Android.Packed.32777

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.463.origin
Android.DownLoader.603.origin
Android.Mixi.16.origin
Android.Mixi.21.origin
Android.Xiny.73.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) rt.hm####.com:80
TCP(HTTP/1.1) a####.zhuo####.com:80
TCP(HTTP/1.1) m####.ads####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
TCP(HTTP/1.1) w####.io:80
TCP(HTTP/1.1) prizes-####.com:80
TCP(HTTP/1.1) r.lead####.com:80
TCP(HTTP/1.1) down####.zhuo####.com:80
TCP(HTTP/1.1) c.cld-se####.com:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) newrota####.com:80
TCP(HTTP/1.1) e####.w####.in:80
TCP(HTTP/1.1) 1####.243.74.32:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) 45.79.2####.163:80
TCP(HTTP/1.1) offer####.online:80
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) www.girlsvi####.info:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) prize####.cdn8-da####.top:80
TCP(HTTP/1.1) tra####.tc-cl####.com:80
TCP(HTTP/1.1) a####.w####.in:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) ins####.insc####.net:80
TCP(HTTP/1.1) 4####.33.37.240:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) m####.a####.com:80
TCP(HTTP/1.1) i####.ki####.com:80
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) c####.lab####.com:80
TCP(HTTP/1.1) hy####.com:80
TCP(HTTP/1.1) p####.a####.com:80
TCP(HTTP/1.1) ns1.newspo####.hk:80
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) normale####.com:443
TCP(TLS/1.0) ins-####.insc####.net:443
TCP(TLS/1.0) c.cldl####.com:443
TCP(TLS/1.0) 2####.58.212.174:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) 5####.edg####.net:443

Запросы DNS:

a####.w####.in
a####.zhuo####.com
api.bi####.com
api.ki####.com
api.zhuo####.com
c####.lab####.com
c.cld-se####.com
c.cldl####.com
d3656q1####.cloudf####.net
down####.zhuo####.com
e####.w####.in
f####.google####.com
f####.gst####.com
gp.lik####.com
gp.miaoxi####.com
h####.b####.com
hy####.com
i####.ki####.com
ilv####.com
img.washing####.com
l.a####.com
m####.a####.com
m####.ads####.com
newrota####.com
normale####.com
ns1.newspo####.hk
offer####.online
p####.a####.com
pm.zhuo####.com
prize####.cdn8-da####.top
prizes-####.com
r.lead####.com
rt.hm####.com
s1.ibt####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sh.penc####.com
tra####.tc-cl####.com
w####.io
www.girlsvi####.info
www.koapk####.com
www.okyes####.com
www.washing####.com

Запросы HTTP GET:

a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
a####.zhuo####.com/Api/UnifiedAccess?PBindKey=####&data=ey####
a####.zhuo####.com/Api/getVideoBoxApp
a####.zhuo####.com/upload/700900CBFFFFFFE242F4EDA9C90A4E51.png
a####.zhuo####.com/upload/8FD96CC4FFFFFFE241C6CB150EFDA56F.png
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
e####.w####.in/interface/mothdnew.php?subid=####&pjid=####&uid=####&Imsi...
e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
gpup####.b0.a####.com/cr/sdk/dynV17041701D/des_dyV17041701Dj1so32.zip
hy####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKhos-Ud...
ins####.insc####.net/sites/www.ibtimes.com/files/styles/embed/public/201...
ins####.insc####.net/sites/www.ibtimes.com/files/styles/md/public/2017/1...
m####.a####.com/redirect/index?type=####&to=aHR0####&data=####&action=####
ns1.newspo####.hk/v1/articles?channel=####&country=####&language=####&li...
p####.a####.com/img/bdar40641.png
prize####.cdn8-da####.top/default.aspx?u=####&o=####&t=####&cid=####&f=#...
prize####.cdn8-da####.top/media/mainstream/backbutton_mainstream.js
prize####.cdn8-da####.top/media/mainstream/jquery.js
prize####.cdn8-da####.top/media/mainstream/js.cookie6_pure.js
prize####.cdn8-da####.top/media/mainstream/js1.js
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/1666.png
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/<System Propert...
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/alert.ogg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/comment-c.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/comment-k.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/comment1.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/comment7.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/fb-check.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/female.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/galiphone.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/icon-left.png
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/icon-right.png
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/ip6sunbox.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/loading.gif
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/logo.png
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/oldlady.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/oldman.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/ps4.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/ps4man.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/s6unbox.jpg
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/smiley.png
prize####.cdn8-da####.top/media/mainstream/nl/wap/google/sub2.png
prize####.cdn8-da####.top/util/utils-ms.js
prizes-####.com/?u=####&o=####&t=####&cid=####

Запросы HTTP POST:

api.bi####.com/un
e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
gp.lik####.com/cr/sv/getEPList
i####.ki####.com/express
i####.ki####.com/jar
i####.ki####.com/u
l.a####.com/pv.php
l.a####.com/sal.php
www.koapk####.com:8081/sm/sr/rt/ry
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/app_process_lock/2325821242035.55
<Package Folder>/app_process_lock/2325821242145.56
<Package Folder>/app_process_lock/2325821243014.46
<Package Folder>/app_process_lock/2325821243055.1
<Package Folder>/app_process_lock/2325821243145.9
<Package Folder>/app_process_lock/2325821243529.6
<Package Folder>/app_process_lock/2325821243582.85
<Package Folder>/app_process_lock/2325821244542.77
<Package Folder>/app_process_lock/2325821244675.94
<Package Folder>/app_process_lock/25580922.4715926
<Package Folder>/app_process_lock/25580922.4715926 (deleted)
<Package Folder>/app_process_lock/32607487.2970169
<Package Folder>/app_process_lock/32607487.2970169 (deleted)
<Package Folder>/app_process_lock/32611891.0993504
<Package Folder>/app_process_lock/32611891.0993504 (deleted)
<Package Folder>/app_process_lock/32613041.4648414
<Package Folder>/app_process_lock/32613041.4648414 (deleted)
<Package Folder>/app_process_lock/32614975.7505372
<Package Folder>/app_process_lock/32614975.7505372 (deleted)
<Package Folder>/app_process_lock/32618034.8889646
<Package Folder>/app_process_lock/32618034.8889646 (deleted)
<Package Folder>/app_process_lock/32618479.2240786
<Package Folder>/app_process_lock/32618479.2240786 (deleted)
<Package Folder>/app_process_lock/32618489.5308945
<Package Folder>/app_process_lock/32618489.5308945 (deleted)
<Package Folder>/app_process_lock/32618748.3291408
<Package Folder>/app_process_lock/32620076.2899342
<Package Folder>/app_process_lock/32621901.2073141
<Package Folder>/app_process_lock/7836592361473.64
<Package Folder>/app_process_lock/7836592361844.32
<Package Folder>/app_process_lock/7836592364771.98
<Package Folder>/app_process_lock/7836592364908.91
<Package Folder>/app_process_lock/7836592365214.85
<Package Folder>/app_process_lock/7836592366507.69
<Package Folder>/app_process_lock/7836592366687.1
<Package Folder>/app_process_lock/7836592369921.47
<Package Folder>/app_process_lock/7836592370370.17
<Package Folder>/app_process_lock/7836592370370.17 (deleted)
<Package Folder>/app_process_lock/880107239918.541
<Package Folder>/app_process_lock/880107239960.17
<Package Folder>/app_process_lock/880107240288.969
<Package Folder>/app_process_lock/880107240304.347
<Package Folder>/app_process_lock/880107240338.706
<Package Folder>/app_process_lock/880107240483.902
<Package Folder>/app_process_lock/880107240504.05
<Package Folder>/app_process_lock/880107240867.293
<Package Folder>/app_process_lock/880107240917.686
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/index
<Package Folder>/cache/intel-1494373021.txt
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/mobikokdload.db
<Package Folder>/databases/mobikokdload.db-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/xUtils_http_cache.db-journal
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/0A23180E5300843BC9938096D586AACF
<Package Folder>/files/####/304A55A114B1BB5080A05D808B97C728
<Package Folder>/files/####/5horsebrowser1012<System Property>46
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/B6BFDE86BB5639D567FA8ED996FFE5AF
<Package Folder>/files/####/BE9C866C5AD2146E3CCE3DBE46AE6A0F
<Package Folder>/files/####/C013E6B8D463D57A9E5C0493B0D1A232
<Package Folder>/files/####/C18AFF9E39574FE2E0A3220A8CD5BC12
<Package Folder>/files/####/C42BD8C1561605E66DAB63893EE6964C
<Package Folder>/files/####/C9B62EBE2B318036B3B8C0F70F5A3744
<Package Folder>/files/####/E04D09FBB9D7D7208CF16653768CC163
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/ntmp20512178
<Package Folder>/files/####/plug_2.jar
<Package Folder>/files/####/plug_3.jar
<Package Folder>/files/####/test
<Package Folder>/files/1508761166999_dyV17041701Dj1so32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1508761161719
<Package Folder>/files/bb.jar
<Package Folder>/files/bb.jar (deleted)
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/libcuid.so
<Package Folder>/files/mingsk
<Package Folder>/files/mobikokJarDecMd5File
<Package Folder>/files/mobikokJarEntityFile
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/sail747.so
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/files/wokuai.apk
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160121.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/Argolisten.xml
<Package Folder>/shared_prefs/HETEENHAPPYFAMILYDATA.xml
<Package Folder>/shared_prefs/MashupGroupSaleFile_Type_4.xml
<Package Folder>/shared_prefs/MobikokCache_Type_4.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml.bak
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/duspf6030945.xml
<Package Folder>/shared_prefs/jihuos.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/userconfig.xml
<SD-Card>/APPMarket/####/122190031.png.tmp
<SD-Card>/Android/####/03e1665592339a396807b2abc1771073
<SD-Card>/Android/####/03e1665592339a396807b2abc1771073.tmp
<SD-Card>/Android/####/10e655d0727bb7eaed38330ea67923e0.0
<SD-Card>/Android/####/1b96d620dbc85c5e934652a07039e3a9.0
<SD-Card>/Android/####/1fd4c21b7ca9a59a37d17e29a8a1611e.0
<SD-Card>/Android/####/286607a7ec722362d50233ea993fbc09.0
<SD-Card>/Android/####/2c5534bfe83c32bf2c8acb3fd7bfec8b.0
<SD-Card>/Android/####/34c84ac1f951b6bade65539bdc084b46.0
<SD-Card>/Android/####/36d1eb61dd50bc1f79d5abfc18d1760d.0
<SD-Card>/Android/####/3aa0b6009b6b49739eba0f4ad2b7ae84.0
<SD-Card>/Android/####/3cb5250ea30f410c3eef93a7be8b4c74.0
<SD-Card>/Android/####/4028dd3959e7e22711b2e15c9c23c101.0
<SD-Card>/Android/####/46be2c86dcba14bb3347b74ce69abe1a.0
<SD-Card>/Android/####/4850bab3bdae0ae72441120d1ea059da
<SD-Card>/Android/####/4850bab3bdae0ae72441120d1ea059da.tmp
<SD-Card>/Android/####/4c62c3a13f5828321bfd22027cd9121f.0
<SD-Card>/Android/####/53023f649fc84f11279fa0bb5c0364f1.0
<SD-Card>/Android/####/5e8f4a0dee9f1704ab71e91d4eeab9db.0
<SD-Card>/Android/####/605943c8b291a3ce6b1d0ab0be5f03a4.0
<SD-Card>/Android/####/64007a1f7c7e0eaef15b313ecfceefda.0
<SD-Card>/Android/####/724d6a9941d9b995495afa79be76a312.0
<SD-Card>/Android/####/7504479c6d9b7d60174eefc969733497.0
<SD-Card>/Android/####/77b75bf21b25b385b1bf58612c27e62c
<SD-Card>/Android/####/77b75bf21b25b385b1bf58612c27e62c.tmp
<SD-Card>/Android/####/7c334bfdc5621de59bf73cb8b7623222
<SD-Card>/Android/####/7c334bfdc5621de59bf73cb8b7623222.tmp
<SD-Card>/Android/####/8245327944b43f09bf765128043bcc50.0
<SD-Card>/Android/####/8f6eb841ea8761755decb15767965ee5.0
<SD-Card>/Android/####/912560a4a3b2617d6a96759b29e00caf
<SD-Card>/Android/####/912560a4a3b2617d6a96759b29e00caf.tmp
<SD-Card>/Android/####/97eedf5eae4a07b46bc6ae3158300c5d.0
<SD-Card>/Android/####/a18ae005d0b5be2dcd1dce81b6441393.0
<SD-Card>/Android/####/aa098d9876dc14b1e109b2285cb5b447.0
<SD-Card>/Android/####/ae265d5444dd41e0ce3ef5c66cd8ce00.0
<SD-Card>/Android/####/b443a0821651210b7b7c7bff5073553d
<SD-Card>/Android/####/b443a0821651210b7b7c7bff5073553d.tmp
<SD-Card>/Android/####/baf775ac8c74b11ce888fa184a04508e.0
<SD-Card>/Android/####/be9c0e019328e4f851664940ae56eef7.0
<SD-Card>/Android/####/bf3adf8a3a718942d847d145fe9b11fa.0
<SD-Card>/Android/####/caae62b7a71d720bbcb52bb0cb8adbf9.0
<SD-Card>/Android/####/cef53d6105e9770770ae8823b2d72f8f.0
<SD-Card>/Android/####/d11d036e4824cb313d8b542a2e1ade4f.0
<SD-Card>/Android/####/d7e9f812401d293491501e8cec78ecab.0
<SD-Card>/Android/####/db2f6f909318ace22987ed38ee8625fb.0
<SD-Card>/Android/####/e0fd27b07ad4d2ce615fbcb7572ff00e
<SD-Card>/Android/####/e0fd27b07ad4d2ce615fbcb7572ff00e.tmp
<SD-Card>/Android/####/e41faeb2ed4b22f54d558da2a1c95bd6
<SD-Card>/Android/####/e41faeb2ed4b22f54d558da2a1c95bd6.tmp
<SD-Card>/Android/####/e70c150df470279537f9f47fd9b9b4f9
<SD-Card>/Android/####/e70c150df470279537f9f47fd9b9b4f9.tmp
<SD-Card>/Android/####/e9679585cdab52dc82a33fd16b6d4d6b.0
<SD-Card>/Android/####/f922b4e91d8b8e49af183e28656dd201.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/DownloadCache/mobikokCacheFileInfos
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/system/0fdbb777227ccda48631fd0b7eea87ff3.apk
<SD-Card>/system/0fdbb777227ccda48631fd0b7eea87ff3.apk.tmp
<SD-Card>/system/1cd1aed7a715f320d76eaeaa02077a244.apk.tmp
<SD-Card>/system/2b633efddcc5367dac2cca4aa6f53a28.apk
<SD-Card>/system/2b633efddcc5367dac2cca4aa6f53a28.apk.tmp
<SD-Card>/system/44200136bd0e3b49501cbb51ec3d5cc51.apk.tmp
<SD-Card>/system/6fdff93153395cd0412c9ca90396b82e8.apk.tmp
<SD-Card>/system/724be9461f0780fcce00c5be5d3622cd0.apk.tmp
<SD-Card>/system/9a4a516714480783edf7a0a658541bec2.apk
<SD-Card>/system/9a4a516714480783edf7a0a658541bec2.apk.tmp
<SD-Card>/system/a73e247b05f5102943f69dd9346312dc7.apk.tmp
<SD-Card>/system/e41faeb2ed4b22f54d558da2a1c95bd66.apk.tmp
<SD-Card>/system/e7af3815447d0b98badf2ad50eed47db5.apk.tmp
<SD-Card>/system1/babeef0fde758db9a6576aea74c6699a.apk
<SD-Card>/system1/babeef0fde758db9a6576aea74c6699a.apk.tmp
<SD-Card>/test1508761166282

Другие:

Запускает следующие shell-скрипты:

.kugua
.kugua -c id
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
app_process /system/bin com.android.commands.pm.Pm path com.dianxinos.dxbs
c201708041650.apk -p <Package> -c <Package>:baidu
chmod 0771 <Package Folder>/.syslib-
chmod 6777 <Package Folder>/files/c201708041650.apk
chmod 770 <Package Folder>/files/.play/test
getenforce
logcat -d -v time
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-

Загружает динамические библиотеки:

1508761166999_dyV17041701Dj1so32
com_zhuoyian_horsebrowser101
getuiext2
intel-1494373021
libjni-comymrefpackagesjrrbaidu
webpbackport

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней