Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.3.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) zhusho####.gam####.cn:80
- TCP(HTTP/1.1) u####.umengc####.com:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(HTTP/1.1) msg.umengc####.com:80
- TCP(HTTP/1.1) i####.gam####.cn.####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) ub####.baidust####.com:80
- TCP(HTTP/1.1) uce####.gam####.cn.####.com:80
- TCP(HTTP/1.1) api.m.ta####.com:80
- TCP(HTTP/1.1) a####.m.ta####.com:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) m####.gam####.cn.####.com:80
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) dow####.b####.com:443
- TCP(TLS/1.0) down####.b####.com:443
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP 1####.205.203.80:80
Запросы DNS:
- a####.m.ta####.com
- a####.u####.com
- c####.baidust####.com
- chan####.s####.com
- dow####.b####.com
- down####.b####.com
- feed####.u####.com
- hm.b####.com
- i####.gam####.cn
- ih.dh.ha####.net
- m####.gam####.cn
- m.b####.com
- mo####.b####.com
- mobads-####.b####.com
- msg.umengc####.com
- u####.umengc####.com
- u####.umengc####.com
- ub####.baidust####.com
- uce####.gam####.cn
- zhusho####.gam####.cn
Запросы HTTP GET:
- api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
- c####.baidust####.com/cpro/ui/noexpire/ws/3rd/esl_b150bbf.js
- c####.baidust####.com/cpro/ui/noexpire/ws/css/base_f258e90.css
- c####.baidust####.com/cpro/ui/noexpire/ws/css/ui_b99a586.css
- c####.baidust####.com/cpro/ui/noexpire/ws/images/logo/close_9d33a11.png
- c####.baidust####.com/cpro/ui/noexpire/ws/images/logo/logo-mob_94da672.png
- c####.baidust####.com/cpro/ui/noexpire/ws/js/anticheatMob_776abb3.js
- c####.baidust####.com/cpro/ui/noexpire/ws/widget/logo_94e2e1b.js
- gdv.a.s####.com/api/2/topic/load?page_size=####&style=####&hot_size=####...
- gdv.a.s####.com/stat/uvstat?platform=####&uuid=####&client_id=####
- i####.gam####.cn.####.com/2015/05/07/106-15050G214350-L.jpg
- i####.gam####.cn.####.com/2015/05/08/106-15050QA3220-L.jpg
- i####.gam####.cn.####.com/2015/05/08/106-15050QF2000-L.jpg
- i####.gam####.cn.####.com/2015/05/09/106-1505091614020-L.jpg
- i####.gam####.cn.####.com/2015/05/09/106-1505091623270-L.jpg
- i####.gam####.cn.####.com/2015/05/11/106-1505111522080-L.jpg
- i####.gam####.cn.####.com/2015/05/11/106-150511154H00-L.jpg
- i####.gam####.cn.####.com/2015/05/14/106-1505141633030-L.jpg
- i####.gam####.cn.####.com/2015/05/27/106-15052G633470-L.jpg
- i####.gam####.cn.####.com/2015/07/19/269-150G91356390-L.jpg
- i####.gam####.cn.####.com/2015/07/19/269-150G91406300-L.jpg
- i####.gam####.cn.####.com/2015/07/20/269-150H00922470-L.jpg
- i####.gam####.cn.####.com/2015/07/23/269-150H31009190-L.jpg
- i####.gam####.cn.####.com/2015/07/23/269-150H31034150-L.jpg
- i####.gam####.cn.####.com/2015/08/19/269-150Q91101300-L.jpg
- i####.gam####.cn.####.com/2015/08/19/269-150Q9110J70-L.jpg
- i####.gam####.cn.####.com/2015/08/19/269-150Q91140570-L.jpg
- i####.gam####.cn.####.com/2015/08/22/269-150R20950240-L.jpg
- i####.gam####.cn.####.com/2015/08/22/269-150R21024250-L.jpg
- i####.gam####.cn.####.com/2015/09/11/269-1509111J3590.jpg
- i####.gam####.cn.####.com/2015/09/11/269-1509111J6060.jpg
- i####.gam####.cn.####.com/2015/09/11/269-1509111JP90.jpg
- i####.gam####.cn.####.com/2015/09/11/269-1509111KI10.jpg
- i####.gam####.cn.####.com/2015/09/15/269-150915094H40-L.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221053580-L.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221139250-L.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221642050.jpg
- i####.gam####.cn.####.com/2015/09/22/269-150922164P10.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221A5010.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221H2070.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221H3320.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221H6240.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221H9270.jpg
- i####.gam####.cn.####.com/2015/09/22/269-1509221I2000.jpg
- i####.gam####.cn.####.com/2015/09/23/269-1509231125010-L.jpg
- i####.gam####.cn.####.com/2015/09/23/269-150923115J00-L.jpg
- i####.gam####.cn.####.com/2015/09/25/269-150925095Q80-L.jpg
- i####.gam####.cn.####.com/2015/09/25/269-1509251034320-L.jpg
- i####.gam####.cn.####.com/2015/09/30/269-1509301014460-L.jpg
- i####.gam####.cn.####.com/2015/09/30/269-1509301110210-L.jpg
- i####.gam####.cn.####.com/2015/10/08/269-15100PS3390-L.jpg
- i####.gam####.cn.####.com/2015/10/10/269-1510101015270-L.jpg
- i####.gam####.cn.####.com/2015/10/10/269-1510101033030-L.jpg
- i####.gam####.cn.####.com/2015/10/12/269-1510121031440-L.jpg
- i####.gam####.cn.####.com/2015/10/16/269-1510161030490-L.jpg
- i####.gam####.cn.####.com/2016/01/26/269-1601261Q2520.jpg
- i####.gam####.cn.####.com/2016/01/26/269-1601261Q5420.jpg
- i####.gam####.cn.####.com/2016/09/22/1162591-1609221626490-L.jpg
- i####.gam####.cn.####.com/2016/09/23/1162591-1609231A1070-L.jpg
- i####.gam####.cn.####.com/2016/10/09/1162591-1610091632240-L.jpg
- i####.gam####.cn.####.com/2016/10/10/1162591-1610101643100-L.jpg
- i####.gam####.cn.####.com/2016/12/14/106-1612141S9170.jpg
- i####.gam####.cn.####.com/2017/04/22/1747865-1F4221G2060.jpg
- i####.gam####.cn.####.com/2017/05/05/23-1F5051H1130.jpg
- i####.gam####.cn.####.com/2017/05/05/23-1F5051H2420.jpg
- i####.gam####.cn.####.com/2017/05/05/23-1F5051H3150.jpg
- i####.gam####.cn.####.com/2017/05/05/23-1F5051H4050.jpg
- i####.gam####.cn.####.com/2017/05/05/23-1F5051H5110.jpg
- i####.gam####.cn.####.com/2017/05/05/23-1F5051H5330.jpg
- i####.gam####.cn.####.com/2017/05/05/23-1F5051H5530.jpg
- i####.gam####.cn.####.com/2017/05/05/275-1F5051H4080.jpg
- i####.gam####.cn.####.com/2017/05/05/275-1F5051H5120.jpg
- i####.gam####.cn.####.com/2017/05/05/275-1F5051H6360.jpg
- i####.gam####.cn.####.com/2017/05/05/275-1F5051I4110.jpg
- i####.gam####.cn.####.com/2017/05/10/1747865-1F5101616340-L.jpg
- i####.gam####.cn.####.com/2017/05/10/1747865-1F510162I80-L.jpg
- i####.gam####.cn.####.com/2017/05/12/1747865-1F5121622310-L.jpg
- i####.gam####.cn.####.com/2017/05/12/1747865-1F5121624080-L.jpg
- i####.gam####.cn.####.com/2017/05/12/1747865-1F512162H90-L.jpg
- i####.gam####.cn.####.com/2017/05/22/1747865-1F5221H4140-L.jpg
- i####.gam####.cn.####.com/2017/05/23/1747865-1F5231640420-L.jpg
- i####.gam####.cn.####.com/2017/06/09/1747865-1F6091G6060-L.jpg
- i####.gam####.cn.####.com/2017/06/09/1747865-1F6091GF90-L.jpg
- i####.gam####.cn.####.com/2017/06/19/1747865-1F6191KK80-L.jpg
- m####.gam####.cn.####.com/2015/05/09/106-1505091553370-L.jpg
- m####.gam####.cn.####.com/2015/05/09/106-1505091604070-L.jpg
- m####.gam####.cn.####.com/2015/05/11/106-1505111534220-L.jpg
- m####.gam####.cn.####.com/2015/05/14/106-1505141629200-L.jpg
- m####.gam####.cn.####.com/2015/07/19/269-150G91335240-L.jpg
- m####.gam####.cn.####.com/2015/07/20/269-150H00Z9400-L.jpg
- m####.gam####.cn.####.com/2015/07/23/269-150H3102F20-L.jpg
- m####.gam####.cn.####.com/2015/07/23/269-150H31053320-L.jpg
- m####.gam####.cn.####.com/2015/08/19/269-150Q91119390-L.jpg
- m####.gam####.cn.####.com/2015/09/11/269-1509111P1250.jpg
- m####.gam####.cn.####.com/2015/09/11/269-1509111P4330.jpg
- m####.gam####.cn.####.com/2015/09/22/269-1509221640210.jpg
- m####.gam####.cn.####.com/2015/09/22/269-1509221H0180.jpg
- m####.gam####.cn.####.com/2015/09/22/269-1509221H5110.jpg
- m####.gam####.cn.####.com/2015/09/22/269-1509221I0360.jpg
- m####.gam####.cn.####.com/2015/09/23/269-1509231113340-L.jpg
- m####.gam####.cn.####.com/2015/09/24/269-1509240U9530-L.jpg
- m####.gam####.cn.####.com/2015/09/25/269-150925092P70-L.jpg
- m####.gam####.cn.####.com/2015/10/10/269-1510101023300-L.jpg
- m####.gam####.cn.####.com/2015/10/10/269-1510101046040-L.jpg
- m####.gam####.cn.####.com/2015/10/12/269-151012102F20-L.jpg
- m####.gam####.cn.####.com/2015/10/20/269-1510201133270.jpg
- m####.gam####.cn.####.com/2016/01/26/269-1601261Q4310.jpg
- m####.gam####.cn.####.com/2017/03/17/275-1F31G512320.jpg
- m####.gam####.cn.####.com/2017/03/17/275-1F31G516490.jpg
- m####.gam####.cn.####.com/2017/03/17/275-1F31G523090.jpg
- m####.gam####.cn.####.com/2017/03/18/281-1F31Q632310-L.jpg
- m####.gam####.cn.####.com/2017/05/05/23-1F5051GR80.jpg
- m####.gam####.cn.####.com/2017/05/05/275-1F5051H1320.jpg
- m####.gam####.cn.####.com/2017/05/05/275-1F5051IF40.jpg
- m####.gam####.cn.####.com/2018/03/23/2804218-1P3231120460.jpg
- mo####.b####.com/ads/ads.appcache
- mo####.b####.com/ads/css/min/main.css
- mo####.b####.com/ads/index.htm
- mo####.b####.com/ads/js/ads.trunk.js
- mo####.b####.com/ads/js/c.js
- mo####.b####.com/ads/pa/__pasys.apk
- mo####.b####.com/ads/pa/__pasys.php
- mo####.b####.com/ads/pa/__pasys_remote_banner.jar
- mo####.b####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####...
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1522752899367=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1522752899376=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1522752909483=####
- u####.umengc####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=...
- u####.umengc####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=##...
- u####.umengc####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####...
- ub####.baidust####.com/media/v1/0f0005ytIkVxsobMfPudds.jpg
- ub####.baidust####.com/media/v1/0f000K00VI1UVpiS88All6.jpg
- uce####.gam####.cn.####.com/avatar.php?uid=####&size=####
- uce####.gam####.cn.####.com/images/noavatar_big.gif
- wap.n.sh####.com/mobads.php?0f0000K####&ck=####
- zhusho####.gam####.cn/api/terraria/AppVersion.xml
- zhusho####.gam####.cn/index.php?m=####&a=####&aid=####
- zhusho####.gam####.cn/index.php?m=####&a=####&id=####&umengchannel=####
- zhusho####.gam####.cn/index.php?m=####&a=####&page=####&typeid=####&flag...
- zhusho####.gam####.cn/index.php?m=####&a=####&pageSize=####&page=####&ty...
Запросы HTTP POST:
- a####.m.ta####.com/rest/gc?ak=####&av=####&c=####&v=####&s=####&d=####&s...
- a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
- a####.u####.com/app_logs
- msg.umengc####.com/v2/register
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-10813310522058397680
- /data/data/####/-10813310522058397682
- /data/data/####/-10813310522058397684
- /data/data/####/-10813310522058397710
- /data/data/####/-10813310522058432220
- /data/data/####/-10813310522058432243
- /data/data/####/-10813310522058432245
- /data/data/####/.imprint
- /data/data/####/1003943842-838647954
- /data/data/####/1824952415-2004233750
- /data/data/####/AGOO_CONNECT.xml
- /data/data/####/AGOO_HOST.xml
- /data/data/####/Alvin2.xml
- /data/data/####/AppStore.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/PhoneUtil.xml
- /data/data/####/TrineaAndroidCommon.xml
- /data/data/####/UTMCBase.xml
- /data/data/####/UTMCConf664632682.xml
- /data/data/####/UTMCLog664632682.xml
- /data/data/####/UmengLocalNotificationStore.db-journal
- /data/data/####/__pasys.apk.beforesign.tm
- /data/data/####/__pasys_remote_banner.jar.beforesign.tm
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/__sdk_pasys_pkgs.xml
- /data/data/####/__sdk_pasys_pkgurls.xml
- /data/data/####/__sdk_remote_dl.xml
- /data/data/####/_acnterrariaassistz.xml
- /data/data/####/agoo.pid
- /data/data/####/avatar.php?uid=2293406&size=big
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/http_mobads.baidu.com_0.localstorage-journal
- /data/data/####/http_mobads.baidu.com_0.localstorage-journal (deleted)
- /data/data/####/index
- /data/data/####/mobclick_agent_cached_cn.gamedog.terrariaassist26
- /data/data/####/register.xml
- /data/data/####/s_update.xml
- /data/data/####/terrariaassist.xml
- /data/data/####/terrariaassistq.jar
- /data/data/####/terrariacomposbox.db-journal
- /data/data/####/trinea_android_common.db-journal
- /data/data/####/umeng_feedback_conversations.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/uuid.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/http___img1_gamedog_cn_2015_05_07_106_15050G214350_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_08_106_15050QA3220_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_08_106_15050QF2000_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091553370_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091604070_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091614020_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091623270_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_11_106_1505111522080_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_11_106_1505111534220_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_11_106_150511154H00_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_14_106_1505141629200_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_14_106_1505141633030_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_05_27_106_15052G633470_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_19_269_150G91335240_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_19_269_150G91356390_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_19_269_150G91406300_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_20_269_150H00922470_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_20_269_150H00Z9400_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H31009190_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H3102F20_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H31034150_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H31053320_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q91101300_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q9110J70_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q91119390_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q91140570_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_08_22_269_150R20950240_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_08_22_269_150R21024250_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111J3590_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111J6060_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111JP90_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111KI10_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111P1250_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111P4330_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_15_269_150915094H40_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221053580_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221139250_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221640210_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221642050_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_150922164P10_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221A5010_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H0180_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H2070_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H3320_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H5110_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H6240_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H9270_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221I0360_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221I2000_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_23_269_1509231113340_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_23_269_1509231125010_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_23_269_150923115J00_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_24_269_1509240U9530_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_25_269_150925092P70_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_25_269_150925095Q80_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_25_269_1509251034320_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_30_269_1509301014460_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_09_30_269_1509301110210_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_08_269_15100PS3390_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_10_269_1510101015270_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_10_269_1510101023300_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_10_269_1510101033030_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_10_269_1510101046040_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_12_269_151012102F20_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_12_269_1510121031440_L_jpg
- /data/media/####/http___img1_gamedog_cn_2015_10_16_269_1510161030490_L_jpg
- /data/media/####/http___img1_gamedog_cn_2016_01_26_269_1601261Q2520_jpg
- /data/media/####/http___img1_gamedog_cn_2016_01_26_269_1601261Q4310_jpg
- /data/media/####/http___img1_gamedog_cn_2016_01_26_269_1601261Q5420_jpg
- /data/media/####/http___img1_gamedog_cn_2016_09_22_1162591_1609..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2016_09_23_1162591_1609..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2016_10_09_1162591_1610..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2016_10_10_1162591_1610..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2016_12_14_106_1612141S9170_jpg
- /data/media/####/http___img1_gamedog_cn_2017_03_18_281_1F31Q632310_L_jpg
- /data/media/####/http___img1_gamedog_cn_2017_04_22_1747865_1F4221G2060_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051GR80_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051H1130_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051H2420_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051H3150_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051H4050_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051H5110_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051H5330_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_23_1F5051H5530_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_275_1F5051H1320_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_275_1F5051H4080_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_275_1F5051H5120_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_275_1F5051H6360_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_275_1F5051I4110_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_05_275_1F5051IF40_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_10_1747865_1F51..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_12_1747865_1F51..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_22_1747865_1F52..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2017_05_23_1747865_1F52..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2017_06_09_1747865_1F60..._L_jpg
- /data/media/####/http___img1_gamedog_cn_2017_06_19_1747865_1F61..._L_jpg
- /data/media/####/http___mimg1_gamedog_cn_2015_10_20_269_1510201133270_jpg
- /data/media/####/http___mimg1_gamedog_cn_2017_03_17_275_1F31G512320_jpg
- /data/media/####/http___mimg1_gamedog_cn_2017_03_17_275_1F31G516490_jpg
- /data/media/####/http___mimg1_gamedog_cn_2017_03_17_275_1F31G523090_jpg
- /data/media/####/http___mimg1_gamedog_cn_2018_03_23_2804218_1P3...60_jpg
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 60 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D {"package":"<Package>","appKey":"umeng:555ee81e67e58e304200458f","utdid":"WsNdeiPdtaQDAGdzx1HseuuC","sdkVersion":"20150515"} -I 100.69.168.33 -O 80 -T -Z
- chmod 500 <Package Folder>/files/DaemonServer
- sh
Загружает динамические библиотеки:
- tnet-2.0.17
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- DES
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
