####.mob####.b####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) c12.la4.down####.####.com:7080
TCP(HTTP/1.1) cdn.4####.club:80
TCP(HTTP/1.1) msg.api.9####.com:80
TCP(HTTP/1.1) c3.la4.down####.####.com:7080
TCP(HTTP/1.1) p####.u####.com:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) zhg.ali####.com:443

Запросы DNS:

ak.icec####.org
and####.cli####.go####.com
api.9####.com
api.mob####.b####.com
c1.la4.down####.####.com
c11.la2.down####.####.com
c12.la2.down####.####.com
c12.la4.down####.####.com
c13.la2.down####.####.com
c14.la2.down####.####.com
c2.la2.down####.####.com
c2.la4.down####.####.com
c3.la4.down####.####.com
c4.la4.down####.####.com
c5.la4.down####.####.com
c6.la4.down####.####.com
c7.la4.down####.####.com
cdn.4####.club
dpl.b####.com
f####.cdn.1####.com
face####.com-pri####.win
g####.u####.com
hl####.down####.9appsin####.com
l.a####.com
mo.freeind####.com
msg.api.9####.com
na####.sno####.1####.com
o####.d####.9####.com
p####.lead####.com
p####.u####.com
pl####.mob####.b####.com
po####.9####.com
real####.icec####.org
s####.9####.com
s####.mob####.b####.com
tra####.onver####.club
u####.b####.com
www.admobim####.com
www.mmmmmm####.com
y####.al####.com

Запросы HTTP GET:

api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
c1.la4.down####.####.com:7080/group1/M00/1F/97/o4YBAFVndu-AaikEAAAy7aJVj...
c1.la4.down####.####.com:7080/group1/M02/72/BE/pYYBAFhRfgqAZzmRAAARZG7vH...
c1.la4.down####.####.com:7080/group2/M00/8D/5A/RQ0DAFlbYn2AJRwcAAAQsoq17...
c1.la4.down####.####.com:7080/group2/M00/D3/5D/RQ0DAFmWW7uAYRfdAAAMR3Hft...
c1.la4.down####.####.com:7080/group2/M00/E3/70/QQ0DAFmpL7mAY-GkAAAMdyX3C...
c11.la2.down####.####.com:7080/group1/M00/51/47/poYBAFdAtCKANSs3AAAaDa_X...
c11.la2.down####.####.com:7080/group1/M02/0A/C7/q4YBAFhmW9uAPRECAAAQyfKX...
c11.la2.down####.####.com:7080/group2/M01/E2/3A/RQ0DAFmo6XCAUhJwAAAK5UZg...
c12.la2.down####.####.com:7080/group2/M02/BF/65/Qg0DAFmC1OOAHT58AAAOhlBc...
c12.la4.down####.####.com:7080/group1/M01/45/49/pYYBAFgbADKAaxgUAAAeMfEg...
c12.la4.down####.####.com:7080/group1/M01/64/AD/qYYBAFfuOBiAboOoAAAC1Bn3...
c12.la4.down####.####.com:7080/group1/M01/91/CF/qYYBAFgbADKAEf_VAAAeMLRz...
c12.la4.down####.####.com:7080/group2/M00/60/AA/RQ0DAFk8fbWANrr5AAAfZGh0...
c12.la4.down####.####.com:7080/group2/M00/81/03/RA0DAFlTXpSAO3SZAAAhM5Xo...
c12.la4.down####.####.com:7080/group2/M00/9D/B4/RA0DAFloRQ-AK3olAAAjKkw3...
c12.la4.down####.####.com:7080/group2/M00/A4/E7/RA0DAFlshyWAOF1vAAAHVTZT...
c12.la4.down####.####.com:7080/group2/M00/A7/62/RQ0DAFludMCAXlyiAAAPVv5o...
c12.la4.down####.####.com:7080/group2/M00/D2/86/RQ0DAFmVf5KAcYxiAAAjcS-7...
c12.la4.down####.####.com:7080/group2/M00/D3/83/QQ0DAFmWjS-AUQisAAANmeQp...
c12.la4.down####.####.com:7080/group2/M01/54/63/RQ0DAFk1NRKAIMzGAAAI6_mf...
c12.la4.down####.####.com:7080/group2/M01/CA/8D/QQ0DAFmNhzGAAMkQAAAcWXoZ...
c12.la4.down####.####.com:7080/group2/M01/DF/E6/Qg0DAFmml0CAV5jjAAATTCTL...
c12.la4.down####.####.com:7080/group2/M01/E1/DE/QQ0DAFmo19SAbc4AAAAKTseV...
c13.la2.down####.####.com:7080/group1/M02/EF/39/qoYBAFiea-2ALo8VAAAiv7XE...
c13.la2.down####.####.com:7080/group2/M02/DC/0C/RQ0DAFmiDgGAHVOOAAAjHxMV...
c14.la2.down####.####.com:7080/group1/M02/0A/2B/qoYBAFi5Y7-AeHhZAAAXChpa...
c14.la2.down####.####.com:7080/group2/M01/28/CC/Qg0DAFkdbCCAFlMCAAANUhnU...
c2.la2.down####.####.com:7080/group2/M00/B1/CB/RA0DAFl27VaAKBTbAAAVoPHb1...
c2.la4.down####.####.com:7080/group1/M00/1F/97/o4YBAFVndu-ACWhJAAAxJyNx8...
c2.la4.down####.####.com:7080/group1/M00/3C/F4/p4YBAFfWC0eAFrvGAAAKdmCuB...
c2.la4.down####.####.com:7080/group1/M01/08/58/oYYBAFQ9dxCAWaOtAAALTnEJD...
c2.la4.down####.####.com:7080/group1/M01/1B/7F/pYYBAFVndu-AEPs_AACz9AKsO...
c2.la4.down####.####.com:7080/group1/M01/1F/97/pIYBAFVndu-Acw-4AAAzV019v...
c2.la4.down####.####.com:7080/group2/M00/AB/9D/QQ0DAFlxxyeAP4znAAASM3m85...
c2.la4.down####.####.com:7080/group2/M00/C8/7E/RA0DAFmLzSKABf6_AAAJA-yL-...
c2.la4.down####.####.com:7080/group2/M01/D9/7D/RA0DAFmegN-ARpJFAAAJQBYv9...
c2.la4.down####.####.com:7080/group2/M01/DF/E3/RA0DAFmmlZqAPSS3AAAUWkk5o...
c2.la4.down####.####.com:7080/group2/M02/18/F8/RQ0DAFkVe-6AMTLbAABpLUBZk...
c2.la4.down####.####.com:7080/group2/M02/4C/95/Qg0DAFkvwhKAFsFNAAARm9dJl...
c3.la4.down####.####.com:7080/group2/M00/14/14/RQ0DAFkS53aAAq1wAAAeqzgRL...
c3.la4.down####.####.com:7080/group2/M00/25/8F/RA0DAFkbur-AcdbOAAAI51t9I...
c3.la4.down####.####.com:7080/group2/M00/BC/82/RQ0DAFmAX0OAVPukAAARNDkCu...
c3.la4.down####.####.com:7080/group2/M00/C3/FC/Qg0DAFmHemSAf-eoAAAME1U6E...
c3.la4.down####.####.com:7080/group2/M00/DE/0E/Qg0DAFmkxT6AQ_xAAAAlRT54S...
c3.la4.down####.####.com:7080/group2/M00/E3/85/RA0DAFmpOi6AFaRhAAAYEuFBq...
c3.la4.down####.####.com:7080/group2/M02/DE/F6/RA0DAFmllDiAV9O3AAAK94MXz...
c3.la4.down####.####.com:7080/group2/M02/E0/EC/RA0DAFmnqriAZen3AABgSZqox...
c4.la4.down####.####.com:7080/group1/M00/18/26/pYYBAFfuN8GAS0P2AAAC0c0UW...
c4.la4.down####.####.com:7080/group1/M00/1B/7F/poYBAFVndu-AD4k4AAA2G6Odf...
c4.la4.down####.####.com:7080/group1/M00/7C/6C/qIYBAFkH_DWATu_FAAASB8Cwn...
c4.la4.down####.####.com:7080/group1/M01/18/2B/poYBAFfuN8OAGenKAAAJ_cFk1...
c4.la4.down####.####.com:7080/group1/M01/96/01/qIYBAFg2opmAUGCyAAAB1tPaT...
c4.la4.down####.####.com:7080/group1/M02/A7/AD/qoYBAFhg9I6AOkFcAAAbPgQ1X...
c4.la4.down####.####.com:7080/group2/M00/9B/7B/RA0DAFllvmqAZwOEAAAVSL8DR...
c4.la4.down####.####.com:7080/group2/M00/B6/FA/RA0DAFl6-jmATtQwAAAf_5SoO...
c4.la4.down####.####.com:7080/group2/M00/BC/82/QQ0DAFmAX0OASolXAAAP4Irb8...
c4.la4.down####.####.com:7080/group2/M01/54/63/RA0DAFk1NPiAFronAAADKNTgE...
c4.la4.down####.####.com:7080/group2/M01/DE/0E/QQ0DAFmkxT-AXcefAAAlRT54S...
c4.la4.down####.####.com:7080/group2/M02/4D/E3/Qg0DAFkwwAiAGkHPAAAeqSrGt...
c4.la4.down####.####.com:7080/group2/M02/BC/82/Qg0DAFmAX0KAD7sXAAAP4VdvI...
c5.la4.down####.####.com:7080/group1/M00/3A/FA/qoYBAFfuOBuAHHmVAAAJjVcyi...
c5.la4.down####.####.com:7080/group1/M01/D2/D8/poYBAFeqZxiACY5lAAAO2SSCg...
c5.la4.down####.####.com:7080/group1/M02/14/AD/q4YBAFhvxpuAXa33AAAfzgL_f...
c5.la4.down####.####.com:7080/group1/M02/2B/39/poYBAFjwbG2AAgBPAAANOXG7O...
c5.la4.down####.####.com:7080/group2/M01/CE/57/RQ0DAFmRdLqAb8hEAAAKibsR2...
c5.la4.down####.####.com:7080/group2/M02/B7/1B/Qg0DAFl7Di2ARPufAAAMDRxbv...
c5.la4.down####.####.com:7080/group2/M02/E6/D7/Qg0DAFmqt46ADShnAAAIBn5By...
c6.la4.down####.####.com:7080/group1/M00/45/4E/poYBAFgbADKAR5jsAAAt6jEae...
c6.la4.down####.####.com:7080/group1/M00/7E/D6/qIYBAFgbADGAU29lAAARU1W0_...
c6.la4.down####.####.com:7080/group1/M02/A9/68/pYYBAFiAcB2ALTI1AAALqkdLe...
c6.la4.down####.####.com:7080/group2/M00/18/F7/Qg0DAFkVe-iAe6AjAAALXksbw...
c6.la4.down####.####.com:7080/group2/M00/AA/06/Qg0DAFlwcRqAU-WeAAANHYP5K...
c6.la4.down####.####.com:7080/group2/M00/DE/BE/Qg0DAFmlVPaASUzgAAAZZcwkD...
c6.la4.down####.####.com:7080/group2/M00/E1/4F/QQ0DAFmoGMmASEeQAAAjRMCk6...
c6.la4.down####.####.com:7080/group2/M01/BC/82/RA0DAFmAX0OAHFd2AAAP4VdvI...
c6.la4.down####.####.com:7080/group2/M01/CB/21/RA0DAFmOIieABkHAAAAIYmr-y...
c6.la4.down####.####.com:7080/group2/M02/BF/65/RA0DAFmC1OaAQ6IpAAAJC7Geb...
c6.la4.down####.####.com:7080/group2/M02/CE/56/Qg0DAFmRdKeAYCFMAAAF5XVdh...
c7.la4.down####.####.com:7080/group1/M00/09/91/poYBAFcDiy-Ab09PAAAUK5as0...
c7.la4.down####.####.com:7080/group1/M00/5C/79/poYBAFg2oqWAAUAWAAAITyh1r...
c7.la4.down####.####.com:7080/group1/M02/9F/C3/poYBAFh3GUqAdwhUAAARD7WFG...
c7.la4.down####.####.com:7080/group2/M00/D5/ED/RA0DAFmZ1AKAQ5mvAAALtK4tV...
c7.la4.down####.####.com:7080/group2/M00/E2/0A/RQ0DAFmo4YKAIjxSAAAR9iOfS...
c7.la4.down####.####.com:7080/group2/M01/B1/8A/QQ0DAFl2sL6AX3FdAAASP4Our...
c7.la4.down####.####.com:7080/group2/M02/98/67/RA0DAFljrj6AJenDAAActP9oP...
c7.la4.down####.####.com:7080/group2/M02/9B/7B/RA0DAFllvmeAFkGtAAAHVmAgc...
c7.la4.down####.####.com:7080/group2/M02/DF/DE/Qg0DAFmmkC-AfiTZAAATLZPSk...
c7.la4.down####.####.com:7080/group2/M02/E0/E5/RQ0DAFmnommAGO5DAAAWcNIcb...
cdn.4####.club/static/gsubcountry/yes/NL/names.js
cdn.4####.club/static/sweep/global/zepto.min.js
dpl.b####.com/M01/01/AC/CvJKDlmj_zaAOXVEAArECPaKkRM025.zip
face####.com-pri####.win/r/l/f42fe0eb8a3e5e92a6023679ef97de4f/?entrypop=...
face####.com-pri####.win/r/t?entrypop=####&voluum_cid=####&lang=####&cc=...
msg.api.9####.com/get/msg?app=####&imei=####&versionCode=####&versionNam...
o####.d####.9####.com/upload/common/2017/7/20/17/66254647-91e6-4bdc-916b...
o####.d####.9####.com/upload/common/2017/7/20/17/9d64c3a7-ff90-4c92-a40d...
p####.u####.com/u1/wwy59wzx45w64x79xzwxzyww4578zw48996wy8787x5wwwwwxwwxx...
s####.9####.com/9apps/share?appSize=####&packageName=####&versionCode=##...
u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...
wild####.9appsin####.com.####.net/9apps/rs/2017/02fdef3b1ac276eb2973e618...
wild####.9appsin####.com.####.net/9apps/rs/2017/0c41799beee58149f9a4ba82...
wild####.9appsin####.com.####.net/9apps/rs/2017/106d2ee8ba95e966f30a50e8...
wild####.9appsin####.com.####.net/9apps/rs/2017/1b893e1c58dbd4bd2e1a1b29...
wild####.9appsin####.com.####.net/9apps/rs/2017/21053219746c86dd2d207e2e...
wild####.9appsin####.com.####.net/9apps/rs/2017/2d88e120afa167132c486504...
wild####.9appsin####.com.####.net/9apps/rs/2017/418a5e2906e507a375f59e70...
wild####.9appsin####.com.####.net/9apps/rs/2017/450310489ac371ded2b1b4cd...
wild####.9appsin####.com.####.net/9apps/rs/2017/6866ec7e044b8485ff642498...
wild####.9appsin####.com.####.net/9apps/rs/2017/762393a53bb19d28d0f83187...
wild####.9appsin####.com.####.net/9apps/rs/2017/76a905276c0782219850d573...
wild####.9appsin####.com.####.net/9apps/rs/2017/77bb698adf78486ff3065cdf...
wild####.9appsin####.com.####.net/9apps/rs/2017/88d0cd26a59bcd2f827d1158...
wild####.9appsin####.com.####.net/9apps/rs/2017/8e4ac78852a9e9b5ec2aedf8...
wild####.9appsin####.com.####.net/9apps/rs/2017/943d1498acc85f35c00ab32a...
wild####.9appsin####.com.####.net/9apps/rs/2017/95382beffad022ce9ccfe0cd...
wild####.9appsin####.com.####.net/9apps/rs/2017/96e703e3b8cb5cf8c528143d...
wild####.9appsin####.com.####.net/9apps/rs/2017/d920bde6126706ab888d2c9a...
wild####.9appsin####.com.####.net/9apps/rs/2017/f16fbc1d9e739b6b5c6fe3bc...
wild####.9appsin####.com.####.net/9apps/rs/2017/f4e1f28eefc438b54f25faf4...
wild####.9appsin####.com.####.net/9apps/rs/2017/f8a9992ccb4f50d98182d5cb...

Запросы HTTP POST:

l.a####.com/l.php
l.a####.com/sal.php
mo.freeind####.com/detail/getOfferListNew?enc=####
p####.u####.com/upgrade/index.xhtml?from=####
pl####.mob####.b####.com/ad_dex.php
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
sl####.1####.com:8111/native/api/v1/update
sl####.1####.com:8111/native/sdk/api/ad/client_action
sl####.1####.com:8111/native/sdk/api/regclient
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.mbj/####/classes.zip
<Package Folder>/HasStarted
<Package Folder>/app_SGLib/####/libsgmainso-5.3.7011.so.tmp
<Package Folder>/app_SGLib/####/lock.lock
<Package Folder>/app_jniLibs/libcrash_1.5.0.0.so
<Package Folder>/app_osdk/adflash_shell.jar
<Package Folder>/app_osdk/t.zip
<Package Folder>/app_wa/####/11gpsdfe_1501849929589002097.wa
<Package Folder>/app_wa/####/12hqtegf_1501849932287002097.wa
<Package Folder>/app_wa/####/13irufhg_1501849933638002097.wa
<Package Folder>/app_wa/####/14jsvgih_1501849946569002097.wa
<Package Folder>/app_wa/####/15ktwhji_1501849966502002097.wa
<Package Folder>/cache/####/1d5082a35f11925942aa125a3aef88c5.0
<Package Folder>/cache/####/1d5082a35f11925942aa125a3aef88c5.1
<Package Folder>/cache/####/2b590792f26a60503cfc7902602b26f7.0
<Package Folder>/cache/####/2b590792f26a60503cfc7902602b26f7.0.tmp
<Package Folder>/cache/####/2b590792f26a60503cfc7902602b26f7.1
<Package Folder>/cache/####/38e9975f7e6bed6b96bc6d465a75bfc6.0.tmp
<Package Folder>/cache/####/38e9975f7e6bed6b96bc6d465a75bfc6.1.tmp
<Package Folder>/cache/####/4697df8e212dd6c77865c40d92a9a3c7.0.tmp
<Package Folder>/cache/####/4697df8e212dd6c77865c40d92a9a3c7.1.tmp
<Package Folder>/cache/####/4b440caf7743e9b720b62a4cadb4bc1e.0
<Package Folder>/cache/####/4b440caf7743e9b720b62a4cadb4bc1e.0.tmp
<Package Folder>/cache/####/4b440caf7743e9b720b62a4cadb4bc1e.1
<Package Folder>/cache/####/4b440caf7743e9b720b62a4cadb4bc1e.1.tmp
<Package Folder>/cache/####/4ed5caf184be56d9ff0e6eadfcdc04d9.0.tmp
<Package Folder>/cache/####/4ed5caf184be56d9ff0e6eadfcdc04d9.1.tmp
<Package Folder>/cache/####/599d81ad9a06c2c85470e55247b55b1f.0.tmp
<Package Folder>/cache/####/599d81ad9a06c2c85470e55247b55b1f.1.tmp
<Package Folder>/cache/####/6ca366e3bc4467e713243578db25a61c.0.tmp
<Package Folder>/cache/####/6ca366e3bc4467e713243578db25a61c.1.tmp
<Package Folder>/cache/####/71ed9fdd43be1279257735def9b10a46.0
<Package Folder>/cache/####/71ed9fdd43be1279257735def9b10a46.1
<Package Folder>/cache/####/771a012dd4b59cbbf875e09ca365a7ec.0
<Package Folder>/cache/####/771a012dd4b59cbbf875e09ca365a7ec.1
<Package Folder>/cache/####/772ab455f0aa1d43748b94dc9211a4eb.0.tmp
<Package Folder>/cache/####/772ab455f0aa1d43748b94dc9211a4eb.1.tmp
<Package Folder>/cache/####/85c3ce92159fa7dbf272969bb63b3398.0
<Package Folder>/cache/####/85c3ce92159fa7dbf272969bb63b3398.0.tmp
<Package Folder>/cache/####/85c3ce92159fa7dbf272969bb63b3398.1
<Package Folder>/cache/####/85c3ce92159fa7dbf272969bb63b3398.1.tmp
<Package Folder>/cache/####/86b2fccce53f49ae697e306254980db9.0
<Package Folder>/cache/####/86b2fccce53f49ae697e306254980db9.0.tmp
<Package Folder>/cache/####/86b2fccce53f49ae697e306254980db9.1
<Package Folder>/cache/####/86b2fccce53f49ae697e306254980db9.1.tmp
<Package Folder>/cache/####/87dd0e4436a0d586ed1a5ba67bfa64ba.0
<Package Folder>/cache/####/87dd0e4436a0d586ed1a5ba67bfa64ba.1
<Package Folder>/cache/####/94ab39639b441e2a253903de93ad81f5.0.tmp
<Package Folder>/cache/####/94ab39639b441e2a253903de93ad81f5.1.tmp
<Package Folder>/cache/####/9cb457725b1f3267af423b7c617287b7.0.tmp
<Package Folder>/cache/####/9cb457725b1f3267af423b7c617287b7.1
<Package Folder>/cache/####/9ef696d4f6273b57bed9cbd186ccab37.0.tmp
<Package Folder>/cache/####/9ef696d4f6273b57bed9cbd186ccab37.1.tmp
<Package Folder>/cache/####/acfe7eabb3f91b29478afb974b7781f2.0.tmp
<Package Folder>/cache/####/acfe7eabb3f91b29478afb974b7781f2.1.tmp
<Package Folder>/cache/####/b35d8bb92770ed629cf6fc242c04c91e.0.tmp
<Package Folder>/cache/####/b35d8bb92770ed629cf6fc242c04c91e.1.tmp
<Package Folder>/cache/####/b69dbc38fced59db3194cf73ab85f09b.0
<Package Folder>/cache/####/b69dbc38fced59db3194cf73ab85f09b.1
<Package Folder>/cache/####/c19fabc3fa3363ec7aec61cc9697ac5a.0.tmp
<Package Folder>/cache/####/c19fabc3fa3363ec7aec61cc9697ac5a.1
<Package Folder>/cache/####/cd4c3a2bb02a23267ce1482cef70a598.0.tmp
<Package Folder>/cache/####/cd4c3a2bb02a23267ce1482cef70a598.1.tmp
<Package Folder>/cache/####/d513ab82c86aeefb3b84b678c6b69770.0
<Package Folder>/cache/####/d513ab82c86aeefb3b84b678c6b69770.1
<Package Folder>/cache/####/d814cacfaf7b27b9644836f4f4cb3937.0
<Package Folder>/cache/####/d814cacfaf7b27b9644836f4f4cb3937.1
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/e0e7589da7c4637fc3b45bb0568d1dc3.0.tmp
<Package Folder>/cache/####/e0e7589da7c4637fc3b45bb0568d1dc3.1.tmp
<Package Folder>/cache/####/fa71067f71e9b1a367273f9eb5f8ead7.0.tmp
<Package Folder>/cache/####/fa71067f71e9b1a367273f9eb5f8ead7.1.tmp
<Package Folder>/cache/####/fd2e103c266c19117cd2241762a9ed82.0.tmp
<Package Folder>/cache/####/fd2e103c266c19117cd2241762a9ed82.1.tmp
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.bb
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.ff
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.meminfo
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.pid
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.ps
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.start
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.time
<Package Folder>/crashsdk/####/QPAIDNI0ELIBOM0MOC.uptime
<Package Folder>/crashsdk/####/REKROW1QPAIDNI0ELIBOM0MOC.bb
<Package Folder>/crashsdk/####/unique
<Package Folder>/databases/9apps.db-journal
<Package Folder>/databases/WaValue.db-journal
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/appusage.db-journal
<Package Folder>/databases/arrkii.native.sdk.db-journal
<Package Folder>/databases/downloader-journal
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/home_app_data_us.json
<Package Folder>/files/0a231bd8575dcf72.txt
<Package Folder>/files/SGMANAGER_DATA2
<Package Folder>/files/SGMANAGER_DATA2.tmp
<Package Folder>/files/adflashcore.jar
<Package Folder>/files/daemon
<Package Folder>/files/dc3df659af1392d36d
<Package Folder>/files/google.db
<Package Folder>/files/sp.lock
<Package Folder>/files/t.jar
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/shared_prefs/9apps.xml
<Package Folder>/shared_prefs/9apps.xml (deleted)
<Package Folder>/shared_prefs/9apps.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml.bak
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml.bak
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml.bak
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/SYSTEM_CACHE.xml
<Package Folder>/shared_prefs/SYSTEM_CACHE.xml.bak
<Package Folder>/shared_prefs/adflash.xml
<Package Folder>/shared_prefs/adflash.xml.bak
<Package Folder>/shared_prefs/ak.native.sdk.xml
<Package Folder>/shared_prefs/ak.native.sdk.xml.bak
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/aps.xml.bak
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/arrkiiad.xml
<Package Folder>/shared_prefs/arrkiiad.xml.bak
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/ffc1d42b1ca5e3db2657d00b91997f6a.xml
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/service_config.xml.bak
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/settingsLog.xml.bak
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/v71.xml
<Package Folder>/shared_prefs/v71.xml.bak
<Package Folder>/shared_prefs/worker_preferences.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.androidsystem/####/49.x-4.3.5-vs.apk
<SD-Card>/.androidsystem/####/PlugShareData
<SD-Card>/.androidsystem/####/plugxml.xml
<SD-Card>/.androidsystem/Plugin.zip
<SD-Card>/.com.taobao.dp/dd7893586a493dc3
<SD-Card>/9appsPro/####/libcrash_1.5.0.0.so.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/012c038da1eb6e4cd6575d113430b1aaa307c1dc....0.tmp
<SD-Card>/Android/####/0153d21685c281d70a118499ba199b12ea1d57fc....0.tmp
<SD-Card>/Android/####/01654265b3a169f129c64365002cddcb36add196....0.tmp
<SD-Card>/Android/####/02fb78f046bf875326454bc4cf8a4eb937f42939....0.tmp
<SD-Card>/Android/####/036b4018864f50e882e2e1f509ec3736154ceadc....0.tmp
<SD-Card>/Android/####/04bb1785a09e2846460b1f9f3df4e918c1fa8ef2....0.tmp
<SD-Card>/Android/####/05938402ae05bbd63b5f5a8056449ecb4b186a1a....0.tmp
<SD-Card>/Android/####/0604cab082286cd438ec91c1dd00fcf87b802271....0.tmp
<SD-Card>/Android/####/09a878dfe460c737cd62357cf98c674c4c36bbd9....0.tmp
<SD-Card>/Android/####/0dca18d77743fb557b7bbb1a6e440bc359424a32....0.tmp
<SD-Card>/Android/####/1291a8f94bcf953de862a19b1d5b24d6c761e45b....0.png
<SD-Card>/Android/####/1291a8f94bcf953de862a19b1d5b24d6c761e45b....0.tmp
<SD-Card>/Android/####/1404124d7c44671d69312ed96803540abe58e045....0.tmp
<SD-Card>/Android/####/1588db1245a5463b8b2efbddb6ebc827b69b5556....0.tmp
<SD-Card>/Android/####/17b37027b8abd2f5e7244a941fada39926cf3744....0.tmp
<SD-Card>/Android/####/191a02b5cdc7680d7a5d16da119a88603032b478....0.tmp
<SD-Card>/Android/####/1ab9c7e60915b8fab527d2dbfee5679f1217056b....0.tmp
<SD-Card>/Android/####/202991d053d591d229181b76f8688c944d454c59....0.tmp
<SD-Card>/Android/####/20ba6487d5c7a2d79e25a804c7b81de4cc2c1dad....0.tmp
<SD-Card>/Android/####/237af98a15dbd61e2551a55d9639ca12cd858219....0.tmp
<SD-Card>/Android/####/25f557d49022663af1326ba9c027e420c220c944....0.tmp
<SD-Card>/Android/####/29a164915957f24fcd73d85127b6be5730771d21....0.tmp
<SD-Card>/Android/####/2c2db5e9169b8c36e87fa05e18e4cf78ce1fecd5....0.tmp
<SD-Card>/Android/####/2c31e046b055ba9a978bd393d37f862190bfb0c3....0.tmp
<SD-Card>/Android/####/2e66bb0646e5b465a52f115495f25123be3b9630....0.tmp
<SD-Card>/Android/####/31ada6f81750db7194e50c1c497a720028f0436a....0.tmp
<SD-Card>/Android/####/35357b777d8e4778a662de12089d4ff8c3588494....0.tmp
<SD-Card>/Android/####/355e857c87593d441bafe8e327fc178db2aab632....0.tmp
<SD-Card>/Android/####/3722959bd8a62bf40a17b46b9372d494055b7c13....0.tmp
<SD-Card>/Android/####/3c61a06861be7c66f628018e958ce21600533b20....0.tmp
<SD-Card>/Android/####/3d7fea62f5a64bb635f1e6c90cdbe4cfac31df04....0.tmp
<SD-Card>/Android/####/3f5c771d6bbc08f4bde364df116fa69fa20bfab2....0.tmp
<SD-Card>/Android/####/412751e130294c29efe32d8ab73f4f927ec74e1e....0.tmp
<SD-Card>/Android/####/43136aa720a2841a1381978a6142216d59d5baaa....0.tmp
<SD-Card>/Android/####/46e427033c3f5346227ad812f979ed64662890df....0.tmp
<SD-Card>/Android/####/4c9c70e2d40682494df26cadcea1d2f17514d59f....0.tmp
<SD-Card>/Android/####/4da3c61143c62744e82a338135ada686156ce71a....0.tmp
<SD-Card>/Android/####/4f4b578b295fce9b56faa0ab7a2444882fb132a2....0.tmp
<SD-Card>/Android/####/549f583238ab968a7fb63a48b1569f16e42c0d21....0.tmp
<SD-Card>/Android/####/593fa95116b38ff4b239718e9cdea51a152f813f....0.tmp
<SD-Card>/Android/####/5a97e98a63f874e9b56e386f873bf27683fdd725....0.tmp
<SD-Card>/Android/####/5b743f186e5b8f40b3d3a4fd9cb41ce85266f689....0.tmp
<SD-Card>/Android/####/5ba2b13af74bcf92ca919fed4662069191b4b72d....0.tmp
<SD-Card>/Android/####/5f0801329591cd674ba1a209ac6c2e609b1d32c8....0.tmp
<SD-Card>/Android/####/5f3a55991d138a91a98a1466c3d01021e7b64b6e....0.tmp
<SD-Card>/Android/####/606a5e4a60c451dd5f9833233ce5be76e0f493c4....0.tmp
<SD-Card>/Android/####/62af85c78d05359b7e0cff79c24dc2b485671936....0.tmp
<SD-Card>/Android/####/6604bac109a4f9075548c5c9985406722f57e875....0.tmp
<SD-Card>/Android/####/69ae44459c9d91c5d185b25b6487a01a32a63f04....0.tmp
<SD-Card>/Android/####/6d03bb60bcf728b99ff0e4ad0167c86b0ac28182....0.tmp
<SD-Card>/Android/####/6e51be3ad5ded5d3364f64ed77d03c4a6d531447....0.tmp
<SD-Card>/Android/####/6fe9e3fe44fc92faf65081f310bb7b300cfc73bc....0.tmp
<SD-Card>/Android/####/71b98d9d412919dc98505f230a6cd1989bec2eab....0.tmp
<SD-Card>/Android/####/74ec364629349fb6f4430fe1e153b50486f6f7a7....0.tmp
<SD-Card>/Android/####/775bb263d1012d26bef0674ab4d290a1828e45c8....0.tmp
<SD-Card>/Android/####/794502a8a433c1c79fa3b5cd00b87c86135c3880....0.tmp
<SD-Card>/Android/####/7b32c931b521e5895153acfbfe42fc7d44d70f4a....0.tmp
<SD-Card>/Android/####/7c7b2080e45fda4963452dbc2de806676e6886a6....0.tmp
<SD-Card>/Android/####/7d81a9884f332cffbed0c50ba6db3d674bb0af0a....0.tmp
<SD-Card>/Android/####/8598a44aa64c38869d72045f0496c01337a0efa3....0.tmp
<SD-Card>/Android/####/872f29ea18f8eb63d3d6943b022c2dd622fd89dd...d76f.0
<SD-Card>/Android/####/8bed71e72b400159e36c7c705480dd61478a30cf....0.tmp
<SD-Card>/Android/####/905feff4caf0f85f577c557834fe12bf0c1050fe....0.tmp
<SD-Card>/Android/####/91b283ffbb0fe9a0919beca01d4b2e54e9841885....0.tmp
<SD-Card>/Android/####/91d9685e18db7b0a7dfa0ec2c771bc4fb81d694b....0.tmp
<SD-Card>/Android/####/93262d0d12d0465ae6764406159f767765a84433....0.tmp
<SD-Card>/Android/####/93f7bac9f3b06904f2a6e45adcae4ca643a357e6....0.tmp
<SD-Card>/Android/####/973cbc142fb79bd09dca7ddc9026c3a1904c32c6....0.tmp
<SD-Card>/Android/####/99cdb87ab451ab422549e01f96692760194a3a9a....0.tmp
<SD-Card>/Android/####/99f58d5906726655679eef0fa679973381222688....0.tmp
<SD-Card>/Android/####/9c0d8b3e4234c67a8c4e84f1436617cf9f874edd....0.tmp
<SD-Card>/Android/####/9d12b76aa7fc44f1fbcbaf5c7620c4ae23f3ff40....0.tmp
<SD-Card>/Android/####/9f75c353b895bde9deb09c4763d66f21cb008666....0.png
<SD-Card>/Android/####/9f75c353b895bde9deb09c4763d66f21cb008666....0.tmp
<SD-Card>/Android/####/a1cbed8dd858ceb0f75d336ac1f2dac4c1a0b73f....0.tmp
<SD-Card>/Android/####/a69c118e395d7f5c511e4b06a705a45d59ba6def....0.tmp
<SD-Card>/Android/####/a73db1030e39b4ac45c4411243a585707db5e3f8....0.tmp
<SD-Card>/Android/####/a7ec223625fe94af0612af003f80b1bc92211bad....0.tmp
<SD-Card>/Android/####/a7f0e46119b827e971a83c2b1f4c840d048061a0....0.tmp
<SD-Card>/Android/####/a89b73b4a0ccd388c2ffb9861176efe175c266c9....0.tmp
<SD-Card>/Android/####/aa681e965fb17174e7fd296724d4f19a7a34fec3....0.tmp
<SD-Card>/Android/####/ad8fa6a6a45ae9b3c706e5f9bd3db2d5d151dad6....0.tmp
<SD-Card>/Android/####/b83246cdfe72400b3c25abb234d5a955c4b765e4....0.tmp
<SD-Card>/Android/####/c13d18fc85dfaea145faf4e2771214fa2ae1e4c2....0.tmp
<SD-Card>/Android/####/c342bae1f0889f1053f988aff9aeec0cf367b398....0.tmp
<SD-Card>/Android/####/c43ac8bf9aedf8dad35bf87daf1f89c2ea6b8ecb....0.tmp
<SD-Card>/Android/####/c9f85dad2297ddafc4d720cc2e50f7aa70a851da...54a4.0
<SD-Card>/Android/####/d5242907ddd202743eaba21e9591797eba70eee9....0.tmp
<SD-Card>/Android/####/d53479ed21ee91697a2422ea5e93b03a1aac3501....0.tmp
<SD-Card>/Android/####/d53f75e431b562f98e9aefca689ce46ba287521a....0.tmp
<SD-Card>/Android/####/d6c1445c6c110deb13ec840fa924f813e1e3d0af....0.tmp
<SD-Card>/Android/####/d798ddeb5af49ec0dc0a664ab1e8f95313d4be5a....0.tmp
<SD-Card>/Android/####/d846ecbfbca0a59c65b4cc6c8319321a0e89c50b....0.tmp
<SD-Card>/Android/####/d913cb9f0e7b7df2caa817a03432d72617dd3585....0.tmp
<SD-Card>/Android/####/dc8cad325256d9ec600a36d72a716123f353213a....0.tmp
<SD-Card>/Android/####/de2ebcfa3761cb06b3fcd33fbfdf209f35d13f04....0.tmp
<SD-Card>/Android/####/dfb268ab45523365131b064498ffecd28a3dbe71....0.tmp
<SD-Card>/Android/####/e23415375259b2a68df2e668a9d35394efe9f94a....0.tmp
<SD-Card>/Android/####/e8a1e4fae2eaa1b10e692e44007698dd5e2fae9b....0.tmp
<SD-Card>/Android/####/e95c967c46c6f273c8fd77855ab83ca142477431....0.tmp
<SD-Card>/Android/####/e9bb3351fea4c89686c80282693ece1533171f62....0.tmp
<SD-Card>/Android/####/ebe77bd2bc759a9b848afacaf86ac6bb7ba17f1c....0.tmp
<SD-Card>/Android/####/ec58e1e29f60ee8d726de1a46b33ce3dead6d058....0.tmp
<SD-Card>/Android/####/f225b1da9d5f868ee4a0d7c619c92270c1dd738d....0.tmp
<SD-Card>/Android/####/f279cfeaf31e0fe51fc5dd0c0f62f763e34d7acb....0.tmp
<SD-Card>/Android/####/f599aa2eb2cfdfcab9c5a43c1f6a3adca856d2ca....0.tmp
<SD-Card>/Android/####/f5a019f654fd1e907b3c4d84114958fd8fa52705....0.tmp
<SD-Card>/Android/####/faaf5bdf58e24f6c0f4b66aff53d5dbbfc8be68d....0.tmp
<SD-Card>/Android/####/fad2cc2b7801d2c27a4b2d9a0261f237aec9af5c....0.tmp
<SD-Card>/Android/####/fe2eedea8158ced15f2290591ef05e584aee3a36....0.tmp
<SD-Card>/Android/####/inapp_dev.txt
<SD-Card>/Android/####/journal.tmp
<SD-Card>/LogN/####/sp
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/dc3df659af1392d36d
chmod 777 <Package Folder>/files/daemon
ps
sh

Загружает динамические библиотеки:

IncrementalUpdate
libcrash_1.5.0.0
ppapkpatchso
sgmainso-5.3
uninstall

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
desede-ECB-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-NoPadding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
desede-ECB-PKCS5Padding

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней