Android.Packed.35726

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.589.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h####.a####.com:80
TCP(HTTP/1.1) kvt####.m####.a####.com:80
TCP(HTTP/1.1) t####.dmp.y####.net:80
TCP(HTTP/1.1) www.a####.com.####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) nb4052-####.a####.com:80
TCP(HTTP/1.1) nb3197-####.a####.com:80
TCP(HTTP/1.1) c46.a####.com:80
TCP(HTTP/1.1) nb3198-####.a####.com:80
TCP(HTTP/1.1) qs.lago####.com:8982
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) sdk.st####.y####.com:80
TCP(HTTP/1.1) aos.w####.y####.net:80
TCP(HTTP/1.1) a####.a####.com:80
TCP(HTTP/1.1) c47.a####.com:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) nb3196-####.a####.com:80
TCP(HTTP/1.1) s####.gw.y####.####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) res11-a####.we####.cn.####.com:80
TCP(HTTP/1.1) nb4050-####.a####.com:80
TCP(HTTP/1.1) cs229-####.a####.com:80
TCP(HTTP/1.1) nb4500-####.a####.com:80
TCP(HTTP/1.1) au.y####.net:80
TCP(HTTP/1.1) nb3201-####.a####.com:80
TCP(HTTP/1.1) nb3194-####.a####.com:80
TCP(HTTP/1.1) cdn.app.e####.####.com:80
TCP(HTTP/1.1) app.w####.cn:80
TCP(HTTP/1.1) fu1.a####.com:80
TCP(HTTP/1.1) s.y####.net:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(TLS/1.0) c####.im.ta####.com:443
TCP(TLS/1.0) y####.e####.top:443
TCP(TLS/1.0) i####.ww.ta####.com:443
UDP 2####.0.0.1:9998

Запросы DNS:

7####.nd####.y####.com
a####.a####.com
a####.m.ta####.com
a####.u####.com
aos.w####.y####.net
app.w####.cn
au.y####.net
c####.im.ta####.com
c46.a####.com
c47.a####.com
cdn.app.e####.top
cdn.app.h####.top
cdn.game####.org
cdn.img.h####.top
cs229-####.a####.com
fu1.a####.com
g####.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
i####.ww.ta####.com
ip.ta####.com
j####.a####.com
kvt####.m####.a####.com
m####.a####.com
m.a####.com
nb3194-####.a####.com
nb3194-####.a####.com
nb3196-####.a####.com
nb3196-####.a####.com
nb3197-####.a####.com
nb3198-####.a####.com
nb3201-####.a####.com
nb4050-####.a####.com
nb4052-####.a####.com
nb4500-####.a####.com
policyc####.a####.com
qs.lago####.com
res.we####.cn
res11-a####.we####.cn
s####.gw.y####.net
s.y####.net
sdk.st####.y####.com
so.a####.com
t####.dmp.y####.net
www.a####.com
x####.a####.com
y####.e####.top

Запросы HTTP GET:

a####.a####.com/atiws/atiapp?category=####&platform=####&appver=####&gam...
a####.a####.com/atiws/atiappcommon?platform=####&appver=####&gameid=####...
aos.w####.y####.net/v3/zip_upd?s=####
app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
au.y####.net/offer/dist/aos/pkg/2.6.1/offers_2.6.1.zip
c46.a####.com/user/382/29276382/1006/card/47414700/47414700_400.jpg
c46.a####.com/user/985/33440985/1006/card/47412907/47412907_800.jpg
c46.a####.com/user/985/33440985/1006/card/47412907/info.xml
c47.a####.com/user/757/9085757/1005/card/47409316/47409316_800.jpg
cdn.app.e####.####.com/sfile/201711/16/all/cp_V3.0.0.txt
cdn.app.e####.####.com/upload/201801/25/app/20180125152657630.apk
cdn.app.e####.####.com/upload/201801/25/img/20180125152645347.png
cdn.app.e####.####.com/upload/201801/26/app/20180126173705509.apk
cdn.app.e####.####.com/upload/201801/26/img/20180126173702464.png
cdn.game####.org/strategy/UnknownDev
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/larger4.3
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.game####.org/strategy/symlink-adbd
cs229-####.a####.com/user/20/21066020/1006/card/47414820/47414820_400.jpg
fu1.a####.com/account/116/43486116/account/43486116_normal.jpg
fu1.a####.com/account/985/33440985/account/33440985_normal.jpg
h####.a####.com/user/116/43486116/1004/card/47412809/47412809_800.jpg
h####.a####.com/user/116/43486116/1004/card/47412809/card.mp4?l=####
h####.a####.com/user/116/43486116/1004/card/47412809/info.xml
h####.a####.com/user/20/21066020/1006/card/47414820/47414820_400.jpg
h####.a####.com/user/382/29276382/1006/card/47414700/47414700_400.jpg
h####.a####.com/user/485/31201485/1004/card/47409081/47409081_800.jpg
h####.a####.com/user/757/9085757/1005/card/47409316/47409316_800.jpg
h####.a####.com/user/808/16730808/1006/card/47414566/47414566_400.jpg
h####.a####.com/user/985/33440985/1006/card/47412907/47412907_800.jpg
h####.a####.com/user/985/33440985/1006/card/47412907/card.mp4?l=####
h####.a####.com/user/985/33440985/1006/card/47412907/info.xml
h####.a####.com/user/987/9642987/1005/card/47414148/47414148_800.jpg
ip.ta####.com/service/getIpInfo2.php?ip=####
kvt####.m####.a####.com/kvinfo.php
nb3194-####.a####.com/user/116/43486116/1004/card/47412809/info.xml
nb3194-####.a####.com/user/808/16730808/1006/card/47414566/47414566_400....
nb3196-####.a####.com/user/757/9085757/1005/card/47409316/47409316_800.jpg
nb3196-####.a####.com/user/985/33440985/1006/card/47412907/info.xml
nb3197-####.a####.com/user/485/31201485/1004/card/47409081/47409081_800....
nb3198-####.a####.com/user/382/29276382/1006/card/47414700/47414700_400....
nb3201-####.a####.com/user/985/33440985/1006/card/47412907/47412907_800....
nb4050-####.a####.com/user/116/43486116/1004/card/47412809/card.mp4?l=##...
nb4052-####.a####.com/user/987/9642987/1005/card/47414148/47414148_800.jpg
nb4500-####.a####.com/user/116/43486116/1004/card/47412809/47412809_800....
qs.lago####.com:8982/loadtime.shtml?clientIp=&st=android&lt=5852&fip=183...
qs.lago####.com:8982/loadtime.shtml?clientIp=&st=android&lt=7299&fip=61....
qs.lago####.com:8982/notify.shtml?saddr=aipai-android565656&definition=4...
qs.lago####.com:8982/notify.shtml?saddr=jhc-android565656&definition=480...
res11-a####.we####.cn.####.com/aipai/page/pic/15171518811317975d90215171...
res11-a####.we####.cn.####.com/aipai/page/pic/15172285607455335d90215172...
res11-a####.we####.cn.####.com/aipai/page/pic/1517228629704149283ab15172...
res11-a####.we####.cn.####.com/user/985/33440985/1006/card/47412907/card...
s####.gw.y####.####.com/aos/v3/initf?s=####
s####.gw.y####.####.com/stat/v3/udt2?appid=####&s=####
s.y####.net/stat/aos/v3/pkc?s=####
s.y####.net/stat/aos/v3/pku?s=####
sdk.st####.y####.com/core/aos-dex/1701/7011/6f830529.jar
sdk.st####.y####.com/core/aos-so/1611/7000/ad389c56.so
www.a####.com.####.com/api/aipaiApp_action-getCommentNew_mobile-1_type-2...
www.a####.com.####.com/api/framework/adConf/35?platform=####&appver=####...
www.a####.com.####.com/api/framework/jifen/enter/35?platform=####&appver...
www.a####.com.####.com/api/hot/bannerItem/661?platform=####&appver=####&...
www.a####.com.####.com/api/hot/titleItem/662?platform=####&appver=####&o...
www.a####.com.####.com/api/hot/videos/12541?appId=####&xifenId=####&plat...
www.a####.com.####.com/api/jifen/firstInstallInit?platform=####&appver=#...
www.a####.com.####.com/api/search/searchWord/35?platform=####&appver=###...
www.a####.com.####.com/api/specialTopic/itemList/664?platform=####&appve...
www.a####.com.####.com/app/www/templates/cdn_policy_telecom.txt?platform...
www.a####.com.####.com/common/img/upload/xifen/1482998127_603.png
www.a####.com.####.com/common/img/upload/xifen/1482998140_678.png
www.a####.com.####.com/common/img/upload/xifen/1482998153_427.jpg
www.a####.com.####.com/common/img/upload/xifen/1482998168_150.png
www.a####.com.####.com/common/img/upload/xifen/1483429773_541.png
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&app=##...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&os=###...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&platfo...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&test=#...
www.a####.com.####.com/mobile/apps/apps_module-badDomain.html
www.a####.com.####.com/pc/operator

Запросы HTTP POST:

a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
app.w####.cn/action/user_info
kvt####.m####.a####.com/i.gif
t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
t####.dmp.y####.net/v2/android/pkgtime?rt=####&sign=####

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/Matrix
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/ddexe
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/debuggerd
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/fileWork
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/insta...ery.sh
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/pidof
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/su
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/supolicy
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/toolbox
<Package Folder>/app_017b5400-3b94-49ea-87f8-6c425a40568f/wsroot.sh
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/Matrix
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/ddexe
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/debuggerd
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/fileWork
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/insta...ery.sh
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/pidof
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/su
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/supolicy
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/toolbox
<Package Folder>/app_5c371b54-49a9-44a3-9b3e-3f91aae0c7ca/wsroot.sh
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/Matrix
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/ddexe
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/debuggerd
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/device.db
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/fileWork
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/insta...ery.sh
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/pidof
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/root3
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/su
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/supolicy
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/toolbox
<Package Folder>/app_7509ba5d-2534-4281-a6e1-ead1c74ebffd/wsroot.sh
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/Matrix
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/ddexe
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/debuggerd
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/fileWork
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/insta...ery.sh
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/pidof
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/su
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/supolicy
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/toolbox
<Package Folder>/app_75ccd732-d682-4a2c-80ce-712103b86a2b/wsroot.sh
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/Matrix
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/ddexe
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/debuggerd
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/fileWork
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/insta...ery.sh
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/pidof
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/su
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/supolicy
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/toolbox
<Package Folder>/app_83f0b38a-e26c-47b6-a972-985d2bb2997f/wsroot.sh
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/Matrix
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/ddexe
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/debuggerd
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/fileWork
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/insta...ery.sh
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/pidof
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/su
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/supolicy
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/toolbox
<Package Folder>/app_8a793ab1-7f04-491b-8535-7f91040aae70/wsroot.sh
<Package Folder>/app_ee9f1ff0-393a-4e9e-9b28-796b9a406950/9ccc0...75.jar
<Package Folder>/app_ee9f1ff0-393a-4e9e-9b28-796b9a406950/f23ec...f20752
<Package Folder>/app_libs/libabcdefgh.so.new
<Package Folder>/app_libs/ymdex.jar
<Package Folder>/app_libs/ymdex.jar.new
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
<Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
<Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
<Package Folder>/app_subox/c61913b615fb6224701377a119081f36
<Package Folder>/app_subox_download/07ce554b-62c8-4546-88b7-dd2d0ea2187f
<Package Folder>/app_subox_download/8b7197ec-0a74-4c91-88e9-55b0482ee763
<Package Folder>/app_subox_download/ab792734-8066-4923-af2c-14b009f9a0e9
<Package Folder>/app_subox_download/ad09901d-e4f7-4745-b279-849d400d4261
<Package Folder>/app_subox_download/ca3ce990-2315-4e4e-b6ee-104276a5aeac
<Package Folder>/app_subox_download/ce913d7e-d85f-4d97-95d8-daf2d4921ef9
<Package Folder>/app_subox_download/d40c8acb-ec90-450c-be0d-a095c9adcd51
<Package Folder>/app_subox_download/e744be2d-08e1-4583-b7c2-867c43348460
<Package Folder>/cache/####/0591fca9c3a8927e5948bf534d2a558c8b7....0.tmp
<Package Folder>/cache/####/0735b93f859feabeebf0a26332ddadb76ac....0.tmp
<Package Folder>/cache/####/53663b44199ebfe71572ef2cceb5d407a44....0.tmp
<Package Folder>/cache/####/5cc232554739957fbea32a52096ade2db4a....0.tmp
<Package Folder>/cache/####/6bc57eb68720b614ab45c7805c2956b0d3f....0.tmp
<Package Folder>/cache/####/6f70d7d32b5997851f1db450ad450342ccf....0.tmp
<Package Folder>/cache/####/7b629d37a8599ccd085463095f67e0a2667....0.tmp
<Package Folder>/cache/####/878321af1e18fbc676b3b9b1295f17fe399...c46c.0
<Package Folder>/cache/####/87c813ce497d6aa55afda329a7dae5eea03....0.tmp
<Package Folder>/cache/####/8ec833ccb6c56dc6f51dccb477f21c576bd....0.tmp
<Package Folder>/cache/####/abbe76870d29f9169cc74513c4dc62bbe63....0.tmp
<Package Folder>/cache/####/beef06084026662de89e2c91ea2e0be6012....0.tmp
<Package Folder>/cache/####/c9bc5a063878c6fb36fafe0ee5b5139ed9d....0.tmp
<Package Folder>/cache/####/ca9a940bd9dc59a657d089a684fd9a4587d....0.tmp
<Package Folder>/cache/####/e39f19ade025e6288a229d6ae31354110ed....0.tmp
<Package Folder>/cache/####/f1c1ec341865f080010e78087790302ac7e....0.tmp
<Package Folder>/cache/####/f82f4acd0334def261159a93fe8bd7af327....0.tmp
<Package Folder>/cache/####/fafb680f793514513956febf52a025e0b1f....0.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/13a992dde8efb4fa1d6c91a624ae90cd.0.tmp
<Package Folder>/cache/13a992dde8efb4fa1d6c91a624ae90cd.1.tmp
<Package Folder>/cache/19da36368654b18a07286cb0aac50992.0.tmp
<Package Folder>/cache/19da36368654b18a07286cb0aac50992.1.tmp
<Package Folder>/cache/4c2ffbd23b29bcfdd8189a6401dda874.0.tmp
<Package Folder>/cache/4c2ffbd23b29bcfdd8189a6401dda874.1.tmp
<Package Folder>/cache/6538a28cabf0729a76a6ab5d5943a986.0.tmp
<Package Folder>/cache/6538a28cabf0729a76a6ab5d5943a986.1.tmp
<Package Folder>/cache/7ae02e8baf7e5127700fa8befa6418d7.0.tmp
<Package Folder>/cache/7ae02e8baf7e5127700fa8befa6418d7.1.tmp
<Package Folder>/cache/V3.0.0.txt
<Package Folder>/cache/a2ad72045ec4b0cf06609909919b9d27.0.tmp
<Package Folder>/cache/a2ad72045ec4b0cf06609909919b9d27.1.tmp
<Package Folder>/cache/aa38f52e7e95ff336dba5fda55535a71.0.tmp
<Package Folder>/cache/aa38f52e7e95ff336dba5fda55535a71.1.tmp
<Package Folder>/cache/c3b9db6452ff40321dee0efd31538f2e.0.tmp
<Package Folder>/cache/c3b9db6452ff40321dee0efd31538f2e.1.tmp
<Package Folder>/cache/d7e0a6854ebe1c50ed90721895b4b987.0.tmp
<Package Folder>/cache/d7e0a6854ebe1c50ed90721895b4b987.1.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.0.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.1.tmp
<Package Folder>/cache/journal.tmp
<Package Folder>/databases/OxgHkj2lz09F
<Package Folder>/databases/OxgHkj2lz09F-journal
<Package Folder>/databases/P15pKIjsm64m
<Package Folder>/databases/P15pKIjsm64m-journal
<Package Folder>/databases/T1oX0rhhuXWt
<Package Folder>/databases/T1oX0rhhuXWt-journal
<Package Folder>/databases/XKwVoK0huy3R
<Package Folder>/databases/XKwVoK0huy3R-journal
<Package Folder>/databases/aipai.db
<Package Folder>/databases/aipai.db-journal
<Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81
<Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81-journal
<Package Folder>/databases/dce205b1f3598b3cf37eeabfceb296ee-journal
<Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed
<Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed-journal
<Package Folder>/databases/jqIqJYOT3JpT
<Package Folder>/databases/jqIqJYOT3JpT-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/wIU6pTyUBYWX
<Package Folder>/databases/wIU6pTyUBYWX-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/wsUL1uCdKvjD
<Package Folder>/databases/wsUL1uCdKvjD-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/arrow-left.png
<Package Folder>/files/####/arrow-right.png
<Package Folder>/files/####/blank.gif
<Package Folder>/files/####/close-icon.png
<Package Folder>/files/####/config.json
<Package Folder>/files/####/default.png
<Package Folder>/files/####/detail-wx.html
<Package Folder>/files/####/detail-wx.js
<Package Folder>/files/####/detail.html
<Package Folder>/files/####/detail.js
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/feedback.html
<Package Folder>/files/####/feedback.js
<Package Folder>/files/####/form.css
<Package Folder>/files/####/global.js
<Package Folder>/files/####/lists.css
<Package Folder>/files/####/lists.html
<Package Folder>/files/####/lists.js
<Package Folder>/files/####/md5.js
<Package Folder>/files/####/pic_m.png
<Package Folder>/files/####/pic_tips_01.png
<Package Folder>/files/####/pic_tips_02.png
<Package Folder>/files/####/result.png
<Package Folder>/files/####/rule.html
<Package Folder>/files/####/sdetail.html
<Package Folder>/files/####/share.css
<Package Folder>/files/####/share.html
<Package Folder>/files/####/share.js
<Package Folder>/files/####/sprite-face.png
<Package Folder>/files/####/sprite-icons.png
<Package Folder>/files/####/sprite-icons2.png
<Package Folder>/files/####/wx-step1.jpg
<Package Folder>/files/####/wx-step2.jpg
<Package Folder>/files/####/wx-step3.jpg
<Package Folder>/files/####/wx-step4.jpg
<Package Folder>/files/####/wx-step5.jpg
<Package Folder>/files/.imprint
<Package Folder>/files/021534f13569db4534c78694a3f60c5e.zip
<Package Folder>/files/CacheTime.dat
<Package Folder>/files/RptKVStrategy.txt
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/aipai.btconfig
<Package Folder>/files/aipai.guid
<Package Folder>/files/oc.jar
<Package Folder>/files/rv.jar
<Package Folder>/files/sp.lock
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppSettings.xml
<Package Folder>/shared_prefs/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
<Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/CookiePersistence.xml
<Package Folder>/shared_prefs/OFFERSCONFIG1.xml
<Package Folder>/shared_prefs/ShowAdFlag.xml
<Package Folder>/shared_prefs/UTCommon.xml
<Package Folder>/shared_prefs/UTMCConf894660063.xml
<Package Folder>/shared_prefs/UTMCLog894660063.xml
<Package Folder>/shared_prefs/ad_system_config.xml
<Package Folder>/shared_prefs/count.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/rx_sf_account.xml
<Package Folder>/shared_prefs/rx_sf_app.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/vbz.xml
<Package Folder>/shared_prefs/ywPrefsTools.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
<SD-Card>/.com.taobao.dp/dd7893586a493dc3
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/373240561418738c721572c1da14b85e
<SD-Card>/Android/####/373240561418738c721572c1da14b85e.ymtf
<SD-Card>/Android/####/9c161e4574ccb
<SD-Card>/Android/####/AppPackage.dat
<SD-Card>/Android/####/CacheTime.dat
<SD-Card>/Android/####/DXTX902KJZX9JASLDJF
<SD-Card>/Android/####/DXTX902KJZX9JASLDJF.ymtf
<SD-Card>/Android/####/SOX90123JSOALK2098SD
<SD-Card>/Android/####/SOX90123JSOALK2098SD.ymtf
<SD-Card>/Android/####/UnPackage.dat
<SD-Card>/Android/####/android
<SD-Card>/Android/####/b.tmp
<SD-Card>/Android/####/c70892c414f417c8f54914bd6e499fd4.apk
<SD-Card>/Android/####/e7b76f4d4607c
<SD-Card>/Android/####/fd3bd0debb382d92a7b8b0a7ad576357.apk
<SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
<SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/kernel_max
cat /proc/cpuinfo | grep Serial
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/c70892c414f417c8f54914bd6e499fd4.apk
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/fd3bd0debb382d92a7b8b0a7ad576357.apk
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
ls -l /system/xbin/su
sh

Загружает динамические библиотеки:

abcdefgh
libjiagu
securitysdk-3.1
xifen

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding
PBEWITHMD5andDES

Использует следующие алгоритмы для расшифровки данных:

DES
DES-CBC-PKCS5Padding
PBEWITHMD5andDES

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней