Android.Packed.30278

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.226.origin
Android.Triada.248.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) l.ace####.com:80
TCP(HTTP/1.1) 1####.76.78.224:5088
TCP(HTTP/1.1) img.ace####.com:80
TCP(HTTP/1.1) st####.t####.b####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) mf####.gam####.cn.####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) cm.pos.b####.com:80
TCP(HTTP/1.1) m.gam####.cn:80
TCP(HTTP/1.1) m####.gam####.cn.####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) n.m.gam####.cn:80
TCP(HTTP/1.1) cm.g.doublec####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) si####.jom####.com:80
TCP(HTTP/1.1) a####.b####.com:80
TCP(HTTP/1.1) wn.pos.b####.com:80
TCP(HTTP/1.1) vsc####.b####.com:80
TCP(HTTP/1.1) fex.bdst####.com:80
TCP(HTTP/1.1) m####.m.gam####.cn:80
TCP(HTTP/1.1) s.c####.b####.com:80
TCP(HTTP/1.1) f####.gam####.cn.####.com:80
TCP(HTTP/1.1) m.b####.com:80
TCP(HTTP/1.1) bo####.bpc.b####.com:80
TCP(HTTP/1.1) api.sdk.lie####.cn:80
TCP(HTTP/1.1) i####.b####.com:80
TCP(HTTP/1.1) c####.jd.com:80
TCP(HTTP/1.1) gs.a.s####.com:80
TCP(TLS/1.0) d####.iap####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) i####.iap####.com:443
TCP(TLS/1.0) pos.b####.com:443

Запросы DNS:

a####.b####.com
a####.u####.com
api.sdk.lie####.cn
bo####.bpc.b####.com
c####.baidust####.com
c####.baidust####.com
c####.jd.com
chan####.itc.cn
chan####.s####.com
cm.g.doublec####.net
cm.pos.b####.com
d####.iap####.com
f####.gam####.cn
f10.b####.com
f11.b####.com
f12.b####.com
fex.bdst####.com
hm.b####.com
i####.b####.com
i####.gam####.cn
i####.iap####.com
img.ace####.com
l.ace####.com
m####.gam####.cn
m####.m.gam####.cn
m.b####.com
m.gam####.cn
mf####.gam####.cn
n.m.gam####.cn
pos.b####.com
r####.wx.qq.com
re####.sz.z####.com
s####.zhid####.b####.com
s.c####.b####.com
st####.citicfo####.com
st####.t####.b####.com
vsc####.b####.com
wn.pos.b####.com

Запросы HTTP GET:

a####.b####.com/cloudaapi/lightapp.js
a####.b####.com/cloudaapi/pkg/app-socialshare_b5c9f0e.js
a####.b####.com/cloudaapi/pkg/helper-utils-moplus-monitor_cccb3ce.js
a####.b####.com/cloudaapi/pkg/push-smartBar_f0a0b3a.js
api.sdk.lie####.cn/api/channel/getConfig.jhtm?channelName=####
api.sdk.lie####.cn/app/api/appDownload.jhtm?packageName=####&isNew=####&...
api.sdk.lie####.cn/app/api/clkListen.jhtm?sn=####&channelName=####&packa...
api.sdk.lie####.cn/app/api/getBlackList.jhtm?channelName=####
api.sdk.lie####.cn/app/api/getSo.jhtm?packageName=####
api.sdk.lie####.cn/app/api/isAccessEnable.jhtm
api.sdk.lie####.cn/ssp/api/getCfg.jhtm
bo####.bpc.b####.com/v1/vs-resource/gm-2bde278f84be248f192613915b18c64c1...
bo####.bpc.b####.com/v1/vs-resource/gm-2dd2f41ee5380ded2bb45b5db998e63f1...
bo####.bpc.b####.com/v1/vs-resource/gm-5502eaeb1bbc2886ffe9d9af884bc8821...
bo####.bpc.b####.com/v1/vs-resource/gm-99f7d5bd5261ed00fff2fbc00bc26bd91...
bo####.bpc.b####.com/v1/vs-resource/gm-c422dede955e156b93f8d8945e7a8c3c1...
bo####.bpc.b####.com/v1/vs-resource/gm-f509392e1e981ae9a7ebb16440fe01391...
c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
c####.baidust####.com/sync.htm?cproid=####
c####.jd.com/du?&baidu_user_id=####&cookie_version=####&timestamp=####&e...
cm.g.doublec####.net/pixel?google_nid=####&googl####
cm.g.doublec####.net/pixel?google_nid=####&google_cm=####&google_tc=####
cm.pos.b####.com/gpixel?google_gid=####&google_cver=####
cm.pos.b####.com/pixel?dspid=####
fex.bdst####.com/hunter/alog/alog.mobile.min.js?v=####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=#...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&ep=12715,6793&et=3&ja...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&ep={"netAll":0,"netDn...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&et=0&ja=0&ln=en-us&lo...
hm.b####.com/hm.js?15b67ce####
hm.b####.com/hm.js?2fe3f3f####
i####.b####.com/fe-static/game-h5/media//asset/b9878d921eb8f905ce3cdd934...
i####.b####.com/fe-static/game-h5/media//asset/bf2e30b7f829f93c761b9b1db...
i####.b####.com/fe-static/game-h5/media//asset/entry-css.css
i####.b####.com/fe-static/game-h5/media//asset/entry-js.js
i####.b####.com/fe-static/game-h5/media//asset/iframe-css.css
i####.b####.com/fe-static/game-h5/media//asset/iframe-js.js
i####.b####.com/fe-static/game-h5/media//dep/zepto.min.js
i####.b####.com/game/detail?name=####&module=####&id=####
i####.b####.com/game/mediaAjax?name=####&module=####
i####.b####.com/game?name=####
l.ace####.com/ando/v2/mn?k=####&d=####&m=####
m####.m.gam####.cn/
m####.m.gam####.cn/Public/js/TabChange.js?v201709####
m####.m.gam####.cn/Public/js/jquery.min.js?v201709####
m####.m.gam####.cn/Public/zq/img/zy_tb.png
m.gam####.cn/
m.gam####.cn/Public/News/js/arclist.js?v201709####
m.gam####.cn/Public/js/jquery.min.js?v201709####
m.gam####.cn/gonglue/20170922/2222826.html?soucre=####
m.gam####.cn/index.php?m=####&a=####&callback=####&_=####
m.gam####.cn/news/20170921/2221756.html
n.m.gam####.cn/index/h5DbApps/?callback=####&_=####
n.m.gam####.cn/index/likeDbApps/?callback=####&_=####
n.m.gam####.cn/index/shouyouDbApps/?callback=####&_=####
pos.b####.com/dcbm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&d...
pos.b####.com/dcbm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&d...
pos.b####.com/mcbm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&d...
pos.b####.com/mcbm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&d...
pos.b####.com/sync_pos.htm?cproid=####
pos.b####.com/sync_pos.htm?cproid=####&t=####
pos.b####.com/uctm?di=u2934362&dri=0&dis=3&dai=1&ps=2504x0&dcb=___adbloc...
pos.b####.com/uctm?sz=741x186&rdid=2934362&dc=3&di=u2934362&dri=0&dis=3&...
s.c####.b####.com/s.htm?cproid=####&t=####
si####.jom####.com/it/u=1000119497,330111227&fm=76
si####.jom####.com/it/u=113552073,1667293551&fm=76
si####.jom####.com/it/u=131579167,3900474700&fm=76
si####.jom####.com/it/u=1337334481,1827956017&fm=76
si####.jom####.com/it/u=1571750266,2317925312&fm=76
si####.jom####.com/it/u=1820434126,2454532093&fm=76
si####.jom####.com/it/u=1846077568,2854852296&fm=76
si####.jom####.com/it/u=1872973802,2717782524&fm=76
si####.jom####.com/it/u=191352673,1677448400&fm=76
si####.jom####.com/it/u=234109129,2886458562&fm=76
si####.jom####.com/it/u=2425184601,3116256675&fm=76
si####.jom####.com/it/u=285854265,1728290505&fm=76
si####.jom####.com/it/u=314777486,2166959623&fm=76
si####.jom####.com/it/u=33409842,1748504091&fm=76
si####.jom####.com/it/u=3557235116,3688405568&fm=76
si####.jom####.com/it/u=371246763,2030543604&fm=76
si####.jom####.com/it/u=4197887048,130929174&fm=76
si####.jom####.com/it/u=4217172743,30203584&fm=76
si####.jom####.com/it/u=4219539790,1337940242&fm=76
si####.jom####.com/it/u=4254849092,1410780174&fm=76
si####.jom####.com/it/u=450127018,2225145240&fm=76
si####.jom####.com/it/u=697893363,859984925&fm=76
si####.jom####.com/it/u=697939373,3999609038&fm=76
si####.jom####.com/it/u=781151917,2129678143&fm=76
si####.jom####.com/it/u=93662222,3870228995&fm=76
si####.jom####.com/it/u=95805939,1605351005&fm=76
st####.t####.b####.com/tb/error.html?tc=####
vsc####.b####.com/w.gif?url=http://iwan.baidu.com/game/detail?name=####&...
vsc####.b####.com/w.gif?url=http://iwan.baidu.com/game?name=####&pid=###...
wn.pos.b####.com/adx.php?c=####

Запросы HTTP POST:

api.sdk.lie####.cn/ad/api/getAds.jhtm
api.sdk.lie####.cn/ad/api/innerListen.jhtm
api.sdk.lie####.cn/source/api/getSourceRules.jhtm
l.ace####.com/ando/v1/x/ap?app_id=####&r=####
l.ace####.com/ando/v1/x/lv?app_id=####&r=####
l.ace####.com/ando/v1/x/qa?app_id=####&r=####

Изменения в файловой системе:

Создает следующие файлы:

/system/app/Sysapp.apk
/system/lib/lib64jpush220.so
/system/lib/lib64locSDK6a.so
/system/lib/libjpush220.so
/system/lib/liblocSDK6a.so
<Package Folder>/cache/####/-1108696384531427946
<Package Folder>/cache/####/-1645201492-1655802136
<Package Folder>/cache/####/-4136069691193187307
<Package Folder>/cache/####/-490665427695701585
<Package Folder>/cache/####/-535475693-349558920
<Package Folder>/cache/####/-7252669021706626256
<Package Folder>/cache/####/485438327537057920
<Package Folder>/cache/####/485438327954843277
<Package Folder>/cache/####/727725171-1341928210
<Package Folder>/cache/####/9118510122130547032
<Package Folder>/cache/####/916930889-142436614
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/f_00003a
<Package Folder>/cache/####/f_00003b
<Package Folder>/cache/####/f_00003c
<Package Folder>/cache/####/f_00003d
<Package Folder>/cache/####/f_00003e
<Package Folder>/cache/####/f_00003f
<Package Folder>/cache/####/f_000040
<Package Folder>/cache/####/f_000041
<Package Folder>/cache/####/f_000042
<Package Folder>/cache/####/f_000043
<Package Folder>/cache/####/f_000044
<Package Folder>/cache/####/f_000045
<Package Folder>/cache/####/index
<Package Folder>/code-6494289/####/iQ3IsN027fob7qTl.jar
<Package Folder>/code-6494289/tSKU2Z4bup8qAYwi
<Package Folder>/databases/adshower.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_5Uq...39IQ==
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_5Uq...ournal
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_9jj...ournal
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_ArV...ournal
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_ArV...zTjgk=
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_qMu...ournal
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_qMu...q9sw==
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_str...K426wP
<Package Folder>/databases/gW4hbxk1oNmNzdJmv2kFNDB68H5yMCMG_str...ournal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/databases/xUtils_http_cookie.db
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/databases/xUtils_http_cookie.db-journal (deleted)
<Package Folder>/files/####/27579633-be17-4c3a-899f-9a58f130a904.pic.temp
<Package Folder>/files/####/334639af-dec1-47e5-bc8e-46affa1d1428.pic
<Package Folder>/files/####/37980a77-e43f-4cff-9c18-dcc550798d40.pic.temp
<Package Folder>/files/####/4F5glRxBJoCiLR8Z-bQX5zx29zozQYDeL0G...E=.new
<Package Folder>/files/####/5BEv_YePwd9B48xe_RhLdw==
<Package Folder>/files/####/7wafSwvuCkEaNRSuI86jtsBu8VE=
<Package Folder>/files/####/80b72353-de78-42d6-b1e8-fabbd263cf66.pic
<Package Folder>/files/####/8eipAIc-qjvexRubAvqmc9LTSTI=.new
<Package Folder>/files/####/953e0db5-bd51-4e05-ac58-f4f2b5f9fa5d.pic.temp
<Package Folder>/files/####/BHaSiJhr2woNKXTegnRBzRUl8UnPWoOv.new
<Package Folder>/files/####/CfKx5rgCBVVrACb0IPt_mw==
<Package Folder>/files/####/CfKx5rgCBVVrACb0IPt_mw==.new
<Package Folder>/files/####/EgPemkJR4iwC8zOTBQKfN94_JlA=
<Package Folder>/files/####/ExkeuqFbWhxBD3IFrJOd6rX0YuA4AsTy40B...k=.new
<Package Folder>/files/####/HkcKAOicoZ-xEwDx3fBDPw==
<Package Folder>/files/####/HkcKAOicoZ-xEwDx3fBDPw==.new
<Package Folder>/files/####/IiTP9Aomu4Hzpos568qxPg==
<Package Folder>/files/####/IiTP9Aomu4Hzpos568qxPg==.new
<Package Folder>/files/####/IqmBj1nEuHkCWMTG7pN7E5iScRA=.temp
<Package Folder>/files/####/Lk3JOPcL6JQtK4c369e6UIN8QFhznId8.new
<Package Folder>/files/####/MnbqfxYxmuX5G3C6jUdTbK3GlNShQVQdeky...8=.new
<Package Folder>/files/####/PSmWxylHduzQoqeUHvGzqceOSMpfZktDe-_16A==.new
<Package Folder>/files/####/R8idXatFeZc_rRXEFPucwhXinqUEmlHJCRC...k=.new
<Package Folder>/files/####/RUbSxiYDNy1FQlwlvQ_QurvUdXKNgWU8AuT8gw==.new
<Package Folder>/files/####/SHXUnr3XrNiqWeLEoe4-kKRxlm_K2ems.new
<Package Folder>/files/####/SKypkCxhF2uI_xV2XBgTQZTNVJ8=.new
<Package Folder>/files/####/SqD_nEhY2wTbGCXDk_QzYnimVpapPIo8.new
<Package Folder>/files/####/TDwU-7EVi0ZFuyZP.zip
<Package Folder>/files/####/YFcfA8O17eHLTXVK9YNWM3enfmvXvQH0.new
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/f0AuO7dF19KgZHIFCb1MzWseThAn1DVErmCvgA==.new
<Package Folder>/files/####/f4VBWp603baZz10R7ZE3VofUk5GlZ-Hu
<Package Folder>/files/####/f4VBWp603baZz10R7ZE3VofUk5GlZ-Hu.new
<Package Folder>/files/####/f4VBWp603baZz10R7ZE3VofUk5GlZ-Hu.old (deleted)
<Package Folder>/files/####/j0c3E9rZkUn6DZYE-RT4z9h-cnvpUFUw.new
<Package Folder>/files/####/nGK5HGtuPlzGkuUikLXGh0rXY-pS4jfq.new
<Package Folder>/files/####/omIB4S_oSbFvWCb5bgwqYAS0fOw=.new
<Package Folder>/files/####/q0KWPKUep93ll4tqtRvpcify6BQ=.new
<Package Folder>/files/####/qGL6PZsg1lh3i9nv
<Package Folder>/files/####/runner_info.prop.new
<Package Folder>/files/####/sue0ylp2Py0F2FQIUYv1lA==
<Package Folder>/files/####/tkqkxq_f.zip
<Package Folder>/files/####/yDXqVTUBj-aRoP7ubHauVhLgCDU=.temp
<Package Folder>/files/####/ycb4Dn3G-ddpPUfV.new
<Package Folder>/files/.imprint
<Package Folder>/files/exid.dat
<Package Folder>/files/rdata_comvmnfwqea.new
<Package Folder>/files/statistics
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_clip.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/PreferanceUtil.xml
<Package Folder>/shared_prefs/PreferanceUtil.xml.bak
<Package Folder>/shared_prefs/iapppay_config.xml
<Package Folder>/shared_prefs/statistics_preference.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.armsd/####/05dffc00-5cc9-4de7-a630-d8e2e305608b.res
<SD-Card>/.armsd/####/569e1296-4c7c-40ad-9a64-10f1aa373cff.res
<SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
<SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
<SD-Card>/.armsd/####/a5bb2902-c63a-44b4-b15c-ef91596aa93e.res
<SD-Card>/.armsd/####/d2a980fb-1676-4dfc-96fe-31b8f9a6003d.res
<SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
<SD-Card>/.env/.uunique.new
<SD-Card>/.iapppay/.terminal
<SD-Card>/Sysapp/Sysapp.apk
<SD-Card>/SystemChannel/systemLyChannel
<SD-Card>/iapppay/####/statistics.log (deleted)
<SD-Card>/lib64jpush220.so
<SD-Card>/lib64locSDK6a.so
<SD-Card>/libjpush220.so
<SD-Card>/liblocSDK6a.so

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/code-6494289/tSKU2Z4bup8qAYwi -p <Package> -c com.vmnf.wqea.vvevxa.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
app_process /system/bin com.android.commands.pm.Pm install -r /system/app/Sysapp.apk
chmod 644 /system/app/Sysapp.apk
chmod 644 /system/lib/lib64jpush220.so
chmod 644 /system/lib/lib64locSDK6a.so
chmod 644 /system/lib/libjpush220.so
chmod 644 /system/lib/liblocSDK6a.so
chown root:root /system/app/Sysapp.apk
dumpsys activity activities
grep mResumedActivity
mount -o remount /system
sh
sh <Package Folder>/code-6494289/tSKU2Z4bup8qAYwi -p <Package> -c com.vmnf.wqea.vvevxa.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
su

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Использует повышенные привилегии.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней