Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.463.origin
- Android.DownLoader.603.origin
- Android.Loki.10.origin
- Android.Loki.15.origin
- Android.Mixi.16.origin
- Android.Mixi.21.origin
- Android.Xiny.73.origin
Предлагает установить сторонние приложения.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) j.bay####.com:8888
- TCP(HTTP/1.1) dpl.b####.com:80
- TCP(HTTP/1.1) trac####.suma####.com:80
- TCP(HTTP/1.1) is####.ds.du####.com:80
- TCP(HTTP/1.1) 1####.243.74.32:80
- TCP(HTTP/1.1) www.okyes####.com:8081
- TCP(HTTP/1.1) new.havefun####.com:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) trk.gl####.com:80
- TCP(HTTP/1.1) k####.v####.m.####.me:80
- TCP(HTTP/1.1) e####.w####.in:80
- TCP(HTTP/1.1) akw.e####.space:80
- TCP(HTTP/1.1) log.a####.com:80
- TCP(HTTP/1.1) p####.a####.com:80
- TCP(HTTP/1.1) 45.79.1####.251:80
- TCP(HTTP/1.1) premium####.com:80
- TCP(HTTP/1.1) serv####.m####.com:80
- TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
- TCP(HTTP/1.1) www.technol####.net:80
- TCP(HTTP/1.1) c.cld-se####.com:80
- TCP(HTTP/1.1) a####.hitthe####.mobi:80
- TCP(HTTP/1.1) www.face####.com:80
- TCP(HTTP/1.1) s####.r####.world:80
- TCP(HTTP/1.1) a####.w####.in:80
- TCP(HTTP/1.1) sdk.dofun####.com:80
- TCP(HTTP/1.1) www.mmmmmm####.com:80
- TCP(HTTP/1.1) co####.du####.com:80
- TCP(HTTP/1.1) www.koapk####.com:8081
- TCP(HTTP/1.1) m####.a####.com:80
- TCP(HTTP/1.1) koolmed####.com:80
- TCP(HTTP/1.1) c####.gowa####.com:80
- TCP(HTTP/1.1) www.admobim####.com:80
- TCP(HTTP/1.1) ak.icec####.org:80
- TCP(HTTP/1.1) api.reac####.com:80
- TCP(HTTP/1.1) www.technol####.co.uk:80
- TCP(HTTP/1.1) down####.zhuo####.com:80
- TCP(HTTP/1.1) trac####.spykeme####.com:80
- TCP(HTTP/1.1) news####.tv:80
- TCP(HTTP/1.1) mynewro####.com:80
- TCP(HTTP/1.1) rts.mo####.sdk.####.com:80
- TCP(HTTP/1.1) spykem####.go2c####.org:80
- TCP(HTTP/1.1) l.a####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) gp.miaoxi####.com:80
- TCP(HTTP/1.1) tango####.com:80
- TCP(HTTP/1.1) d####.zhuo####.com:80
- TCP(HTTP/1.1) api.mo####.sdk.####.com:80
- TCP(HTTP/1.1) m####.ads####.com:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) d.billyaf####.com:80
- TCP(HTTP/1.1) 2####.177.13.68:8288
- TCP(HTTP/1.1) www.m####.site:80
- TCP(HTTP/1.1) gpup####.b0.a####.com:80
- TCP(HTTP/1.1) adse####.hitthe####.mobi:80
- TCP(HTTP/1.1) gp.lik####.com:80
- TCP(HTTP/1.1) rd.gl####.com:80
- TCP(HTTP/1.1) a####.bay####.com:80
- TCP(HTTP/1.1) a####.flyer####.com:80
- TCP(HTTP/1.1) nrc.dc.du####.com:80
- TCP(HTTP/1.1) c####.roya####.net:80
- TCP(HTTP/1.1) duapps-####.gsh####.com:80
- TCP(HTTP/1.1) cpgnrot####.com:80
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) c.cldl####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) freecal####.com:443
- TCP(TLS/1.0) app####.hs.l####.net:443
- TCP(TLS/1.0) gl####.app####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) billmsc####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) mobioff####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) sconten####.xx.f####.net:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) a####.app####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) lh3.googleu####.com:443
- TCP(TLS/1.0) d####.sli####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) p4-cbxv####.me####.gst####.com:443
Запросы DNS:
- a####.app####.com
- a####.bay####.com
- a####.flyer####.com
- a####.hitthe####.mobi
- a####.w####.in
- adse####.hitthe####.mobi
- adser####.go####.com
- adser####.go####.nl
- ak.icec####.org
- akw.e####.space
- api.mo####.sdk.####.com
- api.reac####.com
- app####.hs.l####.net
- billmsc####.com
- c####.gowa####.com
- c####.roya####.net
- c.cld-se####.com
- c.cldl####.com
- co####.du####.com
- cpgnrot####.com
- d####.sli####.com
- d####.zhuo####.com
- d.billyaf####.com
- d3656q1####.cloudf####.net
- down####.zhuo####.com
- dpl.b####.com
- e####.w####.in
- f####.google####.com
- f####.gst####.com
- freecal####.com
- g####.face####.com
- g####.t####.net
- gl####.app####.com
- googl####.g.doublec####.net
- gp.lik####.com
- gp.miaoxi####.com
- h####.b####.com
- is####.ds.du####.com
- j.bay####.com
- k####.v####.m.####.me
- koolmed####.com
- l.a####.com
- lh3.googleu####.com
- log.a####.com
- m####.a####.com
- m####.ads####.com
- mobioff####.com
- mt####.go####.com
- mynewro####.com
- new.havefun####.com
- news####.tv
- nrc.dc.du####.com
- offer####.online
- p####.a####.com
- p4-cbxv####.me####.gst####.com
- pag####.googles####.com
- pm.zhuo####.com
- premium####.com
- rd.gl####.com
- rts.mo####.sdk.####.com
- s####.r####.world
- sconten####.xx.f####.net
- sdk.dofun####.com
- serv####.m####.com
- sh.penc####.com
- spykem####.go2c####.org
- st####.xx.f####.net
- tango####.com
- tpc.googles####.com
- trac####.spykeme####.com
- trac####.suma####.com
- trk.gl####.com
- u.dc.du####.com
- www.admobim####.com
- www.face####.com
- www.go####.com
- www.google-####.com
- www.gst####.com
- www.koapk####.com
- www.m####.site
- www.mmmmmm####.com
- www.okyes####.com
- www.technol####.co.uk
- www.technol####.net
Запросы HTTP GET:
- a####.hitthe####.mobi/?utm_medium=####&utm_campaign=####&cid=####
- a####.hitthe####.mobi/?utm_term=####&clickverify=####&utm_content=####
- a####.hitthe####.mobi/proc.php?05e0082####
- a####.hitthe####.mobi/proc.php?3ab245f####
- a####.hitthe####.mobi/proc.php?4530c56####
- a####.hitthe####.mobi/proc.php?5395f60####
- a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
- akw.e####.space/index.php?r=####&appid=####
- akw.e####.space/index.php?r=####&p=####&hp=####&l=####&c=####&prod=####&...
- akw.e####.space/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pr...
- api.reac####.com/api/s2s/goto?id=####&t=####&channel=####&appid=####&cli...
- c####.gowa####.com/click?transaction_id=wadogo_12oclock_58127_10201267de...
- c####.roya####.net/click/?pub=18d76b9b-eff3-4dff-8b49-fa5eabfb0dfb&eid=4...
- c####.roya####.net/go/?pub=18d76b9b-eff3-4dff-8b49-fa5eabfb0dfb&eid=41d9...
- d####.zhuo####.com/Api/getPlayBanner?titleId=####&packId=####&language=#...
- d####.zhuo####.com/Api/getStartFigure?packId=####
- d####.zhuo####.com/Api/playGift?titleId=####&packId=####
- dpl.b####.com/M00/01/AD/CvJJDVnd85eAWlwmABJ7jZjVejM2.3.zip
- e####.w####.in/interface/mothdnew.php?subid=####&pjid=####&uid=####&Imsi...
- e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
- e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
- f####.google####.com/css?family=####&ver=####
- f####.gst####.com/s/lato/v14/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4...
- f####.gst####.com/s/robotoslab/v7/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-Bx...
- gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
- gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- gpup####.b0.a####.com/cr/sdk/dynV17041701D/des_dyV17041701Dj1so32.zip
- gpup####.b0.a####.com/rtf/180562885f3e4c613c5e9844caef22755.slze
- gpup####.b0.a####.com/rtf/408c223fa967dc4d9933c57041b7f49f.slze
- gpup####.b0.a####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
- gpup####.b0.a####.com/rtf/4303e8e0c1feae973da3a9e9f6774365.slze
- gpup####.b0.a####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
- gpup####.b0.a####.com/rtf/6115c9af6b1c30917b41f5c378956f40.slze
- gpup####.b0.a####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
- gpup####.b0.a####.com/rtf/6408c259f823e8db8ced83ef353a06b4.slze
- gpup####.b0.a####.com/rtf/806a6b70c891c315e00b5dfd26af42ed.slze
- log.a####.com/trk.php?sid=####&pkg=####&aid=####&type=####&sv=####&udid=...
- m####.a####.com/redirect/index?type=####&to=aHR0####&data=####&action=####
- m####.ads####.com/c/be4a97a2e0fd6181?tid=####&token1=####&pubid=####
- new.havefun####.com/?utm_medium=####&utm_campaign=####&cid=####&token1=#...
- new.havefun####.com/?utm_term=####&clickverify=####&utm_content=####
- new.havefun####.com/proc.php?00a0454####
- news####.tv/tanal?aff_sub1=####&source=####&source2=####&ecid=####&
- nrc.dc.du####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&vendor=##...
- nrc.dc.du####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=#...
- nrc.dc.du####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendo...
- nrc.dc.du####.com/get?model=####&signmd5=####&op=####&vendor=####&locale...
- p####.a####.com/img/bdar40641.png
- pag####.googles####.com/pagead/gen_204?id=resize&scrl=0&adk=3266694079&a...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20171010/r20170110/reactive_library.js
- pag####.googles####.com/pagead/js/r20171010/r20170110/show_ads_impl.js
- pag####.googles####.com/pagead/js/r20171010/r20170110/show_ads_impl.js?2...
- rd.gl####.com/?r=####&l=####&p=####&c=####
- sdk.dofun####.com/dzzb?sid=####&pkg=####&aid=####&type=####&sv=####&udid...
- serv####.m####.com/119987?t=0.073460633167997&ref=&lu=http://www.technol...
- serv####.m####.com/119987?t=0.0914781866595149&ref=&lu=http://www.techno...
- serv####.m####.com/119987?t=0.17422371148131788&ref=&lu=http://www.techn...
- serv####.m####.com/119987?t=0.6333159771747887&ref=&lu=http://www.techno...
- serv####.m####.com/119987?t=0.7349275567103177&ref=&lu=http://www.techno...
- trac####.spykeme####.com/?aff_id=####&offer_id=####&source=####&aff_sub1...
- www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...
Запросы HTTP POST:
- d####.zhuo####.com/Api/playDetail
- e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
- gp.lik####.com/cr/sv/getEPList
- is####.ds.du####.com/overseaaip/appinfo/isgame?model=####&signmd5=####&o...
- l.a####.com/pv.php
- l.a####.com/sal.php
- rts.mo####.sdk.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sd...
- s####.r####.world/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- www.koapk####.com:8081/sm/sr/rt/ry
- www.m####.site/ad_app_dex_new.php
- www.mmmmmm####.com/osp/oaen_reg.action
- www.okyes####.com:8081/sdk/nsd.action?b=####
- www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/1549516c784b826b82c11891305beb84.0
- /data/data/####/80509ec8a6d677f868a2cf1b238a8d05.0.tmp
- /data/data/####/80509ec8a6d677f868a2cf1b238a8d05.1.tmp
- /data/data/####/ActivatePreUtil.xml
- /data/data/####/AdsBusiness-data.xml
- /data/data/####/DianxinDXB.xml
- /data/data/####/FBAdPrefs.xml
- /data/data/####/LoginPreUtil.xml
- /data/data/####/SDKIDFA.xml
- /data/data/####/_duf_prefs.xml
- /data/data/####/_duscene_module_prefs.xml
- /data/data/####/_mbj_toolbox_prefs.xml
- /data/data/####/_toolbox_prefs.xml
- /data/data/####/_toolbox_prefs.xml.bak
- /data/data/####/app-update-prefs.xml
- /data/data/####/aps.xml
- /data/data/####/apsad.xml
- /data/data/####/apscomm.xml
- /data/data/####/charging_configs_sp.xml
- /data/data/####/classes.zip
- /data/data/####/com.duapps.cleaner_preferences.xml
- /data/data/####/com.duapps.cleaner_shell_dlsdk_reflux_global.xml
- /data/data/####/com.duapps.cleaner_shell_scenerydispatcher_global.xml
- /data/data/####/com.duapps.cleaner_shell_scenerydispatcher_private.xml
- /data/data/####/com.duapps.cleaner_sp_file_scenery_global.xml
- /data/data/####/com.duapps.cleaner_sp_file_scenery_private.xml
- /data/data/####/com.facebook.ads.FEATURE_CONFIG.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/device_info.xml
- /data/data/####/duresultcard_image.db-journal
- /data/data/####/duscene_mobula.db-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/fac_fb_data.db-journal
- /data/data/####/fb1.db
- /data/data/####/fsdk.db-journal
- /data/data/####/google.db
- /data/data/####/hunter_config.xml
- /data/data/####/index
- /data/data/####/journal.tmp
- /data/data/####/ls_sp_date.xml
- /data/data/####/mbj_du_ad_cache.db-journal
- /data/data/####/mbj_du_ad_parse.db-journal
- /data/data/####/mbj_du_ad_ts.db-journal
- /data/data/####/multidex.version.xml
- /data/data/####/my.db
- /data/data/####/my.db-journal
- /data/data/####/notify_items.sp-journal
- /data/data/####/other_config.xml
- /data/data/####/pref_scene.xml
- /data/data/####/prefs_file_default.xml
- /data/data/####/prinstall.db
- /data/data/####/scenery_app_info-journal
- /data/data/####/scenery_games_from_server.db-journal
- /data/data/####/scenery_games_name.db-journal
- /data/data/####/sdk_(unknown)_pref.xml
- /data/data/####/sdk_gmk_sp.xml
- /data/data/####/sdk_gmk_sp.xml.bak (deleted)
- /data/data/####/service_config.xml
- /data/data/####/sp_config.xml
- /data/data/####/sp_file_card_private.xml
- /data/data/####/splash_ogury.xml
- /data/data/####/t_ini.xml
- /data/data/####/toolbox.db-journal
- /data/data/####/toolbox_cache.db-journal
- /data/data/####/toolbox_ts.db-journal
- /data/data/####/utils.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/z
- /data/data/####/z-journal
- <Package Folder>/app_indicators/indicator_d
- <Package Folder>/app_indicators/indicator_p
- <Package Folder>/app_libs/.atmp9.jar
- <Package Folder>/app_libs/.atmp_8.log
- <Package Folder>/app_mdex/abc.zip
- <Package Folder>/app_mdex/classes.dex
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/index
- <Package Folder>/cache/intel-1281785762.txt
- <Package Folder>/databases/DownloandFile_db-journal
- <Package Folder>/databases/arrkii.asa.sdk.db-journal
- <Package Folder>/databases/bdownloaders.db-journal
- <Package Folder>/databases/link.db
- <Package Folder>/databases/link.db-journal
- <Package Folder>/databases/random_sdkdb_data-journal
- <Package Folder>/databases/swith1014.db-journal
- <Package Folder>/databases/tmpd8.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.md
- <Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
- <Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
- <Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
- <Package Folder>/files/####/5youxizhongxing1102<System Property>46
- <Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
- <Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
- <Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
- <Package Folder>/files/####/<Package>12<System Property>2
- <Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
- <Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
- <Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
- <Package Folder>/files/####/gpdu
- <Package Folder>/files/####/ntmp20482157
- <Package Folder>/files/####/test
- <Package Folder>/files/1507802939242_dyV17041701Dj1so32.so
- <Package Folder>/files/1805.jar
- <Package Folder>/files/201708041650.apk
- <Package Folder>/files/408.jar
- <Package Folder>/files/421.jar
- <Package Folder>/files/430.jar
- <Package Folder>/files/610.jar
- <Package Folder>/files/611.jar
- <Package Folder>/files/617.jar
- <Package Folder>/files/640.jar
- <Package Folder>/files/806.jar
- <Package Folder>/files/<System Property>112.jar
- <Package Folder>/files/IlvGNfLeLnXWQUZjdynamicloader.jar
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1507802937557
- <Package Folder>/files/c201708041650.apk
- <Package Folder>/files/ehkdbiDtwbaGbOOydaemon.so
- <Package Folder>/files/hftJcw46N.jar
- <Package Folder>/files/init_c1.pid
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/libiXCCVhYUvWYjNhMlbootstrap.so
- <Package Folder>/files/mingsk
- <Package Folder>/files/pPSqBZtGDOsuTyItstub.jar
- <Package Folder>/files/sail747.so
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- <Package Folder>/files/wokuai.apk
- <Package Folder>/files/xnPqJGuLCADgDtbpsa.jar
- <Package Folder>/shared_prefs/20160121.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/Argolisten.xml
- <Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- <Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/ae.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/baseactivity_share_name.xml
- <Package Folder>/shared_prefs/basefragment_share_name.xml
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
- <Package Folder>/shared_prefs/dayupdate.xml
- <Package Folder>/shared_prefs/duspf6030945.xml
- <Package Folder>/shared_prefs/jihuos.xml
- <Package Folder>/shared_prefs/settingsLog.xml
- <Package Folder>/shared_prefs/userconfig.xml
- <SD-Card>/.androidsystem/####/files.db
- <SD-Card>/.androidsystem/####/gads.db
- <SD-Card>/.androidsystem/####/syncfiles_dap.db
- <SD-Card>/.androidsystem/20fb3e1774a229363f04baa6e5559ca6.jpg
- <SD-Card>/.androidsystem/97ec1aa300a4337e3fcaf1652b87ba3d.jpg
- <SD-Card>/.salvia/<Package>
- <SD-Card>/.userReturn
- <SD-Card>/APPMarket/####/223201800.png.tmp
- <SD-Card>/APPMarket/####/5202522.apk
- <SD-Card>/Android/####/715119f29f736652abd3f673bc8acf54.0
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/HorseBrowser/####/080A76A8AC157B637E27F549707A37CC.png
- <SD-Card>/HorseBrowser/####/08DDFCD9AC157B63445C5E3411AC11EA.jpg
- <SD-Card>/HorseBrowser/####/08DDFCDAAC157B633CD7914081AF495A.jpg
- <SD-Card>/HorseBrowser/####/10360CD1FFFFFFE23EEF9993877424E5.png
- <SD-Card>/HorseBrowser/####/10360CD1FFFFFFE24BACD1851599EB68.png
- <SD-Card>/HorseBrowser/####/10360CD1FFFFFFE2644BA22C4910017C.png
- <SD-Card>/HorseBrowser/####/10360CD2FFFFFFE20E4EAC7F697E4C85.png
- <SD-Card>/HorseBrowser/####/10360CD2FFFFFFE24F1ECD2F4BE1E796.png
- <SD-Card>/HorseBrowser/####/37D1AA67AC157B624B3C07D5765AC15A.png
- <SD-Card>/HorseBrowser/####/64223430AC157B636AB78C4A8C5E0524.png
- <SD-Card>/HorseBrowser/####/64281E4FAC157B635E90A00F61F29893.png
- <SD-Card>/HorseBrowser/####/CA292C74FFFFFFE20B7F21F347FC3A40.jpeg
- <SD-Card>/HorseBrowser/####/CA292C74FFFFFFE2478DDE6AB87569BC.jpeg
- <SD-Card>/HorseBrowser/####/CA292C74FFFFFFE24BADFC0E453793AD.png
- <SD-Card>/HorseBrowser/####/CA292C75FFFFFFE216F7E3BA539C33E5.jpeg
- <SD-Card>/HorseBrowser/####/CA292C75FFFFFFE2330525D994617330.jpeg
- <SD-Card>/HorseBrowser/####/CA292C75FFFFFFE26C87D41DE97A0573.jpeg
- <SD-Card>/LogN/####/sp
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
- <SD-Card>/baidu/####/journal.tmp
- <SD-Card>/baidu/.cuid
- <SD-Card>/dianxin/####/ad18b8460fb2b0ccbbba29b7ee15b6f8.0
- <SD-Card>/dianxin/####/journal
- <SD-Card>/dianxin/####/journal.tmp
- <SD-Card>/test1507802940088
Другие:
Запускает следующие shell-скрипты:
- .kugua
- .kugua -c id
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/block/mmcblk0/device/cid
- /system/bin/cat /sys/block/mmcblk1/device/cid
- /system/bin/cat /sys/block/mmcblk2/device/cid
- /system/bin/cat /sys/block/mmcblk3/device/cid
- <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
- app_process /system/bin com.android.commands.pm.Pm path com.duapps.cleaner
- c201708041650.apk -p <Package> -c <Package>:baidu
- chmod 0771 <Package Folder>/.syslib-
- chmod 6777 <Package Folder>/files/c201708041650.apk
- chmod 770 <Package Folder>/files/.play/test
- getenforce
- logcat -d -v time
- ps
- rm -f <Package Folder>/files/hftJcw46N.dex
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
Загружает динамические библиотеки:
- 1507802939242_dyV17041701Dj1so32
- com_zhuoyian_youxizhongxing110
- ehkdbiDtwbaGbOOydaemon
- intel-1281785762
- libiXCCVhYUvWYjNhMlbootstrap
- libjni-comymrefpackagesjrrbaidu
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
