Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Mobikok.1.origin
- Android.RemoteCode.110.origin
- Android.RemoteCode.88.origin
- Android.Xiny.1.origin
- Android.Xiny.197
- Android.Xiny.202.origin
- Android.Xiny.73.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.RemoteCode.110.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) l####.admobim####.com:80
- TCP(HTTP/1.1) of.okyes####.com:80
- TCP(HTTP/1.1) cel####.com:80
- TCP(HTTP/1.1) syndica####.exoc####.com:80
- TCP(HTTP/1.1) 2####.177.13.68:8288
- TCP(HTTP/1.1) fs.api.4a####.com:80
- TCP(HTTP/1.1) app####.hs.l####.net:80
- TCP(HTTP/1.1) 45.79.1####.126:80
- TCP(HTTP/1.1) 45.79.1####.161:80
- TCP(HTTP/1.1) analy####.amak####.com:80
- TCP(HTTP/1.1) t####.snapbac####.com:80
- TCP(HTTP/1.1) tretras####.com:80
- TCP(HTTP/1.1) l####.adsbt####.com:80
- TCP(HTTP/1.1) skyb####.com:80
- TCP(HTTP/1.1) c####.com:80
- TCP(HTTP/1.1) 45.33.1####.75:80
- TCP(HTTP/1.1) www.zfr####.com:80
- TCP(HTTP/1.1) www.okyes####.com:8081
- TCP(HTTP/1.1) cdn.x####.com:80
- TCP(HTTP/1.1) c####.whatthe####.com:80
- TCP(HTTP/1.1) s####.mob####.b####.com:80
- TCP(HTTP/1.1) c.a####.com:80
- TCP(HTTP/1.1) ct####.traffic####.net:80
- TCP(HTTP/1.1) www.admobim####.com:80
- TCP(HTTP/1.1) api.bi####.com:80
- TCP(HTTP/1.1) api.ki####.com:80
- TCP(HTTP/1.1) secur####.com:80
- TCP(HTTP/1.1) mo.freeind####.com:80
- TCP(HTTP/1.1) w####.link:80
- TCP(HTTP/1.1) ali.f####.cdn.####.com:80
- TCP(HTTP/1.1) olympic####.com:80
- TCP(HTTP/1.1) offence####.accountant:80
- TCP(HTTP/1.1) sty.zk####.com:80
- TCP(HTTP/1.1) amc.jiek####.com:80
- TCP(HTTP/1.1) ud.zk####.com:80
- TCP(HTTP/1.1) cld-se####.com:80
- TCP(HTTP/1.1) 4####.33.37.240:80
- TCP(HTTP/1.1) www.koapk####.com:8081
- TCP(HTTP/1.1) 45.79.1####.241:80
- TCP(HTTP/1.1) akw.e####.space:80
- TCP(HTTP/1.1) tango####.com:80
- TCP(HTTP/1.1) koolmed####.com:80
- TCP(HTTP/1.1) deli####.traffic####.com:80
- TCP(HTTP/1.1) www.mmmmmm####.com:80
- TCP(HTTP/1.1) www.cu####.com:80
- TCP(HTTP/1.1) ad####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) ea.sno####.1####.com:18088
- TCP(HTTP/1.1) www.okyes####.com:8080
- TCP(HTTP/1.1) watch####.com:80
- TCP(SSL/3.0) e####.com:443
- TCP(TLS/1.0) tsyndi####.com:443
- TCP(TLS/1.0) app####.hs.l####.net:443
- TCP(TLS/1.0) api.vu####.com.####.net:443
- TCP(TLS/1.0) cdn.vu####.com.####.net:443
- TCP(TLS/1.0) gl####.app####.com:443
- TCP(TLS/1.0) e####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) wild####.moa####.com.####.net:443
- TCP(TLS/1.0) mobileo####.site:443
- TCP(TLS/1.0) a####.app####.com:443
Запросы DNS:
- 01.analy####.amak####.com
- 02.analy####.amak####.com
- 03.analy####.amak####.com
- 04.analy####.amak####.com
- 05.analy####.amak####.com
- a####.app####.com
- a####.google####.com
- ad####.com
- ads.api.vu####.com
- akw.e####.space
- ali.f####.cdn.####.com
- amc.jiek####.com
- amc.jiek####.com
- analy####.amak####.com
- api.bi####.com
- api.ki####.com
- api.mob####.b####.com
- api.vu####.com
- app####.hs.l####.net
- c####.com
- c####.whatthe####.com
- c.a####.com
- cd####.vu####.com
- cdn.x####.com
- cel####.com
- cld-se####.com
- cldl####.com
- ct####.traffic####.net
- deli####.traffic####.com
- e####.com
- ea.sno####.1####.com
- en.sno####.1####.com
- fs.api.4a####.com
- gl####.app####.com
- hy####.com
- ilv####.com
- koolmed####.com
- l####.admobim####.com
- m####.exoc####.com
- mo.freeind####.com
- mobileo####.site
- of.okyes####.com
- offence####.accountant
- offer####.online
- olympic####.com
- questio####.com
- s####.mob####.b####.com
- secur####.com
- skyb####.com
- sty.zk####.com
- t####.snapbac####.com
- tango####.com
- tsyndi####.com
- ud.zk####.com
- w####.link
- watch####.com
- www.admobim####.com
- www.cu####.com
- www.google-####.com
- www.koapk####.com
- www.mmmmmm####.com
- www.okyes####.com
- www.zfr####.com
- y####.instagi####.com
- z.moa####.com
Запросы HTTP GET:
- ad####.com/ad/visit.php?al=####
- akw.e####.space/index.php?r=####
- akw.e####.space/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pr...
- ali.f####.cdn.####.com/20180106173244-snowfox_v19i154et.jar
- amc.jiek####.com/sdkcp/plugUpdate.php?uid=####&model=####&plugVersion=##...
- amc.jiek####.com/sdkcp/push_msgcp_new.php?uid=####&model=####&plugVersio...
- amc.jiek####.com/sdkcp/sale_static_newcp.php?uid=####&model=####&plugVer...
- amc.jiek####.com/sdkcp/user_visit_appcp.php?uid=####&model=####&plugVers...
- amc.jiek####.com/sdkcp/wappush?uid=####&model=####&imei=####&screen_size...
- analy####.amak####.com/dl.js
- analy####.amak####.com/s.php?c=####
- api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
- api.ki####.com/click?tid=####
- api.ki####.com/express?tid=####
- app####.hs.l####.net/tools/sdk/config/2.2.0/interstitial_config.txt
- c####.com/?a=####&c=####&s1=####&s2=####
- c####.whatthe####.com/?utm_medium=####&utm_campaign=####
- c####.whatthe####.com/?utm_term=####&clickverify=####&utm_content=####
- c####.whatthe####.com/proc.php?7c7e3ea####
- c.a####.com/ck/sl/w6kYOx3c?tfc_id=####&sc=####&pub_click_id=####
- cdn.x####.com/ak/watchmygf/t1/banner-sm-fluid.jpg
- cdn.x####.com/ak/watchmygf/t1/banner-xs.jpg
- cdn.x####.com/ak/watchmygf/t1/btn-download.jpg
- cdn.x####.com/ak/watchmygf/t1/footerLink.jpg
- cdn.x####.com/ak/watchmygf/videos/01.jpg
- cdn.x####.com/ak/watchmygf/videos/02.jpg
- cdn.x####.com/ak/watchmygf/videos/03.jpg
- cdn.x####.com/ak/watchmygf/videos/04.jpg
- cdn.x####.com/ak/watchmygf/videos/05.jpg
- cdn.x####.com/ak/watchmygf/videos/06.jpg
- cdn.x####.com/ak/watchmygf/videos/07.jpg
- cdn.x####.com/ak/watchmygf/videos/08.jpg
- cdn.x####.com/ak/watchmygf/videos/09.jpg
- cdn.x####.com/ak/watchmygf/videos/10.jpg
- cdn.x####.com/ak/watchmygf/videos/11.jpg
- cdn.x####.com/ak/watchmygf/videos/12.gif
- cdn.x####.com/ak/watchmygf/videos/13.jpg
- cdn.x####.com/ak/watchmygf/videos/14.jpg
- cdn.x####.com/ak/watchmygf/videos/15.jpg
- cdn.x####.com/ak/watchmygf/videos/16.jpg
- cdn.x####.com/ak/watchmygf/videos/17.jpg
- cdn.x####.com/ak/watchmygf/videos/18.jpg
- cdn.x####.com/ak/watchmygf/videos/19.jpg
- cdn.x####.com/ak/watchmygf/videos/20.jpg
- cdn.x####.com/ak/watchmygf/videos/21.jpg
- cdn.x####.com/ak/watchmygf/videos/22.jpg
- cdn.x####.com/ak/watchmygf/videos/23.jpg
- cdn.x####.com/ak/watchmygf/videos/24.jpg
- cdn.x####.com/ak/watchmygf/videos/25.jpg
- cdn.x####.com/ak/watchmygf/videos/26.jpg
- cdn.x####.com/ak/watchmygf/videos/27.jpg
- cdn.x####.com/ak/watchmygf/videos/28.gif
- cdn.x####.com/ak/watchmygf/videos/29.jpg
- cdn.x####.com/ak/watchmygf/videos/30.jpg
- cdn.x####.com/ak/watchmygf/videos/31.jpg
- cdn.x####.com/ak/watchmygf/videos/32.jpg
- cdn.x####.com/ak/watchmygf/videos/33.jpg
- cdn.x####.com/ak/watchmygf/videos/34.jpg
- cdn.x####.com/ak/watchmygf/videos/35.jpg
- cdn.x####.com/ak/watchmygf/videos/36.gif
- cdn.x####.com/ak/watchmygf/videos/37.jpg
- cdn.x####.com/ak/watchmygf/videos/38.gif
- cdn.x####.com/ak/watchmygf/videos/39.jpg
- cdn.x####.com/ak/watchmygf/videos/40.jpg
- cdn.x####.com/ak/watchmygf/videos/41.jpg
- cdn.x####.com/ak/watchmygf/videos/42.jpg
- cdn.x####.com/ak/watchmygf/videos/43.jpg
- cdn.x####.com/ak/watchmygf/videos/44.jpg
- cdn.x####.com/ak/watchmygf/videos/45.jpg
- cdn.x####.com/ak/watchmygf/videos/46.jpg
- cdn.x####.com/ak/watchmygf/videos/47.jpg
- cdn.x####.com/ak/watchmygf/videos/48.jpg
- cdn.x####.com/ak/watchmygf/videos/49.jpg
- cdn.x####.com/ak/watchmygf/videos/50.jpg
- cdn.x####.com/ak/watchmygf/videos/51.jpg
- cdn.x####.com/ak/watchmygf/videos/52.jpg
- cdn.x####.com/ak/watchmygf/videos/53.jpg
- cdn.x####.com/ak/watchmygf/videos/54.jpg
- cdn.x####.com/ak/watchmygf/videos/55.jpg
- cdn.x####.com/ak/watchmygf/videos/56.jpg
- cdn.x####.com/ak/watchmygf/videos/57.jpg
- cdn.x####.com/ak/watchmygf/videos/58.jpg
- cdn.x####.com/ak/watchmygf/videos/59.jpg
- cdn.x####.com/ak/watchmygf/videos/60.jpg
- cdn.x####.com/ak/watchmygf/videos/61.jpg
- cdn.x####.com/ak/watchmygf/videos/62.jpg
- cdn.x####.com/ak/watchmygf/videos/63.jpg
- cdn.x####.com/ak/watchmygf/videos/64.jpg
- cdn.x####.com/ak/watchmygf/videos/65.jpg
- cdn.x####.com/ak/watchmygf/videos/66.jpg
- cdn.x####.com/ak/watchmygf/videos/67.jpg
- cdn.x####.com/ak/watchmygf/videos/68.jpg
- cdn.x####.com/ak/watchmygf/videos/69.jpg
- cdn.x####.com/ak/watchmygf/videos/70.jpg
- cdn.x####.com/ak/watchmygf/videos/71.jpg
- cdn.x####.com/ak/watchmygf/videos/72.jpg
- cdn.x####.com/ak/watchmygf/videos/73.jpg
- cdn.x####.com/ak/watchmygf/videos/75.jpg
- cdn.x####.com/ak/watchmygf/videos/76.jpg
- cdn.x####.com/ak/watchmygf/videos/77.jpg
- cdn.x####.com/ak/watchmygf/videos/78.jpg
- cdn.x####.com/ak/watchmygf/videos/79.jpg
- cdn.x####.com/ak/watchmygf/videos/80.jpg
- cdn.x####.com/ak/watchmygf/videos/81.jpg
- cdn.x####.com/ak/watchmygf/videos/82.jpg
- cdn.x####.com/ak/watchmygf/videos/83.jpg
- cdn.x####.com/ak/watchmygf/videos/84.jpg
- cdn.x####.com/ak/watchmygf/videos/85.jpg
- cel####.com/page?cam=####&country=####&pub=####&clickid=####&subid=####
- cld-se####.com/?a=####&c=####&s1=####&s2=####
- cld-se####.com/?a=####&c=####&s1=####&s2=####&ckmguid=####
- ct####.traffic####.net/ctrack?action=####&type=####&id=####&context=####...
- deli####.traffic####.com/retargeting.php?id=####
- koolmed####.com/favicon.ico
- koolmed####.com/r/2820c7cc-05ac-11e8-8171-1144478008e5/0/
- koolmed####.com/r/2820c7cc-05ac-11e8-8171-1144478008e5/1/
- koolmed####.com/r/29c6c4c8-05ac-11e8-9fc4-1146d9929c2f/0/
- koolmed####.com/r/29c6c4c8-05ac-11e8-9fc4-1146d9929c2f/1/
- koolmed####.com/r/3ac70bf2-05ac-11e8-b007-114a0a163991/0/
- koolmed####.com/r/3ac70bf2-05ac-11e8-b007-114a0a163991/1/
- l####.adsbt####.com/c/da57dc555e50572d?s1=####&s2=####&s3=####&j1=####&j...
- of.okyes####.com/redirect?uid=####&sourceid=####&clickid=####
- offence####.accountant/10.jpg
- offence####.accountant/11.jpg
- offence####.accountant/7.jpg
- offence####.accountant/8.jpg
- offence####.accountant/9.jpg
- offence####.accountant/?brand=####&model=####&browser=####&td=####&voluu...
- offence####.accountant/favicon.ico
- offence####.accountant/flag.png
- offence####.accountant/index.html
- offence####.accountant/ip7.png
- offence####.accountant/iphone6.jpg
- offence####.accountant/iphone7.jpg
- offence####.accountant/item1.png
- offence####.accountant/item2.png
- offence####.accountant/item3.png
- offence####.accountant/like.png
- offence####.accountant/search.png
- olympic####.com/?a=####&c=####&s1=####&s2=####
- secur####.com/?a=####&c=####&s1=####&s2=####&ckmguid=####
- skyb####.com/d/80064908fe500415f4e?sub=####&source=####
- skyb####.com/gw?sub=273bc9fe-05ac-11e8-a6a1-06cffb869fca&source=236&url=...
- skyb####.com/l/80064908fe500415f4e?sub=####&source=####&code=####
- syndica####.exoc####.com/tag.php?goal=####
- t####.snapbac####.com/c3759a1a-a2e4-494c-8aeb-dcf9897ad791?pubid=####&ki...
- tango####.com/64358_nl_5587_android?rpm=0.2&fallbackUrl=https://mobileof...
- tretras####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKh...
- tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
- w####.link/click?c=####&tracker=####&ptrack=####
- watch####.com/t/?tracker=####&clickid=####&ref=####&c=####
- watch####.com/t1/css/bootstrap.min.css
- watch####.com/t1/js/bootstrap.min.js
- watch####.com/t1/style.css
- www.cu####.com/20180125141223.gen521_BdJarDex_adtiming_0125.zip
- www.google-####.com/ga.js
- www.google-####.com/r/__utm.gif?utmwv=5.7.1&utms=1&utmn=1598163614&utmhn...
Запросы HTTP POST:
- api.bi####.com/un
- ea.sno####.1####.com:18088/ping
- ea.sno####.1####.com:18088/sdk/api/checklib
- ea.sno####.1####.com:18088/sdk/api/regclient
- fs.api.4a####.com/k/v1.0/hb
- fs.api.4a####.com/k/v1.0/offer/5d555807-10f1-4231-827d-65948057a07f
- fs.api.4a####.com/k/v1.0/track/o
- l####.admobim####.com/surl/api3_status.action
- mo.freeind####.com/detail/getOfferListNew?enc=####
- s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- sty.zk####.com/cc/v1/api?sid=####
- ud.zk####.com/stat?sid=####
- www.admobim####.com/surl/api2_reg.action
- www.koapk####.com:8081/sm/sr/rt/ry
- www.koapk####.com:8081/sm/sr/sp/py
- www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
- www.mmmmmm####.com/osp/oaen_reg.action
- www.okyes####.com:8080/sdk/cb.action
- www.okyes####.com:8080/sdk/td.action
- www.okyes####.com:8081/sdk/nsd.action?b=####
- www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...
- www.zfr####.com/up.do
Изменения в файловой системе:
Создает следующие файлы:
- /data/.xbin/api
- /data/.xbin/bkoatdump_pooj_radish
- /data/.xbin/cid
- /data/.xbin/disp
- /data/.xbin/mid
- /data/.xbin/release
- /data/.xbin/uid
- /data/anr/traces.txt
- /data/local/####/api
- /data/local/####/cid
- /data/local/####/disp
- /data/local/####/mid
- /data/local/####/release
- /data/local/####/uid
- /system/bin/####/api
- /system/bin/####/bkload_jpoo_hd
- /system/bin/####/cid
- /system/bin/####/disp
- /system/bin/####/mid
- /system/bin/####/release
- /system/bin/####/uid
- /system/bin/.install-recovery.luno.sh
- /system/bin/debuggerd
- /system/bin/debuggerd_hulu
- /system/bin/debuggerd_server
- /system/bin/install-recovery.sh
- /system/bin/kcol_ysy
- /system/bin/oatdump_pooj_radish
- /system/etc/install-cm-recovery.sh
- /system/etc/install-recovery-2.sh
- /system/etc/install-recovery.sh
- /system/etc/install_recovery.sh
- /system/xbin/.kugua
- /system/xbin/load_jpoo_hd
- /system/xbin/supolicy
- <Package Folder>/app_DEX_OPT/05822759.dex
- <Package Folder>/app_DEX_OPT/15466758.dex
- <Package Folder>/app_DEX_OPT/41415436.dex
- <Package Folder>/app_DEX_OPT/44436379.dex
- <Package Folder>/app_DEX_OPT/58588670.dex
- <Package Folder>/app_dex/mmx.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/f_000044
- <Package Folder>/cache/####/f_000045
- <Package Folder>/cache/####/f_000046
- <Package Folder>/cache/####/f_000047
- <Package Folder>/cache/####/f_000048
- <Package Folder>/cache/####/f_000049
- <Package Folder>/cache/####/f_00004a
- <Package Folder>/cache/####/f_00004b
- <Package Folder>/cache/####/f_00004c
- <Package Folder>/cache/####/f_00004d
- <Package Folder>/cache/####/f_00004e
- <Package Folder>/cache/####/f_00004f
- <Package Folder>/cache/####/f_000050
- <Package Folder>/cache/####/f_000051
- <Package Folder>/cache/####/f_000052
- <Package Folder>/cache/####/f_000053
- <Package Folder>/cache/####/f_000054
- <Package Folder>/cache/####/f_000055
- <Package Folder>/cache/####/f_000056
- <Package Folder>/cache/####/f_000057
- <Package Folder>/cache/####/f_000058
- <Package Folder>/cache/####/f_000059
- <Package Folder>/cache/####/index
- <Package Folder>/com.init.env/####/AD_ID_SPINFO.xml
- <Package Folder>/com.init.env/####/debuggerd_hulu
- <Package Folder>/com.init.env/####/elfm
- <Package Folder>/com.init.env/####/elfm1510833298630.zip
- <Package Folder>/com.init.env/####/forever.sh
- <Package Folder>/com.init.env/####/install-recovery.sh
- <Package Folder>/com.init.env/####/kcol_ysy
- <Package Folder>/com.init.env/####/load_jpoo_hd
- <Package Folder>/com.init.env/####/oatdump_pooj_radish
- <Package Folder>/com.init.env/####/supolicy
- <Package Folder>/com.init.env/####/toolbox
- <Package Folder>/com.init.env/####/toolbox1510833298971.zip
- <Package Folder>/databases/adblib.db-journal
- <Package Folder>/databases/bdownloaders.db-journal
- <Package Folder>/databases/database.db-journal
- <Package Folder>/databases/db_snowfox.db
- <Package Folder>/databases/db_snowfox.db-journal
- <Package Folder>/databases/my.db
- <Package Folder>/databases/my.db-journal
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/databases/rtr.db
- <Package Folder>/databases/rtr.db-journal
- <Package Folder>/databases/snowfoxad_msg.db
- <Package Folder>/databases/snowfoxad_msg.db-journal
- <Package Folder>/databases/swith1014.db-journal
- <Package Folder>/databases/vungle-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/-188828598
- <Package Folder>/files/####/-188828598.data
- <Package Folder>/files/####/05822759.apk
- <Package Folder>/files/####/15466758.apk
- <Package Folder>/files/####/41415436.apk
- <Package Folder>/files/####/44436379.apk
- <Package Folder>/files/####/58588670.apk
- <Package Folder>/files/####/N2026.data
- <Package Folder>/files/####/dk363.data
- <Package Folder>/files/####/dk941.data
- <Package Folder>/files/####/dk952.data
- <Package Folder>/files/####/fiwmw
- <Package Folder>/files/####/ja201801152050.data
- <Package Folder>/files/####/pgbwaa
- <Package Folder>/files/201712201050.apk
- <Package Folder>/files/SW01.jar
- <Package Folder>/files/c201712201050.apk
- <Package Folder>/files/cc.jar
- <Package Folder>/files/conf.dat
- <Package Folder>/files/d.zip
- <Package Folder>/files/d.zip (deleted)
- <Package Folder>/files/dtemp.apk
- <Package Folder>/files/google.db
- <Package Folder>/files/lib.dat
- <Package Folder>/files/mesosphere.jar
- <Package Folder>/files/ob1.zip
- <Package Folder>/files/snowfox_v19i.jar
- <Package Folder>/p.dk363/####/forever.sh
- <Package Folder>/p.dk363/####/krcfg.txt
- <Package Folder>/p.dk363/####/krmain
- <Package Folder>/p.dk363/####/krmain1510833299803.zip
- <Package Folder>/p.dk363/####/krsdk.cert
- <Package Folder>/p.dk941/####/forever.sh
- <Package Folder>/p.dk941/####/krcfg.txt
- <Package Folder>/p.dk941/####/krmain
- <Package Folder>/p.dk941/####/krmain1510833350746.zip
- <Package Folder>/p.dk941/####/krsdk.cert
- <Package Folder>/p.dk952/####/forever.sh
- <Package Folder>/p.dk952/####/krcfg.txt
- <Package Folder>/p.dk952/####/krmain
- <Package Folder>/p.dk952/####/krmain1510833328624.zip
- <Package Folder>/p.dk952/####/krsdk.cert
- <Package Folder>/shared_prefs/20160121.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/ActivatePreUtil.xml
- <Package Folder>/shared_prefs/AdsBusiness-data.xml
- <Package Folder>/shared_prefs/BusinessPreUtil.xml
- <Package Folder>/shared_prefs/LoginPreUtil.xml
- <Package Folder>/shared_prefs/MobikokCache_Type_1.xml
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml (deleted)
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak (deleted)
- <Package Folder>/shared_prefs/OfferPreUtil.xml
- <Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- <Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
- <Package Folder>/shared_prefs/SPS_file.xml
- <Package Folder>/shared_prefs/SPS_file.xml (deleted)
- <Package Folder>/shared_prefs/SpZvPrefs.xml
- <Package Folder>/shared_prefs/VUNGLE_PUB_APP_INFO.xml
- <Package Folder>/shared_prefs/af.xml
- <Package Folder>/shared_prefs/af.xml.bak
- <Package Folder>/shared_prefs/aps.xml
- <Package Folder>/shared_prefs/aps.xml.bak
- <Package Folder>/shared_prefs/apsad.xml
- <Package Folder>/shared_prefs/apscomm.xml
- <Package Folder>/shared_prefs/cn_rs.xml
- <Package Folder>/shared_prefs/device_info.xml
- <Package Folder>/shared_prefs/hunter_config.xml
- <Package Folder>/shared_prefs/isupdate.xml
- <Package Folder>/shared_prefs/lib_shared_preferences.xml
- <Package Folder>/shared_prefs/lib_shared_preferences.xml.bak
- <Package Folder>/shared_prefs/m_cfg.xml
- <Package Folder>/shared_prefs/m_cfg.xml.bak
- <Package Folder>/shared_prefs/m_cfg.xml.bak (deleted)
- <Package Folder>/shared_prefs/ops_data.xml
- <Package Folder>/shared_prefs/other_config.xml
- <Package Folder>/shared_prefs/s_sdk_pro_pref.xml
- <Package Folder>/shared_prefs/service_config.xml
- <Package Folder>/shared_prefs/sharepreference_common_record.xml
- <Package Folder>/shared_prefs/sharepreference_url_param.xml
- <Package Folder>/shared_prefs/snowfoxprf.xml
- <Package Folder>/shared_prefs/sp_cache.xml
- <Package Folder>/shared_prefs/sp_config.xml
- <Package Folder>/shared_prefs/t_ini.xml
- <Package Folder>/shared_prefs/t_ini.xml (deleted)
- <Package Folder>/shared_prefs/t_ini.xml.bak
- <Package Folder>/shared_prefs/t_ini.xml.bak (deleted)
- <Package Folder>/shared_prefs/upgrade_config.xml
- <SD-Card>/.androidsystem/####/gads.db
- <SD-Card>/APPMarket/####/204102004.jpg.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/app_icon.jpg
- <SD-Card>/Android/####/app_store.gif
- <SD-Card>/Android/####/dev_f53bc04.txt
- <SD-Card>/Android/####/download_arrow.png
- <SD-Card>/Android/####/exit_button_light.png
- <SD-Card>/Android/####/exit_button_pressed.png
- <SD-Card>/Android/####/imei.txt
- <SD-Card>/Android/####/index.html
- <SD-Card>/Android/####/landscape.jpg
- <SD-Card>/Android/####/localVideo.mp4
- <SD-Card>/Android/####/portrait.jpg
- <SD-Card>/Android/####/postRoll.zip
- <SD-Card>/Android/####/postroll-script.js
- <SD-Card>/Android/####/postroll-style.css
- <SD-Card>/Android/####/privacy_button_extension_light_mode.png
- <SD-Card>/Android/####/privacy_button_light_mode.png
- <SD-Card>/Android/####/star_empty.png
- <SD-Card>/Android/####/star_full.png
- <SD-Card>/Android/####/star_half.png
- <SD-Card>/Android/####/ua.dat
- <SD-Card>/Android/####/vungle_logo_light.png
- <SD-Card>/Log/Log_2017_11_16.txt
- <SD-Card>/LogG/####/sp
- <SD-Card>/baidu/####/journal
- <SD-Card>/baidu/####/journal.tmp
- <SD-Card>/baidu/.cuid
- <SD-Card>/test1510833294562
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/sh <Package Folder>/p.dk363/files/forever.sh
- c201712201050.apk -p <Package> -c <Package>:boson
- chmod 0755 <Package Folder>/com.init.env
- chmod 0777 <Package Folder>/com.init.env/files/elfm
- chmod 0777 <Package Folder>/com.init.env/files/forever.sh
- chmod 0777 <Package Folder>/com.init.env/files/toolbox
- chmod 0777 <Package Folder>/p.dk363/files/forever.sh
- chmod 0777 <Package Folder>/p.dk363/files/krmain
- chmod 0777 <Package Folder>/p.dk363/files/krsdk.cert
- chmod 0777 <Package Folder>/p.dk941/files/forever.sh
- chmod 0777 <Package Folder>/p.dk952/files/forever.sh
- chmod 0777 <Package Folder>/p.dk952/files/krmain
- chmod 6777 <Package Folder>/files/c201712201050.apk
- chmod 777 <Package Folder>/p.dk363/files/krcfg.txt
- chmod 777 <Package Folder>/p.dk941/files/krcfg.txt
- chmod 777 <Package Folder>/p.dk952/files/krcfg.txt
- load_jpoo_hd
- load_jpoo_hd -c id
- logcat -d -v time
- ls -l /system/bin/su
- ps
- sh
- sh /system/bin/load_jpoo_hd
- sh /system/bin/load_jpoo_hd -c id
- su
- su -c id
Загружает динамические библиотеки:
- com.beautiful
- fiwmw
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-NoPadding
- AES-ECB-PKCS5Padding
- desede-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES
Использует повышенные привилегии.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
