Android.DownLoader.3470

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

10658423: mvwlan,7671a395bbb6ae66124b5a84e309ca83,Ctce
1066038311: 104B

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.600.origin
Android.SmsSpy.677.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.SmsSpy.677.origin

Предлагает установить сторонние приложения.

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sdk.qi1####.com:80
TCP(HTTP/1.1) oth.eve.mdt.####.com:8080
TCP(HTTP/1.1) q####.qi1####.com:14302
TCP(HTTP/1.1) q####.qi1####.com:15302
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) qyc####.qi1####.com:8200
TCP(HTTP/1.1) z####.wann####.com:9600
TCP(HTTP/1.1) iekf####.gcj####.cn:80
TCP(HTTP/1.1) 1####.55.16.91:8080
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) 1####.124.104.179:8080
TCP(HTTP/1.1) p4####.b0.upa####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 1####.55.17.147:8080
TCP(HTTP/1.1) 88####.net:88
TCP(HTTP/1.1) p####.nj####.com.####.com:8080
TCP(HTTP/1.1) mon####.uu.qq.com:80
TCP(HTTP/1.1) www.q####.cn:80
TCP(HTTP/1.1) oth.str.mdt.####.com:8080
TCP(TLS/1.0) m.i####.com:443
TCP(TLS/1.0) www.go####.com:443

Запросы DNS:

88####.net
a####.u####.com
hangzho####.oss-cn-####.aliy####.com
iekf####.gcj####.cn
int.d####.s####.####.cn
m.i####.com
mon####.uu.qq.com
mt####.go####.com
oth.eve.mdt.####.com
oth.str.mdt.####.com
p####.nj####.com
p4####.b0.upa####.com
q####.qi1####.com
qyc####.qi1####.com
sdk.qi1####.com
www.go####.com
www.q####.cn
z####.wann####.com
zxc####.wann####.com

Запросы HTTP GET:

88####.net:88/game/cof.do?k=####
hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
iekf####.gcj####.cn/all/40063-C01
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
p####.nj####.com.####.com:8080/png/ic_jyyy.png
p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
p####.nj####.com.####.com:8080/res/novel/app/icon/1.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/2.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/3.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/4.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/5.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/6.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/7.jpg
p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2020.jar
p4####.b0.upa####.com/web/ng/201612/111/360u3ODP.apk
p4####.b0.upa####.com/web/ng/201612/111/c/icon.jpg
p4####.b0.upa####.com/web/ng/201612/111/c/pic0.jpg
p4####.b0.upa####.com/web/ng/201706/321/c/icon.png
p4####.b0.upa####.com/web/ng/201706/321/c/pic0.jpg
p4####.b0.upa####.com/web/ng/201706/321/qqyddq8DgI.apk
p4####.b0.upa####.com/web/ng/201709/446/c/icon.png
p4####.b0.upa####.com/web/ng/201709/446/c/pic0.jpg
p4####.b0.upa####.com/web/ng/201801/649/c/icon.jpg
p4####.b0.upa####.com/web/ng/201801/649/c/pic0.png
p4####.b0.upa####.com/web/ng/201801/649/ttkbbb2eZYU_958998.apk
qyc####.qi1####.com:8200/sdk/file?9jiNTbG####
qyc####.qi1####.com:8200/sdk/file?XThB7p8####
qyc####.qi1####.com:8200/sdk/file?x7YfosZ####
sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar
www.q####.cn/n/dpz/?app=####&uid=####&sv=####&appver=####&osver=####&cve...

Запросы HTTP POST:

88####.net:88/game/centerbanner2.do?ver=####
88####.net:88/game/open.do
88####.net:88/game/start.do?ver=####
a####.u####.com/app_logs
mon####.uu.qq.com/analytics/rqdsync
oth.eve.mdt.####.com:8080/analytics/upload?rid=####&sid=####
oth.str.mdt.####.com:8080/analytics/upload
oth.str.mdt.####.com:8080/analytics/upload?sid=####
q####.qi1####.com:14302/sdk_login?t=####
q####.qi1####.com:15302/sdk_login?t=####
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/DENGTA_META.xml
/data/data/####/beacon_db-journal
/data/data/####/com.qq.reader-1.apk.classes60219346.zip
/data/data/####/eup_db
/data/data/####/eup_db-journal
/data/data/####/hmt_agent_commonutill_com.qq.reader.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting.xml
/data/data/####/multidex.version.xml
/data/data/####/openudid_prefs.xml
/data/data/####/qtsession.xml
<Package Folder>/PaySDK-1.2.16.8-UR_yx.jar
<Package Folder>/app_payload_odex/<Package>.jar
<Package Folder>/app_payload_res/####/._logo_img_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_2.jpg
<Package Folder>/app_payload_res/####/._pg_1.png
<Package Folder>/app_payload_res/####/._pg_2.png
<Package Folder>/app_payload_res/####/._pg_3.png
<Package Folder>/app_payload_res/####/._pic_bg.png
<Package Folder>/app_payload_res/####/._pic_mm_0.jpg
<Package Folder>/app_payload_res/####/._pic_mm_1.jpg
<Package Folder>/app_payload_res/####/._pic_mm_2.jpg
<Package Folder>/app_payload_res/####/._pic_mm_3.jpg
<Package Folder>/app_payload_res/####/._pic_mm_4.jpg
<Package Folder>/app_payload_res/####/._pic_mm_5.jpg
<Package Folder>/app_payload_res/####/._pic_mm_6.jpg
<Package Folder>/app_payload_res/####/._pic_mm_7.jpg
<Package Folder>/app_payload_res/####/._price1.jpg
<Package Folder>/app_payload_res/####/._price3.png
<Package Folder>/app_payload_res/logo_img_0.jpg
<Package Folder>/app_payload_res/maan.so
<Package Folder>/app_payload_res/mm_show_0_0.jpg
<Package Folder>/app_payload_res/mm_show_0_1.jpg
<Package Folder>/app_payload_res/mm_show_0_2.jpg
<Package Folder>/app_payload_res/mm_show_0_3.jpg
<Package Folder>/app_payload_res/mm_show_1_0.jpg
<Package Folder>/app_payload_res/mm_show_1_1.jpg
<Package Folder>/app_payload_res/mm_show_1_2.jpg
<Package Folder>/app_payload_res/mm_show_1_3.jpg
<Package Folder>/app_payload_res/mm_show_2_0.jpg
<Package Folder>/app_payload_res/mm_show_2_1.jpg
<Package Folder>/app_payload_res/mm_show_2_2.jpg
<Package Folder>/app_payload_res/mm_show_2_3.jpg
<Package Folder>/app_payload_res/mm_show_3_0.jpg
<Package Folder>/app_payload_res/mm_show_3_1.jpg
<Package Folder>/app_payload_res/mm_show_3_2.jpg
<Package Folder>/app_payload_res/mm_show_4_0.jpg
<Package Folder>/app_payload_res/mm_show_4_1.jpg
<Package Folder>/app_payload_res/mm_show_4_2.jpg
<Package Folder>/app_payload_res/mm_show_5_0.jpg
<Package Folder>/app_payload_res/mm_show_5_1.jpg
<Package Folder>/app_payload_res/mm_show_5_2.jpg
<Package Folder>/app_payload_res/mm_show_6_0.jpg
<Package Folder>/app_payload_res/mm_show_6_1.jpg
<Package Folder>/app_payload_res/mm_show_6_2.jpg
<Package Folder>/app_payload_res/pg_1.png
<Package Folder>/app_payload_res/pg_2.png
<Package Folder>/app_payload_res/pg_3.png
<Package Folder>/app_payload_res/pic_bg.png
<Package Folder>/app_payload_res/pic_mm_0.jpg
<Package Folder>/app_payload_res/pic_mm_1.jpg
<Package Folder>/app_payload_res/pic_mm_2.jpg
<Package Folder>/app_payload_res/pic_mm_3.jpg
<Package Folder>/app_payload_res/pic_mm_4.jpg
<Package Folder>/app_payload_res/pic_mm_5.jpg
<Package Folder>/app_payload_res/pic_mm_6.jpg
<Package Folder>/app_payload_res/pic_mm_7.jpg
<Package Folder>/app_payload_res/price1.jpg
<Package Folder>/app_payload_res/price3.png
<Package Folder>/app_payload_res/story_btn_read.png
<Package Folder>/app_payload_res/tab1_0.png
<Package Folder>/app_payload_res/tab1_1.png
<Package Folder>/app_payload_res/tab2_0.png
<Package Folder>/app_payload_res/tab2_1.png
<Package Folder>/app_process_lock/1122144285974.59
<Package Folder>/app_process_lock/1122144285974.59 (deleted)
<Package Folder>/app_process_lock/1122144285983.54
<Package Folder>/app_process_lock/1122144285983.54 (deleted)
<Package Folder>/app_process_lock/1122144285998.92
<Package Folder>/app_process_lock/1122144285998.92 (deleted)
<Package Folder>/app_process_lock/1122144286134.14
<Package Folder>/app_process_lock/1122144286134.14 (deleted)
<Package Folder>/app_process_lock/1122144286139.08
<Package Folder>/app_process_lock/1122144286139.08 (deleted)
<Package Folder>/app_process_lock/1122144286289.73
<Package Folder>/app_process_lock/1122144286289.73 (deleted)
<Package Folder>/app_process_lock/1122144286565.21
<Package Folder>/app_process_lock/1122144286565.21 (deleted)
<Package Folder>/app_process_lock/1122144286603.89
<Package Folder>/app_process_lock/1122144286603.89 (deleted)
<Package Folder>/app_process_lock/1122144286639.17
<Package Folder>/app_process_lock/1122144286639.17 (deleted)
<Package Folder>/app_process_lock/1122144286713.78
<Package Folder>/app_process_lock/1122144286713.78 (deleted)
<Package Folder>/app_process_lock/1122144286890.17
<Package Folder>/app_process_lock/1122144286890.17 (deleted)
<Package Folder>/app_process_lock/1122144286972.07
<Package Folder>/app_process_lock/1122144286972.07 (deleted)
<Package Folder>/app_process_lock/1122144287004.93
<Package Folder>/app_process_lock/1122144287004.93 (deleted)
<Package Folder>/app_process_lock/1132.30089999093
<Package Folder>/app_process_lock/1132.30089999093 (deleted)
<Package Folder>/app_process_lock/1132.34542065845
<Package Folder>/app_process_lock/1132.34542065845 (deleted)
<Package Folder>/app_process_lock/1132.38994132597
<Package Folder>/app_process_lock/1132.38994132597 (deleted)
<Package Folder>/app_process_lock/1132.43446199348
<Package Folder>/app_process_lock/1132.43446199348 (deleted)
<Package Folder>/app_process_lock/1132.478982661
<Package Folder>/app_process_lock/1132.478982661 (deleted)
<Package Folder>/app_process_lock/1132.52350332852
<Package Folder>/app_process_lock/1132.52350332852 (deleted)
<Package Folder>/app_process_lock/1132.56802399603
<Package Folder>/app_process_lock/1132.56802399603 (deleted)
<Package Folder>/app_process_lock/161.918512514603
<Package Folder>/app_process_lock/161.918512514603 (deleted)
<Package Folder>/app_process_lock/2325836881852.22
<Package Folder>/app_process_lock/2325836881852.22 (deleted)
<Package Folder>/app_process_lock/2325836882737.2
<Package Folder>/app_process_lock/2325836882737.2 (deleted)
<Package Folder>/app_process_lock/2325836883218.7
<Package Folder>/app_process_lock/2325836883218.7 (deleted)
<Package Folder>/app_process_lock/2325836883737.31
<Package Folder>/app_process_lock/2325836883737.31 (deleted)
<Package Folder>/app_process_lock/2325836883913.46
<Package Folder>/app_process_lock/2325836883913.46 (deleted)
<Package Folder>/app_process_lock/2325836884343.68
<Package Folder>/app_process_lock/2325836884343.68 (deleted)
<Package Folder>/app_process_lock/2325836888463.39
<Package Folder>/app_process_lock/2325836888463.39 (deleted)
<Package Folder>/app_process_lock/261208671340.722
<Package Folder>/app_process_lock/261208671340.722 (deleted)
<Package Folder>/app_process_lock/261208671440.111
<Package Folder>/app_process_lock/261208671440.111 (deleted)
<Package Folder>/app_process_lock/261208671494.187
<Package Folder>/app_process_lock/261208671494.187 (deleted)
<Package Folder>/app_process_lock/261208671552.431
<Package Folder>/app_process_lock/261208671552.431 (deleted)
<Package Folder>/app_process_lock/261208671572.214
<Package Folder>/app_process_lock/261208671572.214 (deleted)
<Package Folder>/app_process_lock/261208671620.531
<Package Folder>/app_process_lock/261208671620.531 (deleted)
<Package Folder>/app_process_lock/261208672083.204
<Package Folder>/app_process_lock/261208672083.204 (deleted)
<Package Folder>/app_process_lock/2965442049072.82
<Package Folder>/app_process_lock/2965442049072.82 (deleted)
<Package Folder>/app_process_lock/2965442049096.47
<Package Folder>/app_process_lock/2965442049096.47 (deleted)
<Package Folder>/app_process_lock/2965442049137.11
<Package Folder>/app_process_lock/2965442049137.11 (deleted)
<Package Folder>/app_process_lock/2965442049494.46
<Package Folder>/app_process_lock/2965442049494.46 (deleted)
<Package Folder>/app_process_lock/2965442049507.5
<Package Folder>/app_process_lock/2965442049507.5 (deleted)
<Package Folder>/app_process_lock/2965442049905.63
<Package Folder>/app_process_lock/2965442049905.63 (deleted)
<Package Folder>/app_process_lock/2965442050633.64
<Package Folder>/app_process_lock/2965442050633.64 (deleted)
<Package Folder>/app_process_lock/2965442050735.85
<Package Folder>/app_process_lock/2965442050735.85 (deleted)
<Package Folder>/app_process_lock/2965442050829.08
<Package Folder>/app_process_lock/2965442050829.08 (deleted)
<Package Folder>/app_process_lock/2965442051026.25
<Package Folder>/app_process_lock/2965442051026.25 (deleted)
<Package Folder>/app_process_lock/2965442051492.38
<Package Folder>/app_process_lock/2965442051492.38 (deleted)
<Package Folder>/app_process_lock/2965442051708.82
<Package Folder>/app_process_lock/2965442051708.82 (deleted)
<Package Folder>/app_process_lock/2965442051795.67
<Package Folder>/app_process_lock/2965442051795.67 (deleted)
<Package Folder>/app_process_lock/3660380.04099951
<Package Folder>/app_process_lock/3660380.04099951 (deleted)
<Package Folder>/app_process_lock/3660380.34145408
<Package Folder>/app_process_lock/3660380.34145408 (deleted)
<Package Folder>/app_process_lock/690284829910.066
<Package Folder>/app_process_lock/690284829910.066 (deleted)
<Package Folder>/app_process_lock/690284830172.717
<Package Folder>/app_process_lock/690284830172.717 (deleted)
<Package Folder>/app_process_lock/690284830315.622
<Package Folder>/app_process_lock/690284830315.622 (deleted)
<Package Folder>/app_process_lock/690284830469.541
<Package Folder>/app_process_lock/690284830469.541 (deleted)
<Package Folder>/app_process_lock/690284830521.821
<Package Folder>/app_process_lock/690284830521.821 (deleted)
<Package Folder>/app_process_lock/690284830649.506
<Package Folder>/app_process_lock/690284830649.506 (deleted)
<Package Folder>/app_process_lock/690284831872.192
<Package Folder>/app_process_lock/690284831872.192 (deleted)
<Package Folder>/app_process_lock/889.37042982576
<Package Folder>/app_process_lock/889.37042982576 (deleted)
<Package Folder>/app_process_lock/889.414950493276
<Package Folder>/app_process_lock/889.414950493276 (deleted)
<Package Folder>/app_process_lock/889.459471160793
<Package Folder>/app_process_lock/889.459471160793 (deleted)
<Package Folder>/app_process_lock/889.503991828309
<Package Folder>/app_process_lock/889.503991828309 (deleted)
<Package Folder>/app_process_lock/889.548512495826
<Package Folder>/app_process_lock/889.548512495826 (deleted)
<Package Folder>/app_process_lock/889.593033163343
<Package Folder>/app_process_lock/889.593033163343 (deleted)
<Package Folder>/app_process_lock/889.637553830859
<Package Folder>/app_process_lock/889.637553830859 (deleted)
<Package Folder>/app_process_lock/889.682074498376
<Package Folder>/app_process_lock/889.682074498376 (deleted)
<Package Folder>/app_process_lock/889.726595165892
<Package Folder>/app_process_lock/889.726595165892 (deleted)
<Package Folder>/cache/.jar
<Package Folder>/databases/a.db
<Package Folder>/databases/a.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/qy_db_pay
<Package Folder>/databases/qy_db_pay-journal
<Package Folder>/databases/twsdk.db
<Package Folder>/databases/twsdk.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/xUtils_http_cache.db
<Package Folder>/databases/xUtils_http_cache.db-journal
<Package Folder>/databases/xUtils_http_cache.db-shm
<Package Folder>/databases/xUtils_http_cache.db-shm (deleted)
<Package Folder>/databases/xUtils_http_cache.db-wal
<Package Folder>/databases/xUtils_http_cookie.db
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/databases/xUtils_http_cookie.db-shm
<Package Folder>/databases/xUtils_http_cookie.db-shm (deleted)
<Package Folder>/databases/xUtils_http_cookie.db-wal
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.imprint
<Package Folder>/files/exid.dat
<Package Folder>/files/getprop
<Package Folder>/files/pid
<Package Folder>/files/umeng_it.cache
<Package Folder>/libzxvps/####/libzxvps.so
<Package Folder>/libzxvps/####/tmp_so
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/unknown.xml
<Package Folder>/shared_prefs/userData.xml
<Package Folder>/shared_prefs/userDatas.xml
<Package Folder>/tmp_jar
<SD-Card>/.Systemp/.cfg
<SD-Card>/.Systemp/device
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/018eac40d9a0bf83976b2b19fc6ce80a
<SD-Card>/Android/####/031f04ef44c86d37888b9206208ab7ff
<SD-Card>/Android/####/03fcfdeaa80fc0d9e507c1231591b3bc
<SD-Card>/Android/####/110b6dcd7a403d3581b21c2d9d50f95c
<SD-Card>/Android/####/155e8c371bcc478c0268b93a9d799c78
<SD-Card>/Android/####/300f50dfb16e035d7ba2ebd4753b36b8
<SD-Card>/Android/####/3ebed89385d4c2fa824c583e1e864706
<SD-Card>/Android/####/507e1ac61205109fcbd9415672708dd2
<SD-Card>/Android/####/614b01e4628d6b78f36743a3105948fe
<SD-Card>/Android/####/641396e85bf54468fe7cee3296fab1be
<SD-Card>/Android/####/791d313ad16c4d8de7d547e7c46844be
<SD-Card>/Android/####/7e365bcb196b60dfa152dd1e209cb485
<SD-Card>/Android/####/82c6e1f492188a993ae1e41eb5f1540f
<SD-Card>/Android/####/897f47697ee1e6f740a2bff65a9d1b9e
<SD-Card>/Android/####/8acf08558ad9a62966ddb70b9a7b29a0
<SD-Card>/Android/####/a5fc328080cee06fdeb19e557a154ddd
<SD-Card>/Android/####/a79cb2fef0da8ab575753557cff42a61
<SD-Card>/Android/####/a7cbfdefe06305428f97708d9a408e7d
<SD-Card>/Android/####/ca2aecb5287afe44c3d3238d869afceb
<SD-Card>/Android/####/fb4f2aac972c020c67c81700d51c9733
<SD-Card>/Android/1.txt.tmp
<SD-Card>/Android/10.txt.tmp
<SD-Card>/Android/11.txt.tmp
<SD-Card>/Android/12.txt.tmp
<SD-Card>/Android/13.txt.tmp
<SD-Card>/Android/15.txt.tmp
<SD-Card>/Android/16.txt.tmp
<SD-Card>/Android/2.txt.tmp
<SD-Card>/Android/3.txt.tmp
<SD-Card>/Android/4.txt.tmp
<SD-Card>/Android/5.txt.tmp
<SD-Card>/Android/6.txt.tmp
<SD-Card>/Android/7.txt.tmp
<SD-Card>/Android/8.txt
<SD-Card>/Android/9.txt.tmp
<SD-Card>/Android/com.molove.mobile.sjwwx.png
<SD-Card>/Android/com.molove.mobile.sjwwx.png.tmp
<SD-Card>/ImgCach/084b3f60810fcac2ca6b1dedc74406a7.cach
<SD-Card>/ImgCach/50fe69d50d15b70be2ff3c83ec176635.cach
<SD-Card>/ImgCach/64f683b3d456f7b058d1f50241bde0df.cach
<SD-Card>/ImgCach/69988bab8ff69a136cdbfac0efd57b5e.cach
<SD-Card>/ImgCach/b42abe178a51e465a36800396c992cf6.cach
<SD-Card>/ImgCach/c1e3ac9e501ad432d25f8eb2ea5e410a.cach
<SD-Card>/ImgCach/e59be6414ad531e7d1e9c024666ec6f4.cach
<SD-Card>/ImgCach/f2e36a4a3342417016672790735afa56.cach
<SD-Card>/QQReader/####/skinlist.db
<SD-Card>/QQReader/####/skinlist.db-journal
<SD-Card>/dp.jar.tmp
<SD-Card>/tmp/####/01cfae9a0b60a71fa8e34693b883fb7f.sds
<SD-Card>/tmp/####/3277e08081eb849010f1206a8e060608.sds
<SD-Card>/tmp/####/f1478824b54c5807ca43785665b5e48f.sds
<SD-Card>/updateApkDemo/FrameCore.jar

Другие:

Запускает следующие shell-скрипты:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
chmod 777 /storage/emulated/0/tmp/<Package>/01cfae9a0b60a71fa8e34693b883fb7f.sds
chmod 777 /storage/emulated/0/tmp/<Package>/3277e08081eb849010f1206a8e060608.sds
chmod 777 /storage/emulated/0/tmp/<Package>/f1478824b54c5807ca43785665b5e48f.sds
chmod 777 <Package Folder>/lib/helper
dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
df
getprop
ls -l /system/bin/su
ps | grep <Package>
sh

Загружает динамические библиотеки:

libhelper
libsmsmanager
libzxvps

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
DES
DES-ECB-NoPadding

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Парсит информацию из смс сообщений.

Осуществляет доступ к информации об отправленых/принятых смс.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней