Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) t.p####.ico####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) p####.ico####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) si.ci.s####.com:80
- TCP(TLS/1.0) tinyq####.ove####.b0.####.com:443
Запросы DNS:
- a####.exc.mob.com
- a####.u####.com
- api.s####.mob.com
- c####.comi####.cn
- cdn.ico####.com
- oc.u####.com
- p####.ico####.com
- si.ci.s####.com
- t.p####.ico####.com
Запросы HTTP GET:
- si.ci.s####.com/a?a=####
- ti####.c####.l####.####.com/11024_ccover_hp_84ad99f8f50ca144.jpg?imageVi...
- ti####.c####.l####.####.com/11244_1_10_f478e2ebd3f2d364.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_11_8826c363ae2c23ba.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_12_1b77b5aeb05a2b59.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_13_f1fed451890a5c98.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_14_e3c7f356c0c4051b.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_15_1a13b75bb6c9f986.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_16_219854960deea5ab.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_17_f2e43d09aa4b3ff8.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_18_e552fd60bc96b35f.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_19_10fb719add558e19.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_1_cd0549bc4775fcd3.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_20_5e076023edf16898.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_21_22a11e9340473cb1.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_22_e259c052f434f143.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_23_43236cc92d978bb8.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_24_a5ccc6c862143fe3.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_25_2aa312190a4cf8d0.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_26_0e3bdb168f3fd568.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_27_0303a1b840f485e2.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_28_8f8f53b36fe25126.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_29_492fbadbb78eb391.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_2_dccd6fdb2a29077c.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_30_701564039e852776.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_31_ae2d4924e3947a05.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_32_db630776f69d14d2.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_33_29d370f4cb0c3ad5.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_34_b27f5717b74133e1.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_35_7e4e011f1e59c081.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_36_e63c927601c7fc6a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_37_6500338e64e5887d.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_38_2b03ab9779d409e3.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_39_6e7464abc7ad1cb0.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_3_040b24bb47fd5742.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_40_9b6e9e13416dfd0a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_41_fe48c57fd7ca42cc.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_42_6e299f3db2b31548.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_43_f50486d7eca8453a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_44_14e6c946f3d5429b.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_45_f5eca248e17cfbdc.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_46_4325c6fc28d0c610.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_47_a341bf0dbb194efe.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_48_d3c85af4d6dd1446.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_49_721a88291b132f82.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_4_9dc19880afc4113f.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_50_7ce49aa3044639da.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_51_b04d296121a263eb.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_52_f9e9d20ffaee0b9a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_53_1fd92104efa9ac9a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_54_5580a1cc68a39425.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_55_8b4dc289e6750797.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_56_4febcd47a2a2d0dd.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_57_ab39278c20dda235.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_58_83249343ec2b7b18.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_59_a1a8cb189b54275a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_5_d064ac9c8a1a99b7.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_60_562252bff6853f3a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_61_692480153e334578.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_62_11b2299efdc26130.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_63_8a3f22753eeeebc4.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_64_f80f73086b673ed7.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_65_e875fd941a2cbd44.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_66_32feb61e14daafd9.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_67_0f28fc8e87106fc4.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_68_139905b331931254.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_69_cd645d535f755313.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_6_b8e5ff9836bbcf8a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_70_b1e2ad2ec8ea698b.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_71_265b7c325901a620.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_72_60a6616bfcda7741.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_73_2f029b67f373c345.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_74_0f84b95aba1cf2be.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_75_1505c5e0d25ec13e.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_76_e4e17e0a2bb0633b.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_77_fe502d31cea51fa2.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_78_03317ec6f2a5003a.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_79_c6f019e79650d37c.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_7_74b5ddab8a6bccaf.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_80_336ce331bce039a5.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_81_cab75ab72af08a22.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_82_ffb7517f6a7c85f3.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_83_ff66afeefbccf166.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_84_75a6fe448eb5c50d.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_85_e1fa1a5172d689d2.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_86_fa443605876a6b64.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_87_7a6c599dae828e1e.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_88_0317cc12beef32fc.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_89_86fa484bfdf528a7.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_8_cae1417556f41666.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_90_a98d9fa2c788e0cc.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_91_c03f496194ad595b.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_92_f87c3ce73c15a3bb.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_93_4134082c30cdfe33.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_94_7a82ee5dea489952.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_95_6c71ece7c98f6dc6.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_96_4d1b18e4829da1f4.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_97_e5c850a7548edef0.jpg?imageMo####
- ti####.c####.l####.####.com/11244_1_9_d9ce0dd60618948b.jpg?imageMo####
- ti####.c####.l####.####.com/11244_ccover_623719d161630476.jpg?imageVi####
- ti####.c####.l####.####.com/12015_ccover_hl_b8834ad1a01bff5d.jpg?imageVi...
- ti####.c####.l####.####.com/12149_ccover_hp_2e37d7984f34f058.jpg?imageVi...
- ti####.c####.l####.####.com/12413_ccover_hp_cea7eae34faf2cd6.jpg?imageVi...
Запросы HTTP POST:
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- api.s####.mob.com/conf4
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- p####.ico####.com/categorylist
- p####.ico####.com/handshake
- p####.ico####.com/homepage
- t.p####.ico####.com/comicdetail
- t.p####.ico####.com/epinfo
- t.p####.ico####.com/getcomments2
- t.p####.ico####.com/getextinfo
- t.p####.ico####.com/splashinfo
- t.p####.ico####.com/syncextinfo
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/749b2f22c9ffc5fb4ff8c9dc085c04cdx.jar
- /data/data/####/Alvin2.xml
- /data/data/####/AppStore.xml
- /data/data/####/ContextData.xml
- /data/data/####/ICOMICO_PREFERENCE.xml
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/icomico_db-journal
- /data/data/####/libjiagu.so
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/mobclick_agent_cached_com.txj.anime.complete482
- /data/data/####/mobclick_agent_online_setting_com.txj.anime.complete.xml
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/ze34d6517.xml
- /data/media/####/.ba
- /data/media/####/.dk
- /data/media/####/.lock
- /data/media/####/10mn9mev86h9mfqeipdqs2gbv.0.tmp
- /data/media/####/10mn9mev86h9mfqeipdqs2gbv.downtmp.downtmp
- /data/media/####/14rj15yk8xoz1tezu8rhv2eqp.0.tmp
- /data/media/####/14rj15yk8xoz1tezu8rhv2eqp.downtmp.downtmp
- /data/media/####/174sw1hm7v4y1doul8bfo0i80.0.tmp
- /data/media/####/17o034avbnp9pj9wtxgq06wld.0.tmp
- /data/media/####/17o034avbnp9pj9wtxgq06wld.downtmp.downtmp
- /data/media/####/181x5jsofqhfq2mdxa0nhx211.0.tmp
- /data/media/####/181x5jsofqhfq2mdxa0nhx211.downtmp.downtmp
- /data/media/####/1feypv7x1ntcyt5axr9f3rjat.0.tmp
- /data/media/####/1feypv7x1ntcyt5axr9f3rjat.downtmp.downtmp
- /data/media/####/1j6x13qqn8290khmdsf3jlz87.0.tmp
- /data/media/####/1j6x13qqn8290khmdsf3jlz87.downtmp.downtmp
- /data/media/####/1kg93pz5ks1nw331hij2blfc8.0.tmp
- /data/media/####/1kg93pz5ks1nw331hij2blfc8.downtmp.downtmp
- /data/media/####/1nylgu289qqyqnlzek8lq2bgg.0.tmp
- /data/media/####/1nylgu289qqyqnlzek8lq2bgg.downtmp.downtmp
- /data/media/####/1okvwolcrsmhxwc9m1kmt36zn.0.tmp
- /data/media/####/1okvwolcrsmhxwc9m1kmt36zn.downtmp.downtmp
- /data/media/####/1pamu4pbclbru9ftpg6i1byke.0.tmp
- /data/media/####/1pamu4pbclbru9ftpg6i1byke.downtmp.downtmp
- /data/media/####/1r4wrmee5btizmku8rkv1bwqz.0.tmp
- /data/media/####/1r4wrmee5btizmku8rkv1bwqz.downtmp.downtmp
- /data/media/####/1s3de7xvkpzk8wumj5g6jsdhu.0.tmp
- /data/media/####/1s3de7xvkpzk8wumj5g6jsdhu.downtmp.downtmp
- /data/media/####/1tk65tb2o2xq2r47lb00wac3w.0.tmp
- /data/media/####/1tk65tb2o2xq2r47lb00wac3w.downtmp.downtmp
- /data/media/####/1v5axy6fbwsiamcdimyv6ohwy.0.tmp
- /data/media/####/1v5axy6fbwsiamcdimyv6ohwy.downtmp.downtmp
- /data/media/####/1vqhybsrdeov9b6639m1zsek6.0.tmp
- /data/media/####/1vqhybsrdeov9b6639m1zsek6.downtmp.downtmp
- /data/media/####/1wu1l41yuwxe107xqjjuep6xj.0.tmp
- /data/media/####/1wu1l41yuwxe107xqjjuep6xj.downtmp.downtmp
- /data/media/####/1xt73sjw9t69pmas2jbqzxf1l.0.tmp
- /data/media/####/1xt73sjw9t69pmas2jbqzxf1l.downtmp.downtmp
- /data/media/####/25dp93mj40yxzty7uxuuk5onj.0.tmp
- /data/media/####/25dp93mj40yxzty7uxuuk5onj.downtmp.downtmp
- /data/media/####/26rk3v4jbabr6wo7o195k14ly.0.tmp
- /data/media/####/26rk3v4jbabr6wo7o195k14ly.downtmp.downtmp
- /data/media/####/2avq7rpgeuzuiw1k8xyrfphq6.0.tmp
- /data/media/####/2avq7rpgeuzuiw1k8xyrfphq6.downtmp.downtmp
- /data/media/####/2b7cqj3h72ddjry6t4v0r870d.0.tmp
- /data/media/####/2b7cqj3h72ddjry6t4v0r870d.downtmp.downtmp
- /data/media/####/2ccikwllru7h6nyjz5ie4derz.0.tmp
- /data/media/####/2ccikwllru7h6nyjz5ie4derz.downtmp.downtmp
- /data/media/####/2d0zwaljmtxwiud6n4i8tzmnc.0.tmp
- /data/media/####/2d0zwaljmtxwiud6n4i8tzmnc.downtmp.downtmp
- /data/media/####/2ei0u3ys2mx2echohuwd0u7ay.0.tmp
- /data/media/####/2ei0u3ys2mx2echohuwd0u7ay.downtmp.downtmp
- /data/media/####/2fkegtkg9jswgmcyz2ac3fa8a.0.tmp
- /data/media/####/2fkegtkg9jswgmcyz2ac3fa8a.downtmp.downtmp
- /data/media/####/2gghr4kvz6f7odepnlrl6v3r.0.tmp
- /data/media/####/2gghr4kvz6f7odepnlrl6v3r.downtmp.downtmp
- /data/media/####/2js5jaxw25o3zqqfvdp6cmohf.0.tmp
- /data/media/####/2js5jaxw25o3zqqfvdp6cmohf.downtmp.downtmp
- /data/media/####/2kesm47rqcy0pa3xxyggl6nv5.0.tmp
- /data/media/####/2kesm47rqcy0pa3xxyggl6nv5.downtmp.downtmp
- /data/media/####/2ml9z4jsktmmpkqlfyzlsrlvd.0.tmp
- /data/media/####/2ml9z4jsktmmpkqlfyzlsrlvd.downtmp.downtmp
- /data/media/####/2mpcua2t1zk4w4j3zxd192oib.0.tmp
- /data/media/####/2mpcua2t1zk4w4j3zxd192oib.downtmp.downtmp
- /data/media/####/2myfvmn05baz8mgtpl7r5bbuo.0.tmp
- /data/media/####/2myfvmn05baz8mgtpl7r5bbuo.downtmp.downtmp
- /data/media/####/2ne2qanhkqedds0u23vdwo9xm.0.tmp
- /data/media/####/2ne2qanhkqedds0u23vdwo9xm.downtmp.downtmp
- /data/media/####/2o8nw5pbhzv84xvx1u2vepwiw.0.tmp
- /data/media/####/2o8nw5pbhzv84xvx1u2vepwiw.downtmp.downtmp
- /data/media/####/2pxz2sj0pi0wezorxhm3j5qe2.0.tmp
- /data/media/####/2pxz2sj0pi0wezorxhm3j5qe2.downtmp.downtmp
- /data/media/####/2uecrs6l0rvezg4feh6b2s4at.0.tmp
- /data/media/####/2uecrs6l0rvezg4feh6b2s4at.downtmp.downtmp
- /data/media/####/2wsek5ge3mbz9ohbtz0snxni5.0.tmp
- /data/media/####/2wsek5ge3mbz9ohbtz0snxni5.downtmp.downtmp
- /data/media/####/2zpu7rvchbxkikpazjak3egla.0.tmp
- /data/media/####/2zpu7rvchbxkikpazjak3egla.downtmp.downtmp
- /data/media/####/31jfruh7z1efd3q72050bsk9e.0.tmp
- /data/media/####/33pc0mjaao55eh3pfo8mltypf.0.tmp
- /data/media/####/33pc0mjaao55eh3pfo8mltypf.downtmp.downtmp
- /data/media/####/35rp87v66soxccffmxklqnwet.0.tmp
- /data/media/####/35rp87v66soxccffmxklqnwet.downtmp.downtmp
- /data/media/####/39jkvcdz4gvo0g3t6n85mazdb.0.tmp
- /data/media/####/39jkvcdz4gvo0g3t6n85mazdb.downtmp.downtmp
- /data/media/####/3bpqdhpvjyb281ko2ozxcmh9p.0.tmp
- /data/media/####/3bpqdhpvjyb281ko2ozxcmh9p.downtmp.downtmp
- /data/media/####/3f0ouwblxrgbzimuw79pbv9vy.0.tmp
- /data/media/####/3f0ouwblxrgbzimuw79pbv9vy.downtmp.downtmp
- /data/media/####/3hnw0wrd9n0zja7vttw8yqvy9.0.tmp
- /data/media/####/3hnw0wrd9n0zja7vttw8yqvy9.downtmp.downtmp
- /data/media/####/3i41l3vqymklnoy41np6l6m71.0.tmp
- /data/media/####/3i41l3vqymklnoy41np6l6m71.downtmp.downtmp
- /data/media/####/3jj744grlh7c2vkvs0yeafec8.0.tmp
- /data/media/####/3jj744grlh7c2vkvs0yeafec8.downtmp.downtmp
- /data/media/####/3lhbmidt5tjqiadojx3nbecum.0.tmp
- /data/media/####/3lhbmidt5tjqiadojx3nbecum.downtmp.downtmp
- /data/media/####/3st4yhq53a3yn6c7huw330w5f.0.tmp
- /data/media/####/3st4yhq53a3yn6c7huw330w5f.downtmp.downtmp
- /data/media/####/3vxqeyq5cxhnixpwma8rt6ru0.0.tmp
- /data/media/####/3vxqeyq5cxhnixpwma8rt6ru0.downtmp.downtmp
- /data/media/####/3xs81an79syfonubeilr5t77i.0.tmp
- /data/media/####/3xs81an79syfonubeilr5t77i.downtmp.downtmp
- /data/media/####/40iyja4if4e0yh9fdhbfsqq34.0.tmp
- /data/media/####/40iyja4if4e0yh9fdhbfsqq34.downtmp.downtmp
- /data/media/####/479q8ffkg5a0mru6bl98vd1oj.0.tmp
- /data/media/####/479q8ffkg5a0mru6bl98vd1oj.downtmp.downtmp
- /data/media/####/4bx75sb7fsm6xze31v4uh3rl1.0.tmp
- /data/media/####/4bx75sb7fsm6xze31v4uh3rl1.downtmp.downtmp
- /data/media/####/4h6n6kysho3l9xn4hk5f9bic4.0.tmp
- /data/media/####/4h6n6kysho3l9xn4hk5f9bic4.downtmp.downtmp
- /data/media/####/4i11ynwk0vaxz39rrb0miqexk.0.tmp
- /data/media/####/4i11ynwk0vaxz39rrb0miqexk.downtmp.downtmp
- /data/media/####/4jbu1ceoi9vi8hjebfeanajr.0.tmp
- /data/media/####/4jbu1ceoi9vi8hjebfeanajr.downtmp.downtmp
- /data/media/####/4r47q30or2rpxtixefq6avxz1.0.tmp
- /data/media/####/4r47q30or2rpxtixefq6avxz1.downtmp.downtmp
- /data/media/####/4tivcis3izb8eb99bv727ubs3.0.tmp
- /data/media/####/4tivcis3izb8eb99bv727ubs3.downtmp.downtmp
- /data/media/####/4xdvg2ii1zo7km9jptxkhvigt.0.tmp
- /data/media/####/4xdvg2ii1zo7km9jptxkhvigt.downtmp.downtmp
- /data/media/####/4xfikpcbzxpett1tqa5571wb7.0.tmp
- /data/media/####/4zubupgif989ckfc541027lsi.0.tmp
- /data/media/####/4zubupgif989ckfc541027lsi.downtmp.downtmp
- /data/media/####/503ab2l849k3k8lypiir0gyrv.0.tmp
- /data/media/####/503ab2l849k3k8lypiir0gyrv.downtmp.downtmp
- /data/media/####/53gbkky5i4s1kpshxar9yefqf.0.tmp
- /data/media/####/53gbkky5i4s1kpshxar9yefqf.downtmp.downtmp
- /data/media/####/5bvh1m5b33y3txiz760jqu9pu.0.tmp
- /data/media/####/5bvh1m5b33y3txiz760jqu9pu.downtmp.downtmp
- /data/media/####/5eeylfz735rz7ayol1v5ynq3a.0.tmp
- /data/media/####/5eeylfz735rz7ayol1v5ynq3a.downtmp.downtmp
- /data/media/####/5frz4exuvh3pm31lh5ft4te5u.0.tmp
- /data/media/####/5frz4exuvh3pm31lh5ft4te5u.downtmp.downtmp
- /data/media/####/5fthfgb24e740jvivr459unsr.0.tmp
- /data/media/####/5fthfgb24e740jvivr459unsr.downtmp.downtmp
- /data/media/####/5hdqqmiw2m9jec190iprj4h3c.0.tmp
- /data/media/####/5hdqqmiw2m9jec190iprj4h3c.downtmp.downtmp
- /data/media/####/5kfv3rei45a3sekd0795ovpdx.0.tmp
- /data/media/####/5png3867zp30z7djko3wnryfg.0.tmp
- /data/media/####/5png3867zp30z7djko3wnryfg.downtmp.downtmp
- /data/media/####/5rtixw3mt597s68vu1pt3d3uk.0.tmp
- /data/media/####/5rtixw3mt597s68vu1pt3d3uk.downtmp.downtmp
- /data/media/####/5ry6ljt00e4k8cv9v4i6fuy86.0.tmp
- /data/media/####/5ry6ljt00e4k8cv9v4i6fuy86.downtmp.downtmp
- /data/media/####/5s5r37n78tr3t63c302ah8elb.0.tmp
- /data/media/####/5s5r37n78tr3t63c302ah8elb.downtmp.downtmp
- /data/media/####/5w226xbu0scyrfoiguppydxgt.0.tmp
- /data/media/####/632xljtfl3rej1z5e2dsy87yl.0.tmp
- /data/media/####/632xljtfl3rej1z5e2dsy87yl.downtmp.downtmp
- /data/media/####/65nmuw4mpgqnr1k6nvs05045p.0.tmp
- /data/media/####/65nmuw4mpgqnr1k6nvs05045p.downtmp.downtmp
- /data/media/####/67h47ejo68auphcrcpi1iccqy.0.tmp
- /data/media/####/6cnsx6mbg4fu16o9aiyodmpnl.0.tmp
- /data/media/####/6cnsx6mbg4fu16o9aiyodmpnl.downtmp.downtmp
- /data/media/####/6ej4pmtu0ps35ibisd90sealo.0.tmp
- /data/media/####/6ej4pmtu0ps35ibisd90sealo.downtmp.downtmp
- /data/media/####/6ey9edvc478ptpy2oh38lue7l.0.tmp
- /data/media/####/6ey9edvc478ptpy2oh38lue7l.downtmp.downtmp
- /data/media/####/6iaz70hsww6exhme6v5aub8kf.0.tmp
- /data/media/####/6iaz70hsww6exhme6v5aub8kf.downtmp.downtmp
- /data/media/####/6k1tbc8a1glxzuvlbbid7gx2n.0.tmp
- /data/media/####/6k1tbc8a1glxzuvlbbid7gx2n.downtmp.downtmp
- /data/media/####/6lj3a28ws3x9b0f96peb0gbyz.0.tmp
- /data/media/####/6lj3a28ws3x9b0f96peb0gbyz.downtmp.downtmp
- /data/media/####/6lo6ufz9to3pln14iargws8p0.0.tmp
- /data/media/####/6lo6ufz9to3pln14iargws8p0.downtmp.downtmp
- /data/media/####/6n4jc1lp60bz2vii5op7aqqa7.0.tmp
- /data/media/####/6n4jc1lp60bz2vii5op7aqqa7.downtmp.downtmp
- /data/media/####/6okdynir0q8n1id7ucz6h4x68.0.tmp
- /data/media/####/6okdynir0q8n1id7ucz6h4x68.downtmp.downtmp
- /data/media/####/6p1xl59d3sdvsqftgzbc8tji9.0.tmp
- /data/media/####/6p1xl59d3sdvsqftgzbc8tji9.downtmp.downtmp
- /data/media/####/6rbf14910pw7a0wbtrvwtreiw.0.tmp
- /data/media/####/6rbf14910pw7a0wbtrvwtreiw.downtmp.downtmp
- /data/media/####/6tu1n2exbrazhewhpobjml4zf.0.tmp
- /data/media/####/6tu1n2exbrazhewhpobjml4zf.downtmp.downtmp
- /data/media/####/73r0eslwznb8isqflbb3guyms.0.tmp
- /data/media/####/73r0eslwznb8isqflbb3guyms.downtmp.downtmp
- /data/media/####/76f36qcjdp1orf6k419zg1n2h.0.tmp
- /data/media/####/76f36qcjdp1orf6k419zg1n2h.downtmp.downtmp
- /data/media/####/772arh4le8pjxhth421r6q3ov.0.tmp
- /data/media/####/7bycplxjlio86y3jictg58is4.0.tmp
- /data/media/####/7bycplxjlio86y3jictg58is4.downtmp.downtmp
- /data/media/####/7c9deyjnurc2sbkqco7e88v80.0.tmp
- /data/media/####/7c9deyjnurc2sbkqco7e88v80.downtmp.downtmp
- /data/media/####/7fji8v3ye2177mq0qs0bungph.0.tmp
- /data/media/####/7fji8v3ye2177mq0qs0bungph.downtmp.downtmp
- /data/media/####/7j3w3fjp6dybvlwel41sgf7k.0.tmp
- /data/media/####/7j3w3fjp6dybvlwel41sgf7k.downtmp.downtmp
- /data/media/####/89mu7lbjtopu640jqqhdyd6u.0.tmp
- /data/media/####/89mu7lbjtopu640jqqhdyd6u.downtmp.downtmp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/h1gfuy7ll2up4aaik15ov5ot.0.tmp
- /data/media/####/journal.tmp
- /data/media/####/mghy6jfhb13x5zn67ffwiqnb.0.tmp
- /data/media/####/mghy6jfhb13x5zn67ffwiqnb.downtmp.downtmp
- /data/media/####/og9xaam3dp4bpiff39y148nj.0.tmp
- /data/media/####/og9xaam3dp4bpiff39y148nj.downtmp.downtmp
- /data/media/####/qbpvq4plan5abw8xdhh85124.0.tmp
- /data/media/####/qbpvq4plan5abw8xdhh85124.downtmp.downtmp
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- libjiagu
- neh
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS7Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-NoPadding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
