Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Egame.1.origin
- Adware.Egame.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) h5.p####.cn:80
- TCP(HTTP/1.1) g####.h5.p####.cn:9071
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) o####.p####.cn:80
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) log.vc####.cn:80
- TCP(HTTP/1.1) c.d####.mob.com:80
- TCP(HTTP/1.1) sdk.8####.cn:80
- TCP(HTTP/1.1) d####.d####.mob.com:80
- TCP(HTTP/1.1) reso####.msg.xi####.net:80
- TCP(HTTP/1.1) g####.h5.p####.cn:80
- TCP(HTTP/1.1) pg.x####.com:80
- TCP(HTTP/1.1) www.p####.cn.####.com:80
- TCP(HTTP/1.1) t####.qq.com:80
- UDP(NTP) 1.cn.p####.####.org:123
- TCP(TLS/1.0) av1.x####.com:443
- TCP(TLS/1.0) c####.x####.com:443
- TCP(TLS/1.0) regi####.xm####.xi####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP 4####.62.94.2:443
Запросы DNS:
- 1.cn.p####.####.org
- a####.exc.mob.com
- a.appj####.com
- api.s####.mob.com
- av1.x####.com
- c####.x####.com
- c.d####.mob.com
- cdn.p####.cn
- cdn.vc####.cn
- d####.d####.mob.com
- g####.h5.p####.cn
- h5.p####.cn
- hm.b####.com
- i####.cn
- l####.tbs.qq.com
- log.vc####.cn
- m####.vc####.cn
- m.d####.mob.com
- o####.p####.cn
- pg.x####.com
- ping####.qq.com
- r####.wx.qq.com
- regi####.xm####.xi####.com
- reso####.msg.xi####.net
- sdk.8####.cn
- t####.qq.com
- www.google-####.com
- www.p####.cn
Запросы HTTP GET:
- g####.h5.p####.cn/chessBack/img/game/1510709596958.jpg
- g####.h5.p####.cn/chessBack/img/game/1510709624277.jpg
- g####.h5.p####.cn/chessBack/img/game/1510709633045.jpg
- g####.h5.p####.cn/chessBack/img/game/1510709641597.jpg
- g####.h5.p####.cn/chessBack/img/game/1510709650555.jpg
- g####.h5.p####.cn/chessBack/img/game/1510817311325.jpg
- g####.h5.p####.cn/chessBack/r-image?url=####
- g####.h5.p####.cn:9071/h5/gameinfo/get?gameIDs=####&gameId=####&channelI...
- g####.h5.p####.cn:9071/h5/match/user?matchIds=####&gameId=####&channelId...
- g####.h5.p####.cn:9071/h5/product/exist/unreceive?gameId=####
- g####.h5.p####.cn:9071/h5/task/exist/uncollect?gameId=####
- h5.p####.cn/
- h5.p####.cn/?CAF=####
- h5.p####.cn/egameOut/toobar.js?summary=####&pic=####
- h5.p####.cn/pay/5136996.html
- h5.p####.cn/static//css/style.css
- h5.p####.cn/static//fonts/iconfont.css
- h5.p####.cn/static//js/lib/gmu/v2.1.0/gmu.css
- h5.p####.cn/static//js/lib/gmu/v2.1.0/gmu.js
- h5.p####.cn/static//js/lib/sea/v2.3.0/sea.js
- h5.p####.cn/static//js/lib/zepto/v1.1.6/zepto.min.js
- h5.p####.cn/static/css/playOnline_index_v02.css?v=####
- h5.p####.cn/static/igame/sdk.min-3.0.js?v=####
- h5.p####.cn/static/img/close.png
- h5.p####.cn/static/img/sprite_icons2ab55.png
- h5.p####.cn/static/js/charge/charge-3.0.js?time=####
- h5.p####.cn/static/js/charge/egame-2.0.js
- h5.p####.cn/static/js/charge/user-3.0.js?time=####
- h5.p####.cn/static/js/lib/flexible.js
- h5.p####.cn/static/js/lib/jquery.js
- h5.p####.cn/static/js/playOnline_index_v02ba20b.js?v=####
- h5.p####.cn/static/online/css/app.eb301234c92eb3194acf060a4111ba7b.css
- h5.p####.cn/static/online/img/nav_bottom_sprite0149429.png
- h5.p####.cn/static/online/img/sprite_icons1172fb4.png
- h5.p####.cn/static/online/js/1.c7c3c.js
- h5.p####.cn/static/online/js/2.98c28.js
- h5.p####.cn/static/online/js/3.55942.js
- h5.p####.cn/static/online/js/app.bb9c1.js
- h5.p####.cn/static/online/js/manifest.94987.js
- h5.p####.cn/static/online/js/vendor.529da.js
- h5.p####.cn/static/pay/js/index.js
- h5.p####.cn/toolbar/arrow-right.png
- h5.p####.cn/toolbar/bookmark-tip.png
- h5.p####.cn/toolbar/exit.png
- h5.p####.cn/toolbar/h5_egame_analysis.html?CAF=####
- h5.p####.cn/toolbar/play_egame_analysis.html?CAF=####
- h5.p####.cn/toolbar/tooltip.png
- h5.p####.cn/toolbar/wx-bookmark-tip.png
- h5.p####.cn/undefined
- h5.p####.cn/webapp
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=2433,2433&et=...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=3374,3374&et=...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=4434,4434&et=...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=5982,5982&et=...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&ep=5734,4724&e...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&ep=5760,4751&e...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&ep={"netAll":0...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&et=0&ja=0&ln=e...
- hm.b####.com/hm.js?50ac472####
- hm.b####.com/hm.js?86dd9c7####
- hm.b####.com/hm.js?afc751b####
- log.vc####.cn/api/v2/egame/log/config.json?app_key=####
- log.vc####.cn/api/v2/mcore/sdk/cv?version_code=####&client_id=####
- log.vc####.cn/api/v2/mcore/sdk/mm?uii=####
- m.d####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
- o####.p####.cn/api/v1/charge/epay/sdk/41x/get_init_info?app_id=####&game...
- o####.p####.cn/oauth/token/login?client_id=####&vc=####
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=CAF####&ty=#...
- reso####.msg.xi####.net/gslb/?ver=3.0&type=wap&conpt=dvidpodv >>4>>4>>4...
- s####.tc.qq.com/open/js/jweixin-1.0.0.js
- sdk.8####.cn/Aiyouxi/Loginback/game/qmzg
- t####.qq.com/stats?sId=####
- www.p####.cn.####.com/base/h5online/luckyboy/411784.htm?p=####
- www.p####.cn.####.com/f/cms/u/cms/www/201604/18105432pdlz.png
- www.p####.cn.####.com/f/cms/u/cms/www/201712/20102516m4mq.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/201712/20102949f2wu.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/201712/21103021zz3n.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/201712/261441496kvq.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/201801/11093421y5h9.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/201801/12091419zcwt.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/201801/17155157r908.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/201801/18112126md5f.jpg
- www.p####.cn.####.com/f/cms/u/cms/www/playonline/app/advertupload/1/智力大考...
- www.p####.cn.####.com/f/pkg/ph/mid/000/003/027/05ffce83h2e3243f.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/003/048/87c772d7h2e83d0b.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/003/912/f4a37720h3bb50c5.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/015/8e9d424ch3d43db3.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/071/4524ebdeh3e1e841.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/089/a2871d02h3e6842d.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/120/defcec19h3ee0f43.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/169/d1b5935fh3f9e994.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/177/cb4c2290h3fbe157.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/200/b9453331h401927d.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/212/08902b8ch4046897.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/215/2c760d88h40535b1.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/222/d5479de8h406db28.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/242/89d9c1edh40bce23.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/339/d9c812b9h4235b64.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/359/6642c017h4286755.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/370/a0fc29ebh42b1eb4.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/392/3fc36f3ch4307cbc.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/461/27134bfeh44127ba.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/537/f02e55b9h453e544.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/545/a3ba9eedh455ad5e.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/568/121ed8a0h45b59db.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/571/77a3c9ceh45c01ce.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/582/a4587f92h45eb55c.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/614/e3f126f6h466a602.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/655/c6f181ebh47096d6.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/655/c7536244h470a7ae.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/656/372b552eh470bba7.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/672/bd715001h474a444.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/673/740bd95ch4750251.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/686/35134c65h4782612.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/686/72e0c3a5h4782acb.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/688/aa623e7ah4789d9b.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/725/d0621b4ch481a073.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/726/b40a5970h48205ca.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/728/bae3b924h482699a.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/737/21d79ca4h484868d.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/739/d8025e8ch48529fd.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/740/8f160931h48542a2.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/740/9e692c97h4853d68.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/742/29542399h485f521.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/742/79954382h485f299.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/757/5ccf6a36h48985ce.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/759/cde5d41ch48a18ac.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/760/c1c15a1bh48a30bb.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/760/f7efa1cfh48a340f.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/776/375da0eah48e3730.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/788/c420fb83h491292f.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/792/3e2889b1h4921413.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/806/20c84c55h495859e.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/811/f15cfd75h49696e4.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/829/0d95cb02h49b2961.jpg
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/842/983af65bh49e440a.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/896/2294131bh4ab6423.png
- www.p####.cn.####.com/f/pkg/ph/mid/000/004/899/4fa222cdh4ac27a2.png
- www.p####.cn.####.com/f/push/pkg/hall/2017/09/05/1504602089471.zip
- www.p####.cn.####.com/play/online/advrt/start/info.json?type=####
- www.p####.cn.####.com/play/online/app/version/info.json
- www.p####.cn.####.com/r/cms/www/3g/v02/h5_online/css/index.css
- www.p####.cn.####.com/r/cms/www/3g/v02/h5_online/js/flexible.js
Запросы HTTP POST:
- a####.exc.mob.com/errconf
- a.appj####.com/ad-service/ad/mark
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- c.d####.mob.com/v2/cdata
- d####.d####.mob.com/dinfo
- d####.d####.mob.com/dsign
- g####.h5.p####.cn:9071/h5/match/get
- g####.h5.p####.cn:9071/h5/match/last/134
- g####.h5.p####.cn:9071/h5/match/rank/134
- g####.h5.p####.cn:9071/h5/prize/get
- g####.h5.p####.cn:9071/h5/user/headimageuri/1107690
- g####.h5.p####.cn:9071/init
- g####.h5.p####.cn:9071/user/get
- g####.h5.p####.cn:9071/user/h5/get
- g####.h5.p####.cn:9071/user/playcnlogindata
- l####.tbs.qq.com/ajax?c=####&k=####
- log.vc####.cn/api/v2/egame/log.json
- pg.x####.com/api/q/a/3cff577985556567209c8fa8131303f63
- pg.x####.com/api/statis/3cff577985556567209c8fa8131303f63/app-84520DE772...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_db/####/http_h5.play.cn_0.localstorage-journal
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/cache/####/1e0104ad1234555f6a57dee6c228b926129....0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/f_000044
- <Package Folder>/cache/####/f_000045
- <Package Folder>/cache/####/f_000046
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/ThrowalbeLog.db-journal
- <Package Folder>/databases/geofencing.db
- <Package Folder>/databases/geofencing.db-journal
- <Package Folder>/databases/sharesdk.db-journal
- <Package Folder>/databases/talkingdata_app.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/egame/####/EGAME_SDK.dat
- <Package Folder>/egame/####/EGAME_SDK.jar
- <Package Folder>/egame/####/Signature
- <Package Folder>/egame/####/egame_sdk_1.png
- <Package Folder>/egame/####/egame_sdk_16.png
- <Package Folder>/egame/####/egame_sdk_25.png
- <Package Folder>/egame/####/egame_sdk_4.png
- <Package Folder>/egame/####/egame_sdk_9.png
- <Package Folder>/egame/####/egame_sdk_bg.9.png
- <Package Folder>/egame/####/egame_sdk_bg_pay.9.png
- <Package Folder>/egame/####/egame_sdk_bg_ticket_left.9.png
- <Package Folder>/egame/####/egame_sdk_bg_ticket_right.9.png
- <Package Folder>/egame/####/egame_sdk_btn_back_normal.9.png
- <Package Folder>/egame/####/egame_sdk_btn_back_pressed.9.png
- <Package Folder>/egame/####/egame_sdk_btn_gold_store.png
- <Package Folder>/egame/####/egame_sdk_btn_green_normal.9.png
- <Package Folder>/egame/####/egame_sdk_btn_green_pressed.9.png
- <Package Folder>/egame/####/egame_sdk_game_icon_default.png
- <Package Folder>/egame/####/egame_sdk_ico_bag.png
- <Package Folder>/egame/####/egame_sdk_ico_forum.png
- <Package Folder>/egame/####/egame_sdk_ico_list.png
- <Package Folder>/egame/####/egame_sdk_ico_question.png
- <Package Folder>/egame/####/egame_sdk_ico_raiders.png
- <Package Folder>/egame/####/egame_sdk_icon_back.png
- <Package Folder>/egame/####/egame_sdk_icon_close.png
- <Package Folder>/egame/####/egame_sdk_icon_loading.png
- <Package Folder>/egame/####/egame_sdk_icon_pack_up.png
- <Package Folder>/egame/####/egame_sdk_icon_password.png
- <Package Folder>/egame/####/egame_sdk_icon_rmb.png
- <Package Folder>/egame/####/egame_sdk_icon_selected.png
- <Package Folder>/egame/####/egame_sdk_icon_spread_out.png
- <Package Folder>/egame/####/egame_sdk_icon_ticket_more.png
- <Package Folder>/egame/####/egame_sdk_icon_unselected.png
- <Package Folder>/egame/####/egame_sdk_input_box.9.png
- <Package Folder>/egame/####/egame_sdk_logo_aibei.png
- <Package Folder>/egame/####/egame_sdk_logo_chongzhika.png
- <Package Folder>/egame/####/egame_sdk_logo_dianka.png
- <Package Folder>/egame/####/egame_sdk_logo_huafei.png
- <Package Folder>/egame/####/egame_sdk_logo_jdzhifu.png
- <Package Folder>/egame/####/egame_sdk_logo_more.png
- <Package Folder>/egame/####/egame_sdk_logo_weixin.png
- <Package Folder>/egame/####/egame_sdk_logo_yinlian.png
- <Package Folder>/egame/####/egame_sdk_logo_yizhifu.png
- <Package Folder>/egame/####/egame_sdk_logo_zhifubao.png
- <Package Folder>/egame/####/egame_sdk_password_input_box_left.9.png
- <Package Folder>/egame/####/egame_sdk_password_input_box_mid.9.png
- <Package Folder>/egame/####/egame_sdk_password_input_box_right.9.png
- <Package Folder>/egame/####/egame_sdk_popup_btn_blue_normal.9.png
- <Package Folder>/egame/####/egame_sdk_popup_btn_blue_pressed.9.png
- <Package Folder>/egame/####/egame_sdk_pressed.9.png
- <Package Folder>/egame/####/egame_sdk_tag_selected.9.png
- <Package Folder>/egame/####/egame_sdk_tag_unselected.9.png
- <Package Folder>/egame/####/libegamepay_private_dr2.so
- <Package Folder>/egame/####/libepsh_private_ar1.so
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/.mrlock
- <Package Folder>/files/.lock
- <Package Folder>/files/.mrecord
- <Package Folder>/files/.mrecord (deleted)
- <Package Folder>/files/.statistics
- <Package Folder>/files/<Package>;pushservice
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/files/egame_psh_temp.jar
- <Package Folder>/files/egame_psh_temp_.jar
- <Package Folder>/files/egame_s867068438.tmp
- <Package Folder>/files/egame_temp.jar
- <Package Folder>/files/egame_temp_.jar
- <Package Folder>/files/talkingdata_app_process_preferences_file
- <Package Folder>/files/talkingdata_app_version_preferences_file
- <Package Folder>/files/td.lock
- <Package Folder>/files/tdlock.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/EGAME_PAY_SDK.xml
- <Package Folder>/shared_prefs/TDCloudSettingsConfig84520DE77213...67.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml (deleted)
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/XMPushServiceConfig.xml
- <Package Folder>/shared_prefs/cn_egame_sdk_log.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/mcore_dat.xml
- <Package Folder>/shared_prefs/mipush.xml
- <Package Folder>/shared_prefs/mipush_account.xml
- <Package Folder>/shared_prefs/mipush_extra.xml
- <Package Folder>/shared_prefs/mob_commons_1.xml
- <Package Folder>/shared_prefs/mob_sdk_exception_1.xml
- <Package Folder>/shared_prefs/pref_registered_pkg_names.xml
- <Package Folder>/shared_prefs/share_sdk_1.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <Package Folder>/shared_prefs/tdid.xml
- <SD-Card>/.tcookieid
- <SD-Card>/Android/####/log.lock
- <SD-Card>/Android/####/log1.txt
- <SD-Card>/Mob/####/.al
- <SD-Card>/Mob/####/.dh-journal
- <SD-Card>/Mob/####/.dhlock
- <SD-Card>/Mob/####/.dic_lock
- <SD-Card>/Mob/####/.duid
- <SD-Card>/Mob/####/.globalLock
- <SD-Card>/Mob/####/.nulal
- <SD-Card>/Mob/####/.nulplt
- <SD-Card>/Mob/####/.pkg_lock
- <SD-Card>/Mob/####/.plst
- <SD-Card>/Mob/####/.rcTag
- <SD-Card>/Mob/####/.rc_lock
- <SD-Card>/Mob/.dk
- <SD-Card>/egame/####/EPSH_147.zip.temp
Другие:
Запускает следующие shell-скрипты:
- app_process /system/bin com.android.commands.pm.Pm list packages
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop ro.product.cpu.abi
- grep -E -v root|shell|system
- pm list packages
- sh
- top -d 0 -n 1
Загружает динамические библиотеки:
- egamepay_dr2
- libegamepay_private_dr2
- libepsh_private_ar1
- libjiagu
- neh
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
