Android.Packed.35836

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.589.origin

Предлагает установить сторонние приложения.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h####.a####.com:80
TCP(HTTP/1.1) kvt####.m####.a####.com:80
TCP(HTTP/1.1) t####.dmp.y####.net:80
TCP(HTTP/1.1) www.a####.com.####.com:80
TCP(HTTP/1.1) c38.a####.com:80
TCP(HTTP/1.1) au.y####.net:80
TCP(HTTP/1.1) nb4052-####.a####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) nb3198-####.a####.com:80
TCP(HTTP/1.1) qs.lago####.com:8982
TCP(HTTP/1.1) c43.a####.com:80
TCP(HTTP/1.1) r.i####.qq.com:80
TCP(HTTP/1.1) c37.a####.com:80
TCP(HTTP/1.1) c39.a####.com:80
TCP(HTTP/1.1) sdk.st####.y####.com:80
TCP(HTTP/1.1) c36.a####.com:80
TCP(HTTP/1.1) l####.v####.b####.com:80
TCP(HTTP/1.1) g####.a####.com.####.com:80
TCP(HTTP/1.1) aos.w####.y####.net:80
TCP(HTTP/1.1) a####.a####.com:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) fs011-####.a####.com:80
TCP(HTTP/1.1) s####.gw.y####.####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) nb4510-####.a####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) nb4050-####.a####.com:80
TCP(HTTP/1.1) nb4500-####.a####.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) nb3194-####.a####.com:80
TCP(HTTP/1.1) cdn.app.e####.####.com:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(HTTP/1.1) app.w####.cn:80
TCP(HTTP/1.1) fu1.a####.com:80
TCP(HTTP/1.1) s.y####.net:80
TCP(HTTP/1.1) nb4520-####.a####.com:80
TCP(TLS/1.0) c####.im.ta####.com:443
TCP(TLS/1.0) y####.e####.top:443
TCP(TLS/1.0) i####.ww.ta####.com:443
UDP 2####.0.0.1:9998

Запросы DNS:

6####.nd####.y####.com
a####.a####.com
a####.m.ta####.com
a####.u####.com
aos.w####.y####.net
app.w####.cn
au.y####.net
c####.im.ta####.com
c36.a####.com
c37.a####.com
c38.a####.com
c39.a####.com
c43.a####.com
cdn.app.e####.top
cdn.app.h####.top
cdn.game####.org
cdn.img.h####.top
fs011-####.a####.com
fu1.a####.com
g####.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
i####.ww.ta####.com
ip.ta####.com
kvt####.m####.a####.com
l####.v####.b####.com
m####.a####.com
m.a####.com
nb3194-####.a####.com
nb3194-####.a####.com
nb3194-####.a####.com
nb3198-####.a####.com
nb3198-####.a####.com
nb4050-####.a####.com
nb4052-####.a####.com
nb4500-####.a####.com
nb4500-####.a####.com
nb4510-####.a####.com
nb4520-####.a####.com
pc.videoc####.b####.com
policyc####.a####.com
qs.lago####.com
r.i####.qq.com
res.we####.cn
s####.gw.y####.net
s.y####.net
sdk.st####.y####.com
so.a####.com
t####.dmp.y####.net
www.a####.com
x####.a####.com
y####.e####.top

Запросы HTTP GET:

a####.a####.com/atiws/atiapp?category=####&platform=####&appver=####&gam...
a####.a####.com/atiws/atiappcommon?platform=####&appver=####&gameid=####...
aos.w####.y####.net/v3/zip_upd?s=####
app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
au.y####.net/offer/dist/aos/pkg/2.6.1/offers_2.6.1.zip
c36.a####.com/user/20/21066020/1006/card/44353573/44353573_800.jpg
c37.a####.com/user/895/58305895/8772573/card/45566565/45566565_800.jpg
c38.a####.com/user/224/29484224/1004/card/44584546/44584546_800.jpg
c38.a####.com/user/572/40996572/1004/card/44773291/44773291_800.jpg
c38.a####.com/user/744/59843744/1004/card/44525808/44525808_800.jpg
c38.a####.com/user/903/19195903/1004/card/45824323/45824323_800.jpg
c39.a####.com/user/47/36349047/1006/card/46398070/46398070_800.jpg
c39.a####.com/user/948/1430948/1006/card/46411474/46411474_800.jpg
c43.a####.com/user/159/26951159/1004/card/47231015/47231015_800.jpg
c43.a####.com/user/984/42902984/1004/card/46806017/46806017_800.jpg
cdn.app.e####.####.com/sfile/201711/16/all/cp_V3.0.2.txt
cdn.app.e####.####.com/upload/201801/12/img/20180112101838893.png
cdn.app.e####.####.com/upload/201802/7/app/20180207180357572.apk
cdn.game####.org/strategy/UnknownDev
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/larger4.3
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.game####.org/strategy/symlink-adbd
fs011-####.a####.com/user/47/36349047/1006/card/46398070/46398070_800.jpg
fu1.a####.com/account/159/26951159/account/26951159_normal.jpg
fu1.a####.com/account/20/21066020/account/21066020_normal.jpg
fu1.a####.com/account/224/29484224/account/29484224_normal.jpg
fu1.a####.com/account/47/36349047/account/36349047_normal.jpg
fu1.a####.com/account/572/40996572/account/40996572_normal.jpg
fu1.a####.com/account/744/59843744/account/59843744_normal.jpg
fu1.a####.com/account/903/19195903/account/19195903_normal.jpg
fu1.a####.com/account/948/1430948/account/1430948_normal.jpg
fu1.a####.com/account/984/42902984/account/42902984_normal.jpg
g####.a####.com.####.com/user/282/47030282/1005/card/47474506/info.xml
h####.a####.com/user/159/26951159/1004/card/47231015/47231015_800.jpg
h####.a####.com/user/20/21066020/1006/card/44353573/44353573_800.jpg
h####.a####.com/user/224/29484224/1004/card/44584546/44584546_800.jpg
h####.a####.com/user/282/47030282/1005/card/47474506/47474506_800.jpg
h####.a####.com/user/282/47030282/1005/card/47474506/card.mp4?l=####
h####.a####.com/user/282/47030282/1005/card/47474506/info.xml
h####.a####.com/user/47/36349047/1006/card/46398070/46398070_800.jpg
h####.a####.com/user/572/40996572/1004/card/44773291/44773291_800.jpg
h####.a####.com/user/744/59843744/1004/card/44525808/44525808_800.jpg
h####.a####.com/user/872/37800872/1004/card/47471367/47471367_800.jpg
h####.a####.com/user/895/58305895/8772573/card/45566565/45566565_800.jpg
h####.a####.com/user/903/19195903/1004/card/45824323/45824323_800.jpg
h####.a####.com/user/948/1430948/1006/card/46411474/46411474_800.jpg
h####.a####.com/user/984/42902984/1004/card/46806017/46806017_800.jpg
ip.ta####.com/service/getIpInfo2.php?ip=####
kvt####.m####.a####.com/kvinfo.php
l####.v####.b####.com/corp/corpframe.html
l####.v####.b####.com/p.gif?pid=####&tn=####&tpl=####&t=####
nb3194-####.a####.com/user/572/40996572/1004/card/44773291/44773291_800....
nb3194-####.a####.com/user/744/59843744/1004/card/44525808/44525808_800....
nb3194-####.a####.com/user/984/42902984/1004/card/46806017/46806017_800....
nb3198-####.a####.com/user/20/21066020/1006/card/44353573/44353573_800.jpg
nb3198-####.a####.com/user/224/29484224/1004/card/44584546/44584546_800....
nb4050-####.a####.com/user/282/47030282/1005/card/47474506/card.mp4?l=##...
nb4052-####.a####.com/user/159/26951159/1004/card/47231015/47231015_800....
nb4500-####.a####.com/user/282/47030282/1005/card/47474506/47474506_800....
nb4500-####.a####.com/user/948/1430948/1006/card/46411474/46411474_800.jpg
nb4510-####.a####.com/user/903/19195903/1004/card/45824323/45824323_800....
nb4520-####.a####.com/user/895/58305895/8772573/card/45566565/45566565_8...
qs.lago####.com:8982/loadtime.shtml?clientIp=59.42.255.194&st=android&lt...
qs.lago####.com:8982/notify.shtml?saddr=aipai-android10000002&definition...
s####.gw.y####.####.com/aos/v3/initf?s=####
s####.gw.y####.####.com/stat/v3/udt2?appid=####&s=####
s.y####.net/stat/aos/v3/pkc?s=####
s.y####.net/stat/aos/v3/pku?s=####
sdk.st####.y####.com/core/aos-dex/1701/7011/6f830529.jar
sdk.st####.y####.com/core/aos-so/1611/7000/ad389c56.so
www.a####.com.####.com/aipai_platform/mobile/common/dist/apm/manifest_v2...
www.a####.com.####.com/aipai_platform/mobile/common/dist/apm/sea.js
www.a####.com.####.com/aipai_platform/mobile/common/dist/mobile/xifen/js...
www.a####.com.####.com/aipai_platform/mobile/common/dist/weixin/1.0.0/jw...
www.a####.com.####.com/aipai_platform/mobile/xifen/css/img/video/aipai.png
www.a####.com.####.com/aipai_platform/mobile/xifen/css/img/video/icon_cl...
www.a####.com.####.com/aipai_platform/mobile/xifen/css/img/video/stance_...
www.a####.com.####.com/aipai_platform/mobile/xifen/css/video.css
www.a####.com.####.com/api/aipaiApp_action-getCommentNew_mobile-1_type-2...
www.a####.com.####.com/api/framework/adConf/35?platform=####&appver=####...
www.a####.com.####.com/api/framework/jifen/enter/35?platform=####&appver...
www.a####.com.####.com/api/gonglue/list/12541?appId=####&platform=####&a...
www.a####.com.####.com/api/hot/bannerItem/661?platform=####&appver=####&...
www.a####.com.####.com/api/hot/titleItem/662?platform=####&appver=####&o...
www.a####.com.####.com/api/hot/videos/12541?appId=####&xifenId=####&plat...
www.a####.com.####.com/api/jifen/firstInstallInit?platform=####&appver=#...
www.a####.com.####.com/api/specialTopic/itemList/664?platform=####&appve...
www.a####.com.####.com/api/specialTopic/view/216
www.a####.com.####.com/api/specialTopic/viewData/216
www.a####.com.####.com/app/www/templates/aipai_platform/mobile/_public/c...
www.a####.com.####.com/app/www/templates/cdn_policy_telecom.txt?platform...
www.a####.com.####.com/app/www/templates/common/img/userdefaultnew_5_1_n...
www.a####.com.####.com/common/img/upload/xifen/1482997928_259.jpg
www.a####.com.####.com/common/img/upload/xifen/1482998127_603.png
www.a####.com.####.com/common/img/upload/xifen/1482998140_678.png
www.a####.com.####.com/common/img/upload/xifen/1482998153_427.jpg
www.a####.com.####.com/common/img/upload/xifen/1482998168_150.png
www.a####.com.####.com/common/img/upload/xifen/1483429773_541.png
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&app=##...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&os=###...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&platfo...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&test=#...
www.a####.com.####.com/mobile/apps/apps_module-badDomain.html
www.a####.com.####.com/pc/operator

Запросы HTTP POST:

a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
app.w####.cn/action/user_info
kvt####.m####.a####.com/i.gif
r.i####.qq.com/getPatchAndroid?uid=####&qn-rid=####&store=####&targetsdk...
t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
t####.dmp.y####.net/v2/android/pkgtime?rt=####&sign=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.init.tmp
/data/data/####/sp_hotpatch_flow_control.xml
<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/Matrix
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/ddexe
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/debuggerd
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/fileWork
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/insta...ery.sh
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/pidof
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/su
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/supolicy
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/toolbox
<Package Folder>/app_000201af-63ed-4330-a4dc-073a5de9c9e6/wsroot.sh
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/Matrix
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/ddexe
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/debuggerd
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/fileWork
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/insta...ery.sh
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/pidof
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/su
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/supolicy
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/toolbox
<Package Folder>/app_1eb4b49e-ecaa-42df-ba31-24b575d0996e/wsroot.sh
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/Matrix
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/ddexe
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/debuggerd
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/fileWork
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/insta...ery.sh
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/pidof
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/su
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/supolicy
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/toolbox
<Package Folder>/app_82e30fe6-1370-44ff-bed2-b6d2d9224101/wsroot.sh
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/Matrix
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/ddexe
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/debuggerd
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/device.db
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/fileWork
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/insta...ery.sh
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/pidof
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/root3
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/su
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/supolicy
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/toolbox
<Package Folder>/app_8fa899f3-f2aa-4b67-a36c-a27f94dd9c8f/wsroot.sh
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/Matrix
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/ddexe
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/debuggerd
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/fileWork
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/insta...ery.sh
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/pidof
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/su
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/supolicy
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/toolbox
<Package Folder>/app_9c66bbfc-4d2a-4cf9-89c7-92cc82b29442/wsroot.sh
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/Matrix
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/ddexe
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/debuggerd
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/fileWork
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/insta...ery.sh
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/pidof
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/su
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/supolicy
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/toolbox
<Package Folder>/app_c7d70514-8b94-44c7-979e-52bff2c7c54a/wsroot.sh
<Package Folder>/app_cf8ad02d-32e2-4a25-aede-7f2c98669435/bbf21...b6d35b
<Package Folder>/app_cf8ad02d-32e2-4a25-aede-7f2c98669435/d45ce...05.jar
<Package Folder>/app_libs/libabcdefgh.so.new
<Package Folder>/app_libs/ymdex.jar
<Package Folder>/app_libs/ymdex.jar.new
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
<Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
<Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
<Package Folder>/app_subox/c61913b615fb6224701377a119081f36
<Package Folder>/app_subox_download/02c16db5-1611-4bf2-bf69-d9ef3fab245a
<Package Folder>/app_subox_download/11d28304-0099-4c3b-b360-4c1fc1bae1ee
<Package Folder>/app_subox_download/1e9a2e41-347f-4216-bb1b-47d438779c03
<Package Folder>/app_subox_download/98032bf3-70d6-4e4e-b7e1-7f6b442a1bb7
<Package Folder>/app_subox_download/99381bfe-744a-4236-b27d-9e42cbf9a930
<Package Folder>/app_subox_download/d71b4e71-3189-4916-a7ea-258d290a50e2
<Package Folder>/app_subox_download/d96f6ba4-c97d-4fa6-bd5b-f28526b39bec
<Package Folder>/app_subox_download/efb557b5-d226-48f7-8a5a-8c0eed445b13
<Package Folder>/cache/####/53663b44199ebfe71572ef2cceb5d407a44....0.tmp
<Package Folder>/cache/####/5cc232554739957fbea32a52096ade2db4a....0.tmp
<Package Folder>/cache/####/beef06084026662de89e2c91ea2e0be6012....0.tmp
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/e85ca56a5c579625e15ecbca08099954468....0.tmp
<Package Folder>/cache/####/f1c1ec341865f080010e78087790302ac7e....0.tmp
<Package Folder>/cache/####/f82f4acd0334def261159a93fe8bd7af327....0.tmp
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/0d9a3bdac89423e204ab7e8700eb4db2.0.tmp
<Package Folder>/cache/0d9a3bdac89423e204ab7e8700eb4db2.1.tmp
<Package Folder>/cache/11b59b0476bdd4a60304d1a122baa374.0.tmp
<Package Folder>/cache/11b59b0476bdd4a60304d1a122baa374.1.tmp
<Package Folder>/cache/V3.0.2.txt
<Package Folder>/cache/dca15d601469495ae6204117fc84fc9d.0.tmp
<Package Folder>/cache/dca15d601469495ae6204117fc84fc9d.1.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.0.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.1.tmp
<Package Folder>/cache/f9fa083d37bfad13bdcd9177c8403a28.0.tmp
<Package Folder>/cache/f9fa083d37bfad13bdcd9177c8403a28.1.tmp
<Package Folder>/cache/journal.tmp
<Package Folder>/databases/OxgHkj2lz09F
<Package Folder>/databases/OxgHkj2lz09F-journal
<Package Folder>/databases/P15pKIjsm64m
<Package Folder>/databases/P15pKIjsm64m-journal
<Package Folder>/databases/T1oX0rhhuXWt
<Package Folder>/databases/T1oX0rhhuXWt-journal
<Package Folder>/databases/XKwVoK0huy3R
<Package Folder>/databases/XKwVoK0huy3R-journal
<Package Folder>/databases/ad29835b1a312b39d1937b130658bc60-journal
<Package Folder>/databases/aipai.db
<Package Folder>/databases/aipai.db-journal
<Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81
<Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81-journal
<Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed
<Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed-journal
<Package Folder>/databases/jqIqJYOT3JpT
<Package Folder>/databases/jqIqJYOT3JpT-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/wIU6pTyUBYWX
<Package Folder>/databases/wIU6pTyUBYWX-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/wsUL1uCdKvjD
<Package Folder>/databases/wsUL1uCdKvjD-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/arrow-left.png
<Package Folder>/files/####/arrow-right.png
<Package Folder>/files/####/blank.gif
<Package Folder>/files/####/close-icon.png
<Package Folder>/files/####/config.json
<Package Folder>/files/####/default.png
<Package Folder>/files/####/detail-wx.html
<Package Folder>/files/####/detail-wx.js
<Package Folder>/files/####/detail.html
<Package Folder>/files/####/detail.js
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/feedback.html
<Package Folder>/files/####/feedback.js
<Package Folder>/files/####/form.css
<Package Folder>/files/####/global.js
<Package Folder>/files/####/lists.css
<Package Folder>/files/####/lists.html
<Package Folder>/files/####/lists.js
<Package Folder>/files/####/md5.js
<Package Folder>/files/####/pic_m.png
<Package Folder>/files/####/pic_tips_01.png
<Package Folder>/files/####/pic_tips_02.png
<Package Folder>/files/####/result.png
<Package Folder>/files/####/rule.html
<Package Folder>/files/####/sdetail.html
<Package Folder>/files/####/share.css
<Package Folder>/files/####/share.html
<Package Folder>/files/####/share.js
<Package Folder>/files/####/sprite-face.png
<Package Folder>/files/####/sprite-icons.png
<Package Folder>/files/####/sprite-icons2.png
<Package Folder>/files/####/wx-step1.jpg
<Package Folder>/files/####/wx-step2.jpg
<Package Folder>/files/####/wx-step3.jpg
<Package Folder>/files/####/wx-step4.jpg
<Package Folder>/files/####/wx-step5.jpg
<Package Folder>/files/.imprint
<Package Folder>/files/CacheTime.dat
<Package Folder>/files/RptKVStrategy.txt
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/aipai.btconfig
<Package Folder>/files/aipai.guid
<Package Folder>/files/d4b6db780bad5e8aa6280fd57fa394c1.zip
<Package Folder>/files/sc.jar
<Package Folder>/files/sp.lock
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/yd.jar
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppSettings.xml
<Package Folder>/shared_prefs/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
<Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/CookiePersistence.xml
<Package Folder>/shared_prefs/OFFERSCONFIG1.xml
<Package Folder>/shared_prefs/ShowAdFlag.xml
<Package Folder>/shared_prefs/UTCommon.xml
<Package Folder>/shared_prefs/UTMCConf94339578.xml
<Package Folder>/shared_prefs/UTMCLog94339578.xml
<Package Folder>/shared_prefs/V3.0.2.xml
<Package Folder>/shared_prefs/ad_system_config.xml
<Package Folder>/shared_prefs/count.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/rx_sf_account.xml
<Package Folder>/shared_prefs/rx_sf_app.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/vbz.xml
<Package Folder>/shared_prefs/ywPrefsTools.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
<SD-Card>/.com.taobao.dp/dd7893586a493dc3
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/0a015e3aa9e93549f7d52c77b74d8a15.apk
<SD-Card>/Android/####/373240561418738c721572c1da14b85e
<SD-Card>/Android/####/373240561418738c721572c1da14b85e.ymtf
<SD-Card>/Android/####/9aa5696c544fc
<SD-Card>/Android/####/AppPackage.dat
<SD-Card>/Android/####/CacheTime.dat
<SD-Card>/Android/####/DXTX902KJZX9JASLDJF
<SD-Card>/Android/####/DXTX902KJZX9JASLDJF.ymtf
<SD-Card>/Android/####/SOX90123JSOALK2098SD
<SD-Card>/Android/####/SOX90123JSOALK2098SD.ymtf
<SD-Card>/Android/####/UnPackage.dat
<SD-Card>/Android/####/android
<SD-Card>/Android/####/b.tmp
<SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
<SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/kernel_max
cat /proc/cpuinfo | grep Serial
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/0a015e3aa9e93549f7d52c77b74d8a15.apk
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
ls -l /system/xbin/su
sh

Загружает динамические библиотеки:

abcdefgh
libjiagu
securitysdk-3.1
xifen

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding
PBEWITHMD5andDES

Использует следующие алгоритмы для расшифровки данных:

DES
DES-CBC-PKCS5Padding
PBEWITHMD5andDES

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней