Android.DownLoader.3462

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

1065800830195349: 100#GxXMLD
10658077696615: YX,264340,5,f4a8,1807926,615004,F1Y26233371
10658077696626: YX,260637,23,0091,1822051,03,LM886233425
10658423: mvwlan,3dcdcfcf928dbc2ee5db5b09e137745a,VTUe
1066038311: 104B
106606903: 270

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.600.origin
Android.SmsSpy.677.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.SmsSpy.677.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sdk.qi1####.com:80
TCP(HTTP/1.1) 1####.55.16.91:8080
TCP(HTTP/1.1) q####.qi1####.com:14302
TCP(HTTP/1.1) dqtq####.d####.cn:80
TCP(HTTP/1.1) 1####.55.17.147:8080
TCP(HTTP/1.1) q####.qi1####.com:15302
TCP(HTTP/1.1) 88####.net:88
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) p####.nj####.com.####.com:8080
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) 1####.124.104.179:8080
TCP(HTTP/1.1) qyc####.qi1####.com:8200
TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) z####.wann####.com:9600

Запросы DNS:

88####.net
a####.u####.com
dqtq####.d####.cn
hangzho####.oss-cn-####.aliy####.com
int.d####.s####.####.cn
p####.nj####.com
q####.qi1####.com
qyc####.qi1####.com
sdk.qi1####.com
z####.wann####.com
zxc####.wann####.com

Запросы HTTP GET:

88####.net:88/game/cof.do?k=####
dqtq####.d####.cn/all/40063-C01
hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
p####.nj####.com.####.com:8080/png/ic_jyyy.png
p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
p####.nj####.com.####.com:8080/res/novel/app/icon/1.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/2.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/3.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/4.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/5.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/6.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/7.jpg
p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2020.jar
qyc####.qi1####.com:8200/sdk/file?eYrAAJN####
sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar

Запросы HTTP POST:

88####.net:88/game/open.do
88####.net:88/game/start.do?ver=####
a####.u####.com/app_logs
q####.qi1####.com:14302/sdk_login?t=####
q####.qi1####.com:15302/sdk_login?t=####
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_payload_odex/<Package>.dex (deleted)
<Package Folder>/app_payload_odex/<Package>.jar
<Package Folder>/app_payload_res/####/._logo_img_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_2.jpg
<Package Folder>/app_payload_res/####/._pg_1.png
<Package Folder>/app_payload_res/####/._pg_2.png
<Package Folder>/app_payload_res/####/._pg_3.png
<Package Folder>/app_payload_res/####/._pic_bg.png
<Package Folder>/app_payload_res/####/._pic_mm_0.jpg
<Package Folder>/app_payload_res/####/._pic_mm_1.jpg
<Package Folder>/app_payload_res/####/._pic_mm_2.jpg
<Package Folder>/app_payload_res/####/._pic_mm_3.jpg
<Package Folder>/app_payload_res/####/._pic_mm_4.jpg
<Package Folder>/app_payload_res/####/._pic_mm_5.jpg
<Package Folder>/app_payload_res/####/._pic_mm_6.jpg
<Package Folder>/app_payload_res/####/._pic_mm_7.jpg
<Package Folder>/app_payload_res/####/._price1.jpg
<Package Folder>/app_payload_res/####/._price3.png
<Package Folder>/app_payload_res/logo_img_0.jpg
<Package Folder>/app_payload_res/maan.so
<Package Folder>/app_payload_res/mm_show_0_0.jpg
<Package Folder>/app_payload_res/mm_show_0_1.jpg
<Package Folder>/app_payload_res/mm_show_0_2.jpg
<Package Folder>/app_payload_res/mm_show_0_3.jpg
<Package Folder>/app_payload_res/mm_show_1_0.jpg
<Package Folder>/app_payload_res/mm_show_1_1.jpg
<Package Folder>/app_payload_res/mm_show_1_2.jpg
<Package Folder>/app_payload_res/mm_show_1_3.jpg
<Package Folder>/app_payload_res/mm_show_2_0.jpg
<Package Folder>/app_payload_res/mm_show_2_1.jpg
<Package Folder>/app_payload_res/mm_show_2_2.jpg
<Package Folder>/app_payload_res/mm_show_2_3.jpg
<Package Folder>/app_payload_res/mm_show_3_0.jpg
<Package Folder>/app_payload_res/mm_show_3_1.jpg
<Package Folder>/app_payload_res/mm_show_3_2.jpg
<Package Folder>/app_payload_res/mm_show_4_0.jpg
<Package Folder>/app_payload_res/mm_show_4_1.jpg
<Package Folder>/app_payload_res/mm_show_4_2.jpg
<Package Folder>/app_payload_res/mm_show_5_0.jpg
<Package Folder>/app_payload_res/mm_show_5_1.jpg
<Package Folder>/app_payload_res/mm_show_5_2.jpg
<Package Folder>/app_payload_res/mm_show_6_0.jpg
<Package Folder>/app_payload_res/mm_show_6_1.jpg
<Package Folder>/app_payload_res/mm_show_6_2.jpg
<Package Folder>/app_payload_res/pg_1.png
<Package Folder>/app_payload_res/pg_2.png
<Package Folder>/app_payload_res/pg_3.png
<Package Folder>/app_payload_res/pic_bg.png
<Package Folder>/app_payload_res/pic_mm_0.jpg
<Package Folder>/app_payload_res/pic_mm_1.jpg
<Package Folder>/app_payload_res/pic_mm_2.jpg
<Package Folder>/app_payload_res/pic_mm_3.jpg
<Package Folder>/app_payload_res/pic_mm_4.jpg
<Package Folder>/app_payload_res/pic_mm_5.jpg
<Package Folder>/app_payload_res/pic_mm_6.jpg
<Package Folder>/app_payload_res/pic_mm_7.jpg
<Package Folder>/app_payload_res/price1.jpg
<Package Folder>/app_payload_res/price3.png
<Package Folder>/app_payload_res/story_btn_read.png
<Package Folder>/app_payload_res/tab1_0.png
<Package Folder>/app_payload_res/tab1_1.png
<Package Folder>/app_payload_res/tab2_0.png
<Package Folder>/app_payload_res/tab2_1.png
<Package Folder>/app_process_lock/1122134780669.12
<Package Folder>/app_process_lock/1122134780669.12 (deleted)
<Package Folder>/app_process_lock/1122134780892.7
<Package Folder>/app_process_lock/1122134780892.7 (deleted)
<Package Folder>/app_process_lock/1122134780910.9
<Package Folder>/app_process_lock/1122134780910.9 (deleted)
<Package Folder>/app_process_lock/1122134780942.84
<Package Folder>/app_process_lock/1122134780942.84 (deleted)
<Package Folder>/app_process_lock/1122134781042.03
<Package Folder>/app_process_lock/1122134781042.03 (deleted)
<Package Folder>/app_process_lock/1122134781097.35
<Package Folder>/app_process_lock/1122134781097.35 (deleted)
<Package Folder>/app_process_lock/1122134781109.77
<Package Folder>/app_process_lock/1122134781109.77 (deleted)
<Package Folder>/app_process_lock/1122134781152.26
<Package Folder>/app_process_lock/1122134781152.26 (deleted)
<Package Folder>/app_process_lock/1122134781206.35
<Package Folder>/app_process_lock/1122134781206.35 (deleted)
<Package Folder>/app_process_lock/1122134781271.16
<Package Folder>/app_process_lock/1122134781271.16 (deleted)
<Package Folder>/app_process_lock/1122134781291.37
<Package Folder>/app_process_lock/1122134781291.37 (deleted)
<Package Folder>/app_process_lock/1122134781371.65
<Package Folder>/app_process_lock/1122134781371.65 (deleted)
<Package Folder>/app_process_lock/1122134781413.08
<Package Folder>/app_process_lock/1122134781413.08 (deleted)
<Package Folder>/app_process_lock/1122134781428.86
<Package Folder>/app_process_lock/1122134781428.86 (deleted)
<Package Folder>/app_process_lock/1122134781521.17
<Package Folder>/app_process_lock/1122134781521.17 (deleted)
<Package Folder>/app_process_lock/1122134781526.7
<Package Folder>/app_process_lock/1122134781526.7 (deleted)
<Package Folder>/app_process_lock/1122134781557.95
<Package Folder>/app_process_lock/1122134781557.95 (deleted)
<Package Folder>/app_process_lock/1122134781610.93
<Package Folder>/app_process_lock/1122134781610.93 (deleted)
<Package Folder>/app_process_lock/1122134781631.77
<Package Folder>/app_process_lock/1122134781631.77 (deleted)
<Package Folder>/app_process_lock/1122134781663.23
<Package Folder>/app_process_lock/1122134781663.23 (deleted)
<Package Folder>/app_process_lock/1122134781767.2
<Package Folder>/app_process_lock/1122134781767.2 (deleted)
<Package Folder>/app_process_lock/1122134781798.52
<Package Folder>/app_process_lock/1122134781798.52 (deleted)
<Package Folder>/app_process_lock/1122134781807.94
<Package Folder>/app_process_lock/1122134781807.94 (deleted)
<Package Folder>/app_process_lock/1122134781927.51
<Package Folder>/app_process_lock/1122134781927.51 (deleted)
<Package Folder>/app_process_lock/1122134782019.93
<Package Folder>/app_process_lock/1122134782019.93 (deleted)
<Package Folder>/app_process_lock/1122134782297.89
<Package Folder>/app_process_lock/1122134782297.89 (deleted)
<Package Folder>/app_process_lock/1132.30089999093
<Package Folder>/app_process_lock/1132.30089999093 (deleted)
<Package Folder>/app_process_lock/1132.34542065845
<Package Folder>/app_process_lock/1132.34542065845 (deleted)
<Package Folder>/app_process_lock/1132.38994132597
<Package Folder>/app_process_lock/1132.38994132597 (deleted)
<Package Folder>/app_process_lock/1132.43446199348
<Package Folder>/app_process_lock/1132.43446199348 (deleted)
<Package Folder>/app_process_lock/1132.478982661
<Package Folder>/app_process_lock/1132.478982661 (deleted)
<Package Folder>/app_process_lock/1132.52350332852
<Package Folder>/app_process_lock/1132.52350332852 (deleted)
<Package Folder>/app_process_lock/1132.56802399603
<Package Folder>/app_process_lock/1132.56802399603 (deleted)
<Package Folder>/app_process_lock/161.918512514603
<Package Folder>/app_process_lock/161.918512514603 (deleted)
<Package Folder>/app_process_lock/2325817181089.03
<Package Folder>/app_process_lock/2325817181089.03 (deleted)
<Package Folder>/app_process_lock/2325817181974.01
<Package Folder>/app_process_lock/2325817181974.01 (deleted)
<Package Folder>/app_process_lock/2325817182455.51
<Package Folder>/app_process_lock/2325817182455.51 (deleted)
<Package Folder>/app_process_lock/2325817182974.12
<Package Folder>/app_process_lock/2325817182974.12 (deleted)
<Package Folder>/app_process_lock/2325817183150.27
<Package Folder>/app_process_lock/2325817183150.27 (deleted)
<Package Folder>/app_process_lock/2325817183580.49
<Package Folder>/app_process_lock/2325817183580.49 (deleted)
<Package Folder>/app_process_lock/2325817187700.19
<Package Folder>/app_process_lock/2325817187700.19 (deleted)
<Package Folder>/app_process_lock/261206458799.413
<Package Folder>/app_process_lock/261206458799.413 (deleted)
<Package Folder>/app_process_lock/261206458898.802
<Package Folder>/app_process_lock/261206458898.802 (deleted)
<Package Folder>/app_process_lock/261206458952.878
<Package Folder>/app_process_lock/261206458952.878 (deleted)
<Package Folder>/app_process_lock/261206459011.123
<Package Folder>/app_process_lock/261206459011.123 (deleted)
<Package Folder>/app_process_lock/261206459030.906
<Package Folder>/app_process_lock/261206459030.906 (deleted)
<Package Folder>/app_process_lock/261206459079.222
<Package Folder>/app_process_lock/261206459079.222 (deleted)
<Package Folder>/app_process_lock/261206459541.895
<Package Folder>/app_process_lock/261206459541.895 (deleted)
<Package Folder>/app_process_lock/2965416929814.21
<Package Folder>/app_process_lock/2965416929814.21 (deleted)
<Package Folder>/app_process_lock/2965416930405.04
<Package Folder>/app_process_lock/2965416930405.04 (deleted)
<Package Folder>/app_process_lock/2965416930453.13
<Package Folder>/app_process_lock/2965416930453.13 (deleted)
<Package Folder>/app_process_lock/2965416930537.56
<Package Folder>/app_process_lock/2965416930537.56 (deleted)
<Package Folder>/app_process_lock/2965416930799.68
<Package Folder>/app_process_lock/2965416930799.68 (deleted)
<Package Folder>/app_process_lock/2965416930945.85
<Package Folder>/app_process_lock/2965416930945.85 (deleted)
<Package Folder>/app_process_lock/2965416930978.69
<Package Folder>/app_process_lock/2965416930978.69 (deleted)
<Package Folder>/app_process_lock/2965416931090.98
<Package Folder>/app_process_lock/2965416931090.98 (deleted)
<Package Folder>/app_process_lock/2965416931233.92
<Package Folder>/app_process_lock/2965416931233.92 (deleted)
<Package Folder>/app_process_lock/2965416931405.18
<Package Folder>/app_process_lock/2965416931405.18 (deleted)
<Package Folder>/app_process_lock/2965416931458.6
<Package Folder>/app_process_lock/2965416931458.6 (deleted)
<Package Folder>/app_process_lock/2965416931670.74
<Package Folder>/app_process_lock/2965416931670.74 (deleted)
<Package Folder>/app_process_lock/2965416931780.23
<Package Folder>/app_process_lock/2965416931780.23 (deleted)
<Package Folder>/app_process_lock/2965416931821.95
<Package Folder>/app_process_lock/2965416931821.95 (deleted)
<Package Folder>/app_process_lock/2965416932065.87
<Package Folder>/app_process_lock/2965416932065.87 (deleted)
<Package Folder>/app_process_lock/2965416932080.48
<Package Folder>/app_process_lock/2965416932080.48 (deleted)
<Package Folder>/app_process_lock/2965416932163.07
<Package Folder>/app_process_lock/2965416932163.07 (deleted)
<Package Folder>/app_process_lock/2965416932303.1
<Package Folder>/app_process_lock/2965416932303.1 (deleted)
<Package Folder>/app_process_lock/2965416932358.16
<Package Folder>/app_process_lock/2965416932358.16 (deleted)
<Package Folder>/app_process_lock/2965416932441.28
<Package Folder>/app_process_lock/2965416932441.28 (deleted)
<Package Folder>/app_process_lock/2965416932716.05
<Package Folder>/app_process_lock/2965416932716.05 (deleted)
<Package Folder>/app_process_lock/2965416932798.81
<Package Folder>/app_process_lock/2965416932798.81 (deleted)
<Package Folder>/app_process_lock/2965416932823.71
<Package Folder>/app_process_lock/2965416932823.71 (deleted)
<Package Folder>/app_process_lock/2965416933139.7
<Package Folder>/app_process_lock/2965416933139.7 (deleted)
<Package Folder>/app_process_lock/2965416933383.93
<Package Folder>/app_process_lock/2965416933383.93 (deleted)
<Package Folder>/app_process_lock/2965416934118.47
<Package Folder>/app_process_lock/2965416934118.47 (deleted)
<Package Folder>/app_process_lock/3660380.04099951
<Package Folder>/app_process_lock/3660380.04099951 (deleted)
<Package Folder>/app_process_lock/3660380.34145408
<Package Folder>/app_process_lock/3660380.34145408 (deleted)
<Package Folder>/app_process_lock/690278982923.084
<Package Folder>/app_process_lock/690278982923.084 (deleted)
<Package Folder>/app_process_lock/690278983185.736
<Package Folder>/app_process_lock/690278983185.736 (deleted)
<Package Folder>/app_process_lock/690278983328.64
<Package Folder>/app_process_lock/690278983328.64 (deleted)
<Package Folder>/app_process_lock/690278983482.56
<Package Folder>/app_process_lock/690278983482.56 (deleted)
<Package Folder>/app_process_lock/690278983534.839
<Package Folder>/app_process_lock/690278983534.839 (deleted)
<Package Folder>/app_process_lock/690278983662.524
<Package Folder>/app_process_lock/690278983662.524 (deleted)
<Package Folder>/app_process_lock/690278984885.21
<Package Folder>/app_process_lock/690278984885.21 (deleted)
<Package Folder>/app_process_lock/889.37042982576
<Package Folder>/app_process_lock/889.37042982576 (deleted)
<Package Folder>/app_process_lock/889.414950493276
<Package Folder>/app_process_lock/889.414950493276 (deleted)
<Package Folder>/app_process_lock/889.459471160793
<Package Folder>/app_process_lock/889.459471160793 (deleted)
<Package Folder>/app_process_lock/889.503991828309
<Package Folder>/app_process_lock/889.503991828309 (deleted)
<Package Folder>/app_process_lock/889.548512495826
<Package Folder>/app_process_lock/889.548512495826 (deleted)
<Package Folder>/app_process_lock/889.593033163343
<Package Folder>/app_process_lock/889.593033163343 (deleted)
<Package Folder>/app_process_lock/889.637553830859
<Package Folder>/app_process_lock/889.637553830859 (deleted)
<Package Folder>/app_process_lock/889.682074498376
<Package Folder>/app_process_lock/889.682074498376 (deleted)
<Package Folder>/app_process_lock/889.726595165892
<Package Folder>/app_process_lock/889.726595165892 (deleted)
<Package Folder>/cache/.jar
<Package Folder>/databases/a.db
<Package Folder>/databases/a.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/qy_db_pay-journal
<Package Folder>/databases/twsdk.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/xUtils_http_cache.db
<Package Folder>/databases/xUtils_http_cache.db-journal
<Package Folder>/databases/xUtils_http_cookie.db
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.imprint
<Package Folder>/files/exid.dat
<Package Folder>/files/getprop
<Package Folder>/files/pid
<Package Folder>/files/umeng_it.cache
<Package Folder>/libzxvps/####/tmp_so
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/unknown.xml
<Package Folder>/shared_prefs/userData.xml
<Package Folder>/shared_prefs/userDatas.xml
<Package Folder>/tmp_jar
<SD-Card>/.Systemp/.cfg
<SD-Card>/.Systemp/device
<SD-Card>/Android/####/031f04ef44c86d37888b9206208ab7ff
<SD-Card>/Android/####/110b6dcd7a403d3581b21c2d9d50f95c
<SD-Card>/Android/####/13a9b9b062c2dd69914094fccec35851
<SD-Card>/Android/####/2335ec4ab7dfb2a3a4403f02841dee0b
<SD-Card>/Android/####/28bed8706e6a20b89d2745acf2388aff
<SD-Card>/Android/####/28f4502c1c75721a93ec1694c994b6df
<SD-Card>/Android/####/300f50dfb16e035d7ba2ebd4753b36b8
<SD-Card>/Android/####/337372b70559ab820dc1869eaf3e8552
<SD-Card>/Android/####/4947ebcaa0d90565d11cc8d52de5e195
<SD-Card>/Android/####/4a572084352089eec7a19d6df6dd66c1
<SD-Card>/Android/####/4eb51e02f6a176423ce9b08fbde053a6
<SD-Card>/Android/####/55a64821c9042df1dde377125512dd6a
<SD-Card>/Android/####/55ccff2ab83c1a9f55458ba7527d70d5
<SD-Card>/Android/####/5abd17b3ee78dc1d3ef67769c998cc2e
<SD-Card>/Android/####/614b01e4628d6b78f36743a3105948fe
<SD-Card>/Android/####/641396e85bf54468fe7cee3296fab1be
<SD-Card>/Android/####/7cb350593336dcf4136ad289bf15eda8
<SD-Card>/Android/####/897f47697ee1e6f740a2bff65a9d1b9e
<SD-Card>/Android/####/8acf08558ad9a62966ddb70b9a7b29a0
<SD-Card>/Android/####/8ad08fe615919f244be463cb8490f523
<SD-Card>/Android/####/8f0918b168bb556925ce3aab6ed80851
<SD-Card>/Android/####/9de1deec0ca17fdf3acb61529bb9c3a9
<SD-Card>/Android/####/aef1a5a0e410d39bff5a45296338286b
<SD-Card>/Android/####/b42affdbb09e2ac4a99ec502e8ae224b
<SD-Card>/Android/####/b503d5b83a8292e384cc403e3ff7298a
<SD-Card>/Android/####/c354dc8add3ebac7fa4db81fcada0c5a
<SD-Card>/Android/####/cd13a6c189ab0aeb27b36e21a312d4b5
<SD-Card>/Android/####/cffbf339860453dc0888f045f71a8f95
<SD-Card>/Android/####/d3a5c82d8bdb1fb34d6b54b802809dab
<SD-Card>/Android/####/dacfcfc68b2f181c7e93e5d5cb8c3678
<SD-Card>/Android/####/e62c0de24c85fe9c4ac1c4892ce151a9
<SD-Card>/Android/####/f1478fe5dca5d370e02547c7beec9d23
<SD-Card>/Android/####/fc2d8a617ed23f6f6ae32c9527646094
<SD-Card>/Android/1.txt.tmp
<SD-Card>/Android/10.txt.tmp
<SD-Card>/Android/11.txt.tmp
<SD-Card>/Android/12.txt.tmp
<SD-Card>/Android/13.txt.tmp
<SD-Card>/Android/14.txt.tmp
<SD-Card>/Android/15.txt.tmp
<SD-Card>/Android/16.txt.tmp
<SD-Card>/Android/2.txt.tmp
<SD-Card>/Android/3.txt.tmp
<SD-Card>/Android/4.txt.tmp
<SD-Card>/Android/5.txt.tmp
<SD-Card>/Android/6.txt.tmp
<SD-Card>/Android/7.txt.tmp
<SD-Card>/Android/8.txt.tmp
<SD-Card>/Android/9.txt.tmp
<SD-Card>/Android/com.molove.mobile.sjwwx.apk.tmp
<SD-Card>/Android/com.molove.mobile.sjwwx.png.tmp
<SD-Card>/dp.jar.tmp
<SD-Card>/updateApkDemo/FrameCore.jar

Другие:

Запускает следующие shell-скрипты:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
chmod 777 <Package Folder>/lib/helper
dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
df
getprop
ls -l /system/bin/su
ps | grep <Package>
sh

Загружает динамические библиотеки:

libhelper
libsmsmanager
libzxvps

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

DES
DES-ECB-NoPadding

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Парсит информацию из смс сообщений.

Осуществляет доступ к информации об отправленых/принятых смс.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней