Android.Triada.448

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.243
Android.Triada.248.origin
Android.Triada.373.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) l.ace####.com:80
TCP(HTTP/1.1) cl.mo####.u####.com:80
TCP(HTTP/1.1) img.ace####.com:80
TCP(HTTP/1.1) 1####.196.40.71:9600
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) p####.api.kxcon####.com:80
TCP(HTTP/1.1) 1####.196.40.71:9500
TCP(HTTP/1.1) sw.izhu####.com:80
TCP(HTTP/1.1) x####.kap####.com:80
TCP(HTTP/???) l.ace####.com:80

Запросы DNS:

a####.u####.com
cl.mo####.u####.com
img.ace####.com
l.ace####.com
loc.map.b####.com
p####.api.kxcon####.com
p####.k####.com
sw.izhu####.com
x####.kap####.com

Запросы HTTP GET:

img.ace####.com/ando-res/ads/11/9/1a4c5d2b-bb1f-4e7f-9de2-94f89a1dd619/0...
img.ace####.com/ando-res/ads/11/9/1a4c5d2b-bb1f-4e7f-9de2-94f89a1dd619/9...
img.ace####.com/ando-res/ads/13/31/f0b01fed-6c1e-4250-a430-bc13e3dd29a9/...
img.ace####.com/ando-res/ads/20/28/accd2f94-5942-45f2-b3e6-dc96314e5d3e/...
img.ace####.com/ando-res/ads/23/15/274631f7-b216-46c6-8c49-e64bfc112438/...
img.ace####.com/ando-res/ads/3/6/3aa978c3-e6f5-48f3-8b67-9094d5ddf573/57...
img.ace####.com/ando-res/ads/30/14/f15541de-b7bd-4ff9-97fb-9e6cc9e4e044/...
img.ace####.com/ando-res/ads/31/19/0031a27f-36c1-4947-87d6-ef825ea8a691/...
l.ace####.com/ando/v3/mn?k=####&d=####
l.ace####.com/ando/v3/mn?k=####&d=####&m=####

Запросы HTTP POST:

a####.u####.com/app_logs
cl.mo####.u####.com/show.aspx?Key=####
l.ace####.com/ando/v1/x/ap?app_id=####&r=####
l.ace####.com/ando/v1/x/lv?app_id=####&r=####
l.ace####.com/ando/v1/x/qa?app_id=####&r=####
loc.map.b####.com/sdk.php
p####.api.kxcon####.com/v1/pull/mobile
sw.izhu####.com/v1/shuwei/mobile
x####.kap####.com/upload/event.jsp
x####.kap####.com/upload/isuploadappinfo.jsp
x####.kap####.com/upload/longheartbeat.jsp

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/code-7895124/sx-WYz8KPpZIezAn
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_1tR...LLuJo=
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_1tR...ournal
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_Gzz...brelod
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_Gzz...ournal
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_PNV...lZJg==
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_PNV...ournal
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_fmw...ournal
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_lNb...ournal
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_lNb...q3Ng==
<Package Folder>/databases/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_rws.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/vi_db_pay-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/0fe775e9-2103-45ee-ba8d-d7a4603a9d45.pic.temp
<Package Folder>/files/####/10.png
<Package Folder>/files/####/100.png
<Package Folder>/files/####/108603ac-8a73-4092-9f9e-fd16a32c6811.pic.temp
<Package Folder>/files/####/1hs9249e19QzyU8zh1u1eYjoY_Mt7XzEuFNGMg==.new
<Package Folder>/files/####/2.png
<Package Folder>/files/####/20.png
<Package Folder>/files/####/200.png
<Package Folder>/files/####/28.png
<Package Folder>/files/####/30.png
<Package Folder>/files/####/4aBms0WRFNuDxFNIsW8HAQ==
<Package Folder>/files/####/500.png
<Package Folder>/files/####/56cbb3f1-11c3-4dd4-a039-77be5bd90766.pic.temp
<Package Folder>/files/####/6G3RCg_HW5doJFkLS7SNrVqQId3K2t7-8q0...g=.new
<Package Folder>/files/####/87fb024e-4e9b-40a2-b290-f507a1e9807d.pic.temp
<Package Folder>/files/####/888.png
<Package Folder>/files/####/8w5CD0ifFu_F_o8YJCKnCeHyaVG7IZSBJv7...4=.new
<Package Folder>/files/####/902e06d8-7217-4766-bb26-2cb3bcc42724.pic.temp
<Package Folder>/files/####/915233c5-954e-44af-b619-f97abaae64bf.pic.temp
<Package Folder>/files/####/9kxJWh_D813nPDDsyE1W7Vwxq68=.new
<Package Folder>/files/####/Ao-1PSrjL4UgNOmSdMz5iiUZeDc=.new
<Package Folder>/files/####/CvML6TK5oLGVxdxFLEaJpkkb33a5AAFD.new
<Package Folder>/files/####/EcM-bRSMz4v24JeA
<Package Folder>/files/####/Ib_VSU7oJmvSO5mC.new
<Package Folder>/files/####/JPovfQMkwiyLL1EWC8z1avYwrDs=
<Package Folder>/files/####/Marker Felt.ttf
<Package Folder>/files/####/OmWG_onP7l63tx_HCaBNKSCagwMr9JT2.new
<Package Folder>/files/####/Ru6r8hhZ4Oj1sEJ3UWiX5w==.new
<Package Folder>/files/####/SKemI3rSHomcZX4t.zip
<Package Folder>/files/####/TFIXz7wdpfO9D_smBefz_dvGd6gd_BWp.new
<Package Folder>/files/####/UGxSJkg_uxlzWJxBIeQcB4burZ8=.new
<Package Folder>/files/####/VZyif4QBx50lA2LLYFFo6r-L_82jd7NSebh...M=.new
<Package Folder>/files/####/W_XHUYoW2le1tGoZofTHkW7mlSUdRPdR.new
<Package Folder>/files/####/ZkYVV42bMhLu5k4nnnSaAw==
<Package Folder>/files/####/ZuiZhu.plist
<Package Folder>/files/####/ZuiZhu.png
<Package Folder>/files/####/aa2.png
<Package Folder>/files/####/acb14b77-38bc-455f-8a15-1485176f08d0.pic.temp
<Package Folder>/files/####/add.png
<Package Folder>/files/####/addLife.ogg
<Package Folder>/files/####/aixin1.png
<Package Folder>/files/####/anli1.png
<Package Folder>/files/####/anli2.png
<Package Folder>/files/####/anli3.png
<Package Folder>/files/####/anli4.png
<Package Folder>/files/####/att.plist
<Package Folder>/files/####/att.png
<Package Folder>/files/####/attMenu.png
<Package Folder>/files/####/attMenuLock.png
<Package Folder>/files/####/back1.png
<Package Folder>/files/####/back2.png
<Package Folder>/files/####/background.png
<Package Folder>/files/####/background2.png
<Package Folder>/files/####/bao.png
<Package Folder>/files/####/baoqi.mp3
<Package Folder>/files/####/baoxiang.png
<Package Folder>/files/####/begin.mp3
<Package Folder>/files/####/beijing.jpg
<Package Folder>/files/####/bg.mp3
<Package Folder>/files/####/bgm.mp3
<Package Folder>/files/####/biao.plist
<Package Folder>/files/####/biao.png
<Package Folder>/files/####/biaozhi.png
<Package Folder>/files/####/bigBoard.png
<Package Folder>/files/####/bigLight.png
<Package Folder>/files/####/bigLoad.ogg
<Package Folder>/files/####/bigLoad.plist
<Package Folder>/files/####/bigLoad.png
<Package Folder>/files/####/bigMenu.png
<Package Folder>/files/####/bigMenuDisable.png
<Package Folder>/files/####/bigMenuLock.png
<Package Folder>/files/####/bing2.png
<Package Folder>/files/####/bkiSL_GMU-tpLQGW5ArpTErTFmzw80hQVPkbJg==.new
<Package Folder>/files/####/box.plist
<Package Folder>/files/####/box.png
<Package Folder>/files/####/boxBoard.png
<Package Folder>/files/####/boxDie.plist
<Package Folder>/files/####/boxDie.png
<Package Folder>/files/####/boxLight.png
<Package Folder>/files/####/boxOpen.png
<Package Folder>/files/####/boxSure.png
<Package Folder>/files/####/boxSureLock.png
<Package Folder>/files/####/boxTool1.png
<Package Folder>/files/####/boxTool2.png
<Package Folder>/files/####/boxTool3.png
<Package Folder>/files/####/boxTool4.png
<Package Folder>/files/####/boxTool5.png
<Package Folder>/files/####/broken.ogg
<Package Folder>/files/####/broken.plist
<Package Folder>/files/####/broken.png
<Package Folder>/files/####/cha.png
<Package Folder>/files/####/cha1.png
<Package Folder>/files/####/chooseLock.png
<Package Folder>/files/####/chooseMenu.png
<Package Folder>/files/####/chooseReturn.png
<Package Folder>/files/####/chooseReturnLock.png
<Package Folder>/files/####/cloud1.png
<Package Folder>/files/####/cloud2.png
<Package Folder>/files/####/cloud3.png
<Package Folder>/files/####/continueMenu.png
<Package Folder>/files/####/continueMenuLock.png
<Package Folder>/files/####/dutiao.png
<Package Folder>/files/####/dutiao1.png
<Package Folder>/files/####/eG5zLltfHqsNqc8zK37CuSeOBRF3b1as.new
<Package Folder>/files/####/eat.plist
<Package Folder>/files/####/eat.png
<Package Folder>/files/####/enemy2_hurt1.png
<Package Folder>/files/####/enemy3_hurt1.png
<Package Folder>/files/####/enemyDied.mp3
<Package Folder>/files/####/er_28.png
<Package Folder>/files/####/er_30.png
<Package Folder>/files/####/er_cancel.png
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/fEhq218w5HjV8b9gPPjm8g==.new
<Package Folder>/files/####/fX2fXxQZRodKJ892w39iiqnW_a8uHX2s.new
<Package Folder>/files/####/f_guan.png
<Package Folder>/files/####/f_guan1.png
<Package Folder>/files/####/fan.png
<Package Folder>/files/####/fanhuiyouxi.png
<Package Folder>/files/####/fd2d7142-ee54-4b68-b5b3-a4ca76723005.pic.temp
<Package Folder>/files/####/feidao.plist
<Package Folder>/files/####/feidao.png
<Package Folder>/files/####/feiqi.plist
<Package Folder>/files/####/feiqi.png
<Package Folder>/files/####/fireWarnning.png
<Package Folder>/files/####/firework.plist
<Package Folder>/files/####/firework.png
<Package Folder>/files/####/fly.plist
<Package Folder>/files/####/fly.png
<Package Folder>/files/####/fuhuo.plist
<Package Folder>/files/####/fuhuo.png
<Package Folder>/files/####/g_an.png
<Package Folder>/files/####/g_lian.png
<Package Folder>/files/####/gm.png
<Package Folder>/files/####/gm1.png
<Package Folder>/files/####/go.png
<Package Folder>/files/####/gou.png
<Package Folder>/files/####/grass.png
<Package Folder>/files/####/grass2.png
<Package Folder>/files/####/grass3.png
<Package Folder>/files/####/guang.png
<Package Folder>/files/####/guanka1.png
<Package Folder>/files/####/gui_2.png
<Package Folder>/files/####/hRYpI815Vn8FoBeLsh7uZ6cC2EFwXcOS.new
<Package Folder>/files/####/hinderHurt.mp3
<Package Folder>/files/####/hudun.png
<Package Folder>/files/####/huoyan.plist
<Package Folder>/files/####/huoyan.png
<Package Folder>/files/####/hybw_f.zip
<Package Folder>/files/####/imifire.plist
<Package Folder>/files/####/imifire.png
<Package Folder>/files/####/imifire12.png
<Package Folder>/files/####/imifire3.png
<Package Folder>/files/####/imifire30.png
<Package Folder>/files/####/imifire311.png
<Package Folder>/files/####/imilogo.plist
<Package Folder>/files/####/imilogo.png
<Package Folder>/files/####/imilogo2.plist
<Package Folder>/files/####/imilogo2.png
<Package Folder>/files/####/imilogo3.plist
<Package Folder>/files/####/imilogo3.png
<Package Folder>/files/####/imimain1.plist
<Package Folder>/files/####/imimain1.png
<Package Folder>/files/####/isProtect.png
<Package Folder>/files/####/isProtectLock.png
<Package Folder>/files/####/j.png
<Package Folder>/files/####/jewel.ogg
<Package Folder>/files/####/jewel.png
<Package Folder>/files/####/jewel.tsx
<Package Folder>/files/####/jewel1.png
<Package Folder>/files/####/jewel2.ogg
<Package Folder>/files/####/jewel2.png
<Package Folder>/files/####/jewel3.png
<Package Folder>/files/####/jiasu.png
<Package Folder>/files/####/jinruyouxi.png
<Package Folder>/files/####/jinruyouxi1.png
<Package Folder>/files/####/jisulibao.png
<Package Folder>/files/####/jisulibao1.png
<Package Folder>/files/####/js.png
<Package Folder>/files/####/js2.png
<Package Folder>/files/####/jump.ogg
<Package Folder>/files/####/jump2.ogg
<Package Folder>/files/####/jumpMenu.png
<Package Folder>/files/####/jumpMenuLock.png
<Package Folder>/files/####/jump_new.plist
<Package Folder>/files/####/jump_new.png
<Package Folder>/files/####/kaishi.png
<Package Folder>/files/####/kaishi1.png
<Package Folder>/files/####/keng_28.png
<Package Folder>/files/####/keng_30.png
<Package Folder>/files/####/kxxe.png
<Package Folder>/files/####/laohu.png
<Package Folder>/files/####/ling.png
<Package Folder>/files/####/lingqu.png
<Package Folder>/files/####/loading.png
<Package Folder>/files/####/loadingjiu.png
<Package Folder>/files/####/loge.png
<Package Folder>/files/####/lose.ogg
<Package Folder>/files/####/lq.png
<Package Folder>/files/####/lq1.png
<Package Folder>/files/####/m.png
<Package Folder>/files/####/mVoFcpb7Z2D7f05cY4oW0A==.new
<Package Folder>/files/####/m_back1.png
<Package Folder>/files/####/m_back2.png
<Package Folder>/files/####/m_lose.png
<Package Folder>/files/####/m_tui.png
<Package Folder>/files/####/m_win.png
<Package Folder>/files/####/mainMenuFire3.plist
<Package Folder>/files/####/meng.png
<Package Folder>/files/####/menu.ogg
<Package Folder>/files/####/moreClose.png
<Package Folder>/files/####/moreCloseLock.png
<Package Folder>/files/####/mubiao.png
<Package Folder>/files/####/mubiaoziti.png
<Package Folder>/files/####/musicOff.png
<Package Folder>/files/####/musicOn.png
<Package Folder>/files/####/n_1.png
<Package Folder>/files/####/n_10.png
<Package Folder>/files/####/n_11.png
<Package Folder>/files/####/n_2.png
<Package Folder>/files/####/n_3.png
<Package Folder>/files/####/n_4.png
<Package Folder>/files/####/n_5.png
<Package Folder>/files/####/n_6.png
<Package Folder>/files/####/n_7.png
<Package Folder>/files/####/n_8.png
<Package Folder>/files/####/n_9.png
<Package Folder>/files/####/nextDisable.png
<Package Folder>/files/####/nextMenu.png
<Package Folder>/files/####/nextMenuLock.png
<Package Folder>/files/####/nothing.png
<Package Folder>/files/####/o3eQQPixHixiYZ3aPq0CyUMnideojbiFUTS...4=.new
<Package Folder>/files/####/openBox.ogg
<Package Folder>/files/####/overRestarMenu.png
<Package Folder>/files/####/overRestartMenuLock.png
<Package Folder>/files/####/overReturnMain.png
<Package Folder>/files/####/overReturnMainLock.png
<Package Folder>/files/####/pause.png
<Package Folder>/files/####/pauseBoard.png
<Package Folder>/files/####/pauseLock.png
<Package Folder>/files/####/petLight.plist
<Package Folder>/files/####/petLight.png
<Package Folder>/files/####/petRun.plist
<Package Folder>/files/####/petRun.png
<Package Folder>/files/####/playerLoad.plist
<Package Folder>/files/####/playerLoad.png
<Package Folder>/files/####/player_hurt.png
<Package Folder>/files/####/protect.plist
<Package Folder>/files/####/protect.png
<Package Folder>/files/####/protectMenu.png
<Package Folder>/files/####/protectMenuLock.png
<Package Folder>/files/####/protectTimer.png
<Package Folder>/files/####/protectUse.png
<Package Folder>/files/####/protectUseLock.png
<Package Folder>/files/####/qd.png
<Package Folder>/files/####/quan.png
<Package Folder>/files/####/quit_x.png
<Package Folder>/files/####/qx.png
<Package Folder>/files/####/rWfNvuada_6fkPRArUbWsb52Pls=.new
<Package Folder>/files/####/restartMenu.png
<Package Folder>/files/####/restartMenuLock.png
<Package Folder>/files/####/returnMenu.png
<Package Folder>/files/####/returnMenuLock.png
<Package Folder>/files/####/run.plist
<Package Folder>/files/####/run.png
<Package Folder>/files/####/runner_info.prop.new
<Package Folder>/files/####/sc.png
<Package Folder>/files/####/setMenu.png
<Package Folder>/files/####/setMenuLock.png
<Package Folder>/files/####/shenmiliwu.png
<Package Folder>/files/####/shenmiliwu1.png
<Package Folder>/files/####/shezhi.png
<Package Folder>/files/####/shezhi1.png
<Package Folder>/files/####/shizi.plist
<Package Folder>/files/####/shizi.png
<Package Folder>/files/####/shiziDie.plist
<Package Folder>/files/####/shiziDie.png
<Package Folder>/files/####/shop.png
<Package Folder>/files/####/shop1.png
<Package Folder>/files/####/shopNum1.png
<Package Folder>/files/####/shopNum2.png
<Package Folder>/files/####/shui.plist
<Package Folder>/files/####/shui.png
<Package Folder>/files/####/signClose.png
<Package Folder>/files/####/signOk.png
<Package Folder>/files/####/sky.png
<Package Folder>/files/####/snow.png
<Package Folder>/files/####/soundOff.png
<Package Folder>/files/####/soundOn.png
<Package Folder>/files/####/task1.png
<Package Folder>/files/####/task10.png
<Package Folder>/files/####/task11.png
<Package Folder>/files/####/task12.png
<Package Folder>/files/####/task2.png
<Package Folder>/files/####/task3.png
<Package Folder>/files/####/task4.png
<Package Folder>/files/####/task5.png
<Package Folder>/files/####/task6.png
<Package Folder>/files/####/task7.png
<Package Folder>/files/####/task8.png
<Package Folder>/files/####/task9.png
<Package Folder>/files/####/taskBoard.png
<Package Folder>/files/####/taskIndex.png
<Package Folder>/files/####/taskTypeDone.png
<Package Folder>/files/####/titleFire12.plist
<Package Folder>/files/####/toastBoard.png
<Package Folder>/files/####/toastNum.png
<Package Folder>/files/####/toolNum.png
<Package Folder>/files/####/tu.plist
<Package Folder>/files/####/tu.png
<Package Folder>/files/####/tuichu.png
<Package Folder>/files/####/vAcFRP9LcVtN-2TfciukMJh_RX8=.new
<Package Folder>/files/####/wending.plist
<Package Folder>/files/####/wending.png
<Package Folder>/files/####/win.ogg
<Package Folder>/files/####/xue.png
<Package Folder>/files/####/xyg.png
<Package Folder>/files/####/xyg_1.png
<Package Folder>/files/####/yeah.png
<Package Folder>/files/####/yeah1.png
<Package Folder>/files/####/yhpk3sqy0Oaqh--cOFlnIWuf0EqxBp_bOScAUg==.new
<Package Folder>/files/####/z.png
<Package Folder>/files/####/z1mq5UNqwj1TF2-B1s21Cmo4SMpYi_jf.new
<Package Folder>/files/####/zadi.mp3
<Package Folder>/files/####/zctz.png
<Package Folder>/files/####/zhu.png
<Package Folder>/files/####/zhuzhu.plist
<Package Folder>/files/####/zhuzhu.png
<Package Folder>/files/####/ziti.png
<Package Folder>/files/.imprint
<Package Folder>/files/CD.png
<Package Folder>/files/a_1.tmx
<Package Folder>/files/a_10.tmx
<Package Folder>/files/a_2.tmx
<Package Folder>/files/a_3.tmx
<Package Folder>/files/a_4.tmx
<Package Folder>/files/a_5.tmx
<Package Folder>/files/a_6.tmx
<Package Folder>/files/a_7.tmx
<Package Folder>/files/a_8.tmx
<Package Folder>/files/a_9.tmx
<Package Folder>/files/app.icf
<Package Folder>/files/bigPay.png
<Package Folder>/files/bigPayNum.png
<Package Folder>/files/cao.png
<Package Folder>/files/cao1.png
<Package Folder>/files/choose.jpg
<Package Folder>/files/choose.tmx
<Package Folder>/files/coin.png
<Package Folder>/files/coin.tsx
<Package Folder>/files/com.s.ypay.apk
<Package Folder>/files/contentIndex.png
<Package Folder>/files/daoju.png
<Package Folder>/files/development.icf
<Package Folder>/files/doneNum.png
<Package Folder>/files/exid.dat
<Package Folder>/files/ground.png
<Package Folder>/files/ground.tsx
<Package Folder>/files/ground3.png
<Package Folder>/files/ground3.tsx
<Package Folder>/files/hurt.png
<Package Folder>/files/index.png
<Package Folder>/files/jump_light.plist
<Package Folder>/files/jump_light.png
<Package Folder>/files/light.png
<Package Folder>/files/load_new.plist
<Package Folder>/files/load_new.png
<Package Folder>/files/luntai.png
<Package Folder>/files/luxian.png
<Package Folder>/files/mao.plist
<Package Folder>/files/muzhuang.png
<Package Folder>/files/muzhuang_2.png
<Package Folder>/files/new_root.png
<Package Folder>/files/new_root.tsx
<Package Folder>/files/rdata_comrlzaocsa.new
<Package Folder>/files/root.plist
<Package Folder>/files/root.png
<Package Folder>/files/runNum.png
<Package Folder>/files/s_1.tmx
<Package Folder>/files/s_10.tmx
<Package Folder>/files/s_2.tmx
<Package Folder>/files/s_3.tmx
<Package Folder>/files/s_4.tmx
<Package Folder>/files/s_5.tmx
<Package Folder>/files/s_6.tmx
<Package Folder>/files/s_7.tmx
<Package Folder>/files/s_8.tmx
<Package Folder>/files/s_9.tmx
<Package Folder>/files/stone.tsx
<Package Folder>/files/temp.zip
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_...RE.xml
<Package Folder>/shared_prefs/6PO_AGJRogTRVIhut8VOFRvbKpl3iGJ5_rws_sp.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/SP_REPLACE_CLASSLOADER_CLASS_NAME.xml
<Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/unknown.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.armsd/####/0586df1a-c4ef-427b-96c9-08cb9356cf6b.res
<SD-Card>/.armsd/####/07d71916-4679-4a77-92b3-97f95846950b.res
<SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
<SD-Card>/.armsd/####/6538f29b-44b8-4589-a983-088f073fa5ed.res
<SD-Card>/.armsd/####/7f0a0199-2aae-4d5d-a84b-ba9edd2b4471.res
<SD-Card>/.armsd/####/8db6d2da-7c57-4077-941c-ba888846c5ec.res
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
<SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
<SD-Card>/.armsd/####/b1bea98a-6786-49b5-98da-236450944747.res
<SD-Card>/.armsd/####/dca037bc-30e4-4ed9-acc6-e0d4e09965d4.res
<SD-Card>/.armsd/####/f2953a54-ce54-4ea4-b408-82878a07ef11.res
<SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
<SD-Card>/.env/.uunique
<SD-Card>/.env/.uunique.new

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh
<Package Folder>/code-7895124/sx-WYz8KPpZIezAn -p <Package> -c com.rlza.ocsa.bfhhbg.tw.tw.ue.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
cat /sys/block/mmcblk0/device/cid
chmod 755 <Package Folder>/.jiagu/libjiagu.so
ls -l /sbin/su
ls -l /system/sbin/su
ls -l /vendor/bin/su
sh <Package Folder>/code-7895124/sx-WYz8KPpZIezAn -p <Package> -c com.rlza.ocsa.bfhhbg.tw.tw.ue.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung

Загружает динамические библиотеки:

cocos2dcpp
libjiagu

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-ECB-NoPadding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Осуществляет доступ к информации об отправленых/принятых смс.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней