Android.DownLoader.3473

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

10658999: DH244823
10658999: DH410224

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.600.origin
Android.SmsSpy.677.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.SmsSpy.677.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) iekf####.gcj####.cn:80
TCP(HTTP/1.1) 1####.55.16.91:8080
TCP(HTTP/1.1) q####.qi1####.com:14302
TCP(HTTP/1.1) 1####.55.17.147:8080
TCP(HTTP/1.1) sdk.qi1####.com:80
TCP(HTTP/1.1) q####.qi1####.com:15302
TCP(HTTP/1.1) 88####.net:88
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) p####.nj####.com.####.com:8080
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) 1####.124.104.179:8080
TCP(HTTP/1.1) qyc####.qi1####.com:8200
TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) z####.wann####.com:9600
TCP(HTTP/1.1) p4####.b0.upa####.com:80

Запросы DNS:

88####.net
a####.u####.com
hangzho####.oss-cn-####.aliy####.com
iekf####.gcj####.cn
int.d####.s####.####.cn
p####.nj####.com
p4####.b0.upa####.com
q####.qi1####.com
qyc####.qi1####.com
sdk.qi1####.com
z####.wann####.com
zxc####.wann####.com

Запросы HTTP GET:

88####.net:88/game/cof.do?k=####
hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
iekf####.gcj####.cn/all/40063-C01
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
p####.nj####.com.####.com:8080/png/ic_jyyy.png
p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
p####.nj####.com.####.com:8080/res/novel/app/icon/1.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/2.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/3.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/4.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/5.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/6.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/7.jpg
p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2020.jar
p4####.b0.upa####.com/web/ng/201612/111/360u3ODP.apk
p4####.b0.upa####.com/web/ng/201612/111/c/icon.jpg
p4####.b0.upa####.com/web/ng/201612/111/c/pic0.jpg
p4####.b0.upa####.com/web/ng/201702/139/c/icon.png
p4####.b0.upa####.com/web/ng/201702/139/c/pic0.jpeg
p4####.b0.upa####.com/web/ng/201702/139/top6V6mc_529441.apk
p4####.b0.upa####.com/web/ng/201709/455/c/icon.png
p4####.b0.upa####.com/web/ng/201709/455/c/pic0.jpg
p4####.b0.upa####.com/web/ng/201710/484/c/icon.png
p4####.b0.upa####.com/web/ng/201710/484/c/pic0.jpg
p4####.b0.upa####.com/web/ng/201710/484/skzsdeCvO_299754.apk
qyc####.qi1####.com:8200/sdk/file?eJz7wYC####
sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar

Запросы HTTP POST:

88####.net:88/game/centerbanner2.do?ver=####
88####.net:88/game/open.do
88####.net:88/game/start.do?ver=####
a####.u####.com/app_logs
q####.qi1####.com:14302/sdk_login?t=####
q####.qi1####.com:15302/sdk_login?t=####
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/PaySDK-1.2.16.8-UR_yx.jar
<Package Folder>/app_payload_odex/<Package>.dex
<Package Folder>/app_payload_odex/<Package>.jar
<Package Folder>/app_payload_res/####/._logo_img_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_2.jpg
<Package Folder>/app_payload_res/####/._pg_1.png
<Package Folder>/app_payload_res/####/._pg_2.png
<Package Folder>/app_payload_res/####/._pg_3.png
<Package Folder>/app_payload_res/####/._pic_bg.png
<Package Folder>/app_payload_res/####/._pic_mm_0.jpg
<Package Folder>/app_payload_res/####/._pic_mm_1.jpg
<Package Folder>/app_payload_res/####/._pic_mm_2.jpg
<Package Folder>/app_payload_res/####/._pic_mm_3.jpg
<Package Folder>/app_payload_res/####/._pic_mm_4.jpg
<Package Folder>/app_payload_res/####/._pic_mm_5.jpg
<Package Folder>/app_payload_res/####/._pic_mm_6.jpg
<Package Folder>/app_payload_res/####/._pic_mm_7.jpg
<Package Folder>/app_payload_res/####/._price1.jpg
<Package Folder>/app_payload_res/####/._price3.png
<Package Folder>/app_payload_res/logo_img_0.jpg
<Package Folder>/app_payload_res/maan.so
<Package Folder>/app_payload_res/mm_show_0_0.jpg
<Package Folder>/app_payload_res/mm_show_0_1.jpg
<Package Folder>/app_payload_res/mm_show_0_2.jpg
<Package Folder>/app_payload_res/mm_show_0_3.jpg
<Package Folder>/app_payload_res/mm_show_1_0.jpg
<Package Folder>/app_payload_res/mm_show_1_1.jpg
<Package Folder>/app_payload_res/mm_show_1_2.jpg
<Package Folder>/app_payload_res/mm_show_1_3.jpg
<Package Folder>/app_payload_res/mm_show_2_0.jpg
<Package Folder>/app_payload_res/mm_show_2_1.jpg
<Package Folder>/app_payload_res/mm_show_2_2.jpg
<Package Folder>/app_payload_res/mm_show_2_3.jpg
<Package Folder>/app_payload_res/mm_show_3_0.jpg
<Package Folder>/app_payload_res/mm_show_3_1.jpg
<Package Folder>/app_payload_res/mm_show_3_2.jpg
<Package Folder>/app_payload_res/mm_show_4_0.jpg
<Package Folder>/app_payload_res/mm_show_4_1.jpg
<Package Folder>/app_payload_res/mm_show_4_2.jpg
<Package Folder>/app_payload_res/mm_show_5_0.jpg
<Package Folder>/app_payload_res/mm_show_5_1.jpg
<Package Folder>/app_payload_res/mm_show_5_2.jpg
<Package Folder>/app_payload_res/mm_show_6_0.jpg
<Package Folder>/app_payload_res/mm_show_6_1.jpg
<Package Folder>/app_payload_res/mm_show_6_2.jpg
<Package Folder>/app_payload_res/pg_1.png
<Package Folder>/app_payload_res/pg_2.png
<Package Folder>/app_payload_res/pg_3.png
<Package Folder>/app_payload_res/pic_bg.png
<Package Folder>/app_payload_res/pic_mm_0.jpg
<Package Folder>/app_payload_res/pic_mm_1.jpg
<Package Folder>/app_payload_res/pic_mm_2.jpg
<Package Folder>/app_payload_res/pic_mm_3.jpg
<Package Folder>/app_payload_res/pic_mm_4.jpg
<Package Folder>/app_payload_res/pic_mm_5.jpg
<Package Folder>/app_payload_res/pic_mm_6.jpg
<Package Folder>/app_payload_res/pic_mm_7.jpg
<Package Folder>/app_payload_res/price1.jpg
<Package Folder>/app_payload_res/price3.png
<Package Folder>/app_payload_res/story_btn_read.png
<Package Folder>/app_payload_res/tab1_0.png
<Package Folder>/app_payload_res/tab1_1.png
<Package Folder>/app_payload_res/tab2_0.png
<Package Folder>/app_payload_res/tab2_1.png
<Package Folder>/app_process_lock/1122156525217.06
<Package Folder>/app_process_lock/1122156525217.06 (deleted)
<Package Folder>/app_process_lock/1122156525352.81
<Package Folder>/app_process_lock/1122156525352.81 (deleted)
<Package Folder>/app_process_lock/1122156525354.16
<Package Folder>/app_process_lock/1122156525354.16 (deleted)
<Package Folder>/app_process_lock/1122156525364.86
<Package Folder>/app_process_lock/1122156525364.86 (deleted)
<Package Folder>/app_process_lock/1122156525509.47
<Package Folder>/app_process_lock/1122156525509.47 (deleted)
<Package Folder>/app_process_lock/1122156525711.15
<Package Folder>/app_process_lock/1122156525711.15 (deleted)
<Package Folder>/app_process_lock/1122156525750.33
<Package Folder>/app_process_lock/1122156525750.33 (deleted)
<Package Folder>/app_process_lock/1122156526058.51
<Package Folder>/app_process_lock/1122156526058.51 (deleted)
<Package Folder>/app_process_lock/1122156526131.64
<Package Folder>/app_process_lock/1122156526131.64 (deleted)
<Package Folder>/app_process_lock/1122156526233.43
<Package Folder>/app_process_lock/1122156526233.43 (deleted)
<Package Folder>/app_process_lock/1122156526381.52
<Package Folder>/app_process_lock/1122156526381.52 (deleted)
<Package Folder>/app_process_lock/1132.30089999093
<Package Folder>/app_process_lock/1132.30089999093 (deleted)
<Package Folder>/app_process_lock/1132.34542065845
<Package Folder>/app_process_lock/1132.34542065845 (deleted)
<Package Folder>/app_process_lock/1132.38994132597
<Package Folder>/app_process_lock/1132.38994132597 (deleted)
<Package Folder>/app_process_lock/1132.43446199348
<Package Folder>/app_process_lock/1132.43446199348 (deleted)
<Package Folder>/app_process_lock/1132.478982661
<Package Folder>/app_process_lock/1132.478982661 (deleted)
<Package Folder>/app_process_lock/1132.52350332852
<Package Folder>/app_process_lock/1132.52350332852 (deleted)
<Package Folder>/app_process_lock/1132.56802399603
<Package Folder>/app_process_lock/1132.56802399603 (deleted)
<Package Folder>/app_process_lock/161.918512514603
<Package Folder>/app_process_lock/161.918512514603 (deleted)
<Package Folder>/app_process_lock/2325862250349.38
<Package Folder>/app_process_lock/2325862250349.38 (deleted)
<Package Folder>/app_process_lock/2325862251234.35
<Package Folder>/app_process_lock/2325862251234.35 (deleted)
<Package Folder>/app_process_lock/2325862251715.85
<Package Folder>/app_process_lock/2325862251715.85 (deleted)
<Package Folder>/app_process_lock/2325862252234.46
<Package Folder>/app_process_lock/2325862252234.46 (deleted)
<Package Folder>/app_process_lock/2325862252410.61
<Package Folder>/app_process_lock/2325862252410.61 (deleted)
<Package Folder>/app_process_lock/2325862252840.83
<Package Folder>/app_process_lock/2325862252840.83 (deleted)
<Package Folder>/app_process_lock/2325862256960.54
<Package Folder>/app_process_lock/2325862256960.54 (deleted)
<Package Folder>/app_process_lock/261211520410.442
<Package Folder>/app_process_lock/261211520410.442 (deleted)
<Package Folder>/app_process_lock/261211520509.831
<Package Folder>/app_process_lock/261211520509.831 (deleted)
<Package Folder>/app_process_lock/261211520563.907
<Package Folder>/app_process_lock/261211520563.907 (deleted)
<Package Folder>/app_process_lock/261211520622.151
<Package Folder>/app_process_lock/261211520622.151 (deleted)
<Package Folder>/app_process_lock/261211520641.935
<Package Folder>/app_process_lock/261211520641.935 (deleted)
<Package Folder>/app_process_lock/261211520690.251
<Package Folder>/app_process_lock/261211520690.251 (deleted)
<Package Folder>/app_process_lock/261211521152.924
<Package Folder>/app_process_lock/261211521152.924 (deleted)
<Package Folder>/app_process_lock/2965474393188.22
<Package Folder>/app_process_lock/2965474393188.22 (deleted)
<Package Folder>/app_process_lock/2965474393546.96
<Package Folder>/app_process_lock/2965474393546.96 (deleted)
<Package Folder>/app_process_lock/2965474393550.53
<Package Folder>/app_process_lock/2965474393550.53 (deleted)
<Package Folder>/app_process_lock/2965474393578.79
<Package Folder>/app_process_lock/2965474393578.79 (deleted)
<Package Folder>/app_process_lock/2965474393960.95
<Package Folder>/app_process_lock/2965474393960.95 (deleted)
<Package Folder>/app_process_lock/2965474394493.93
<Package Folder>/app_process_lock/2965474394493.93 (deleted)
<Package Folder>/app_process_lock/2965474394597.46
<Package Folder>/app_process_lock/2965474394597.46 (deleted)
<Package Folder>/app_process_lock/2965474395411.89
<Package Folder>/app_process_lock/2965474395411.89 (deleted)
<Package Folder>/app_process_lock/2965474395605.13
<Package Folder>/app_process_lock/2965474395605.13 (deleted)
<Package Folder>/app_process_lock/2965474395874.12
<Package Folder>/app_process_lock/2965474395874.12 (deleted)
<Package Folder>/app_process_lock/2965474396265.49
<Package Folder>/app_process_lock/2965474396265.49 (deleted)
<Package Folder>/app_process_lock/3660380.04099951
<Package Folder>/app_process_lock/3660380.04099951 (deleted)
<Package Folder>/app_process_lock/3660380.34145408
<Package Folder>/app_process_lock/3660380.34145408 (deleted)
<Package Folder>/app_process_lock/690292359023.082
<Package Folder>/app_process_lock/690292359023.082 (deleted)
<Package Folder>/app_process_lock/690292359285.734
<Package Folder>/app_process_lock/690292359285.734 (deleted)
<Package Folder>/app_process_lock/690292359428.638
<Package Folder>/app_process_lock/690292359428.638 (deleted)
<Package Folder>/app_process_lock/690292359582.557
<Package Folder>/app_process_lock/690292359582.557 (deleted)
<Package Folder>/app_process_lock/690292359634.837
<Package Folder>/app_process_lock/690292359634.837 (deleted)
<Package Folder>/app_process_lock/690292359762.522
<Package Folder>/app_process_lock/690292359762.522 (deleted)
<Package Folder>/app_process_lock/690292360985.208
<Package Folder>/app_process_lock/690292360985.208 (deleted)
<Package Folder>/app_process_lock/889.37042982576
<Package Folder>/app_process_lock/889.37042982576 (deleted)
<Package Folder>/app_process_lock/889.414950493276
<Package Folder>/app_process_lock/889.414950493276 (deleted)
<Package Folder>/app_process_lock/889.459471160793
<Package Folder>/app_process_lock/889.459471160793 (deleted)
<Package Folder>/app_process_lock/889.503991828309
<Package Folder>/app_process_lock/889.503991828309 (deleted)
<Package Folder>/app_process_lock/889.548512495826
<Package Folder>/app_process_lock/889.548512495826 (deleted)
<Package Folder>/app_process_lock/889.593033163343
<Package Folder>/app_process_lock/889.593033163343 (deleted)
<Package Folder>/app_process_lock/889.637553830859
<Package Folder>/app_process_lock/889.637553830859 (deleted)
<Package Folder>/app_process_lock/889.682074498376
<Package Folder>/app_process_lock/889.682074498376 (deleted)
<Package Folder>/app_process_lock/889.726595165892
<Package Folder>/app_process_lock/889.726595165892 (deleted)
<Package Folder>/cache/.jar
<Package Folder>/databases/a.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/qy_db_pay
<Package Folder>/databases/qy_db_pay-journal
<Package Folder>/databases/twsdk.db
<Package Folder>/databases/twsdk.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/xUtils_http_cache.db
<Package Folder>/databases/xUtils_http_cache.db-journal
<Package Folder>/databases/xUtils_http_cache.db-shm
<Package Folder>/databases/xUtils_http_cache.db-shm (deleted)
<Package Folder>/databases/xUtils_http_cache.db-wal
<Package Folder>/databases/xUtils_http_cookie.db
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/databases/xUtils_http_cookie.db-shm
<Package Folder>/databases/xUtils_http_cookie.db-shm (deleted)
<Package Folder>/databases/xUtils_http_cookie.db-wal
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.imprint
<Package Folder>/files/exid.dat
<Package Folder>/files/getprop
<Package Folder>/files/pid
<Package Folder>/files/umeng_it.cache
<Package Folder>/libzxvps/####/tmp_so
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/unknown.xml
<Package Folder>/shared_prefs/userData.xml
<Package Folder>/shared_prefs/userDatas.xml
<Package Folder>/tmp_jar
<SD-Card>/.Systemp/.cfg
<SD-Card>/.Systemp/device
<SD-Card>/Android/####/031f04ef44c86d37888b9206208ab7ff
<SD-Card>/Android/####/110b6dcd7a403d3581b21c2d9d50f95c
<SD-Card>/Android/####/18034df2d807af82c05a94d16808e300
<SD-Card>/Android/####/300f50dfb16e035d7ba2ebd4753b36b8
<SD-Card>/Android/####/38772af7086b9700b10328ef4f76a01e
<SD-Card>/Android/####/3adb87ae5ae1044382cd17c8529ba7d7
<SD-Card>/Android/####/580250a58f19d0568600a0ed5db08c1a
<SD-Card>/Android/####/61365bffbec12691243ab50511f1430e
<SD-Card>/Android/####/614b01e4628d6b78f36743a3105948fe
<SD-Card>/Android/####/641396e85bf54468fe7cee3296fab1be
<SD-Card>/Android/####/864e351697d469963357073e21f445aa
<SD-Card>/Android/####/897f47697ee1e6f740a2bff65a9d1b9e
<SD-Card>/Android/####/8acf08558ad9a62966ddb70b9a7b29a0
<SD-Card>/Android/####/9c647a1fd5724bb5447a0c1649f10ab6
<SD-Card>/Android/####/b1deb3fa2d4e3164fd5a9c5ac727abfe
<SD-Card>/Android/####/b89aa7c3a0272920c0b5537e99bdbaed
<SD-Card>/Android/####/e70674bd507620b687e1f920ea8b38e5
<SD-Card>/Android/####/e7e9dd01e68e775e35fad1c827cda9b5
<SD-Card>/Android/1.txt.tmp
<SD-Card>/Android/10.txt.tmp
<SD-Card>/Android/11.txt.tmp
<SD-Card>/Android/12.txt.tmp
<SD-Card>/Android/13.txt.tmp
<SD-Card>/Android/14.txt.tmp
<SD-Card>/Android/15.txt.tmp
<SD-Card>/Android/16.txt.tmp
<SD-Card>/Android/2.txt.tmp
<SD-Card>/Android/3.txt.tmp
<SD-Card>/Android/4.txt.tmp
<SD-Card>/Android/5.txt.tmp
<SD-Card>/Android/6.txt.tmp
<SD-Card>/Android/7.txt.tmp
<SD-Card>/Android/8.txt.tmp
<SD-Card>/Android/9.txt.tmp
<SD-Card>/Android/com.molove.mobile.sjwwx.apk.tmp
<SD-Card>/Android/com.molove.mobile.sjwwx.png.tmp
<SD-Card>/ImgCach/1d1ca0255ef0889a30b0bd5afca866bb.cach
<SD-Card>/ImgCach/39d0905aac7640878ead9cc97790f4a4.cach
<SD-Card>/ImgCach/64f683b3d456f7b058d1f50241bde0df.cach
<SD-Card>/ImgCach/69988bab8ff69a136cdbfac0efd57b5e.cach
<SD-Card>/ImgCach/7066ddc202dffeb16795ab26da5c9d84.cach
<SD-Card>/ImgCach/79c8b8eb75dc27a0f4a46c16da864da0.cach
<SD-Card>/ImgCach/c42fc83dcb1b0335a09dbc2c8d64171e.cach
<SD-Card>/ImgCach/ca5368230a00306e5152b22ff01e6310.cach
<SD-Card>/dp.jar.tmp
<SD-Card>/tmp/####/3277e08081eb849010f1206a8e060608.sds
<SD-Card>/tmp/####/389a6a3ccb7611a54b37ed030bf05e4c.sds
<SD-Card>/tmp/####/c8c5fccaeb20fbf3880edfc151818f83.sds
<SD-Card>/updateApkDemo/FrameCore.jar

Другие:

Запускает следующие shell-скрипты:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
chmod 777 /storage/emulated/0/tmp/<Package>/389a6a3ccb7611a54b37ed030bf05e4c.sds
chmod 777 /storage/emulated/0/tmp/<Package>/c8c5fccaeb20fbf3880edfc151818f83.sds
chmod 777 <Package Folder>/lib/helper
dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
df
getprop
ls -l /system/bin/su
ps | grep <Package>
sh

Загружает динамические библиотеки:

libhelper
libsmsmanager
libzxvps

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
DES
DES-ECB-NoPadding

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Парсит информацию из смс сообщений.

Осуществляет доступ к информации об отправленых/принятых смс.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней