Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.683.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) 4####.92.62.1:80
- TCP(HTTP/1.0) pis.al####.com:80
- TCP(HTTP/1.1) h####.a####.com:80
- TCP(HTTP/1.1) cs107-####.a####.com:80
- TCP(HTTP/1.1) kvt####.m####.a####.com:80
- TCP(HTTP/1.1) t####.dmp.y####.net:80
- TCP(HTTP/1.1) www.a####.com.####.com:80
- TCP(HTTP/1.1) au.y####.net:80
- TCP(HTTP/1.1) cdn.app.ne####.####.com:80
- TCP(HTTP/1.1) cs106-####.a####.com:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) cs251-####.a####.com:80
- TCP(HTTP/1.1) res.we####.cn.####.com:80
- TCP(HTTP/1.1) cs102-####.a####.com:80
- TCP(HTTP/1.1) qs.lago####.com:8982
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(HTTP/1.1) l####.v####.b####.com:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) a####.a####.com:80
- TCP(HTTP/1.1) c47.a####.com:80
- TCP(HTTP/1.1) fs007-####.a####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) cdn.app.win####.top:80
- TCP(HTTP/1.1) cs246-####.a####.com:80
- TCP(HTTP/1.1) l####.c####.q####.####.com:80
- TCP(HTTP/1.1) c50.a####.com:80
- TCP(HTTP/1.1) fu1.a####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) fs012-####.a####.com:80
- TCP(HTTP/1.1) cs230-####.a####.com:80
- TCP(HTTP/1.1) a####.m.ta####.com:80
- TCP(HTTP/1.1) app.w####.cn:80
- TCP(HTTP/1.1) cs110-####.a####.com:80
- TCP(HTTP/1.1) so.a####.com.####.com:80
- TCP(HTTP/1.1) cdn.img.h####.####.com:80
- TCP(HTTP/1.1) s.y####.net:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(TLS/1.0) pns.al####.com:443
- TCP(TLS/1.0) c####.im.ta####.com:443
- TCP(TLS/1.0) ho####.h####.top:443
- TCP(TLS/1.0) i####.ww.ta####.com:443
- UDP 2####.0.0.1:9998
- UDP 1####.168.58.254:4466
Запросы DNS:
- 8####.nd####.y####.com
- a####.a####.com
- a####.m.ta####.com
- a####.u####.com
- aos.w####.y####.net
- app.w####.cn
- au.y####.net
- c####.im.ta####.com
- c47.a####.com
- c50.a####.com
- cdn.app.ne####.top
- cdn.app.win####.top
- cdn.game####.org
- cdn.img.h####.top
- cs102-####.a####.com
- cs102-####.a####.com
- cs106-####.a####.com
- cs107-####.a####.com
- cs110-####.a####.com
- cs230-####.a####.com
- cs230-####.a####.com
- cs246-####.a####.com
- cs246-####.a####.com
- cs251-####.a####.com
- fs007-####.a####.com
- fs012-####.a####.com
- fu1.a####.com
- h####.a####.com
- h####.a####.com
- ho####.h####.top
- i####.ww.ta####.com
- ip.ta####.com
- j####.a####.com
- kvt####.m####.a####.com
- l####.v####.b####.com
- m####.a####.com
- m.a####.com
- mt####.go####.com
- pc.videoc####.b####.com
- pis.al####.com
- pns.al####.com
- policyc####.a####.com
- pss.al####.com
- pus.al####.com
- qs.lago####.com
- res.we####.cn
- s####.gw.y####.net
- s.y####.net
- sdk.st####.y####.com
- so.a####.com
- t####.dmp.y####.net
- www.a####.com
- x####.a####.com
Запросы HTTP GET:
- a####.a####.com/atiws/atiapp?category=####&platform=####&appver=####&gam...
- a####.a####.com/atiws/atiappcommon?platform=####&appver=####&gameid=####...
- app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
- au.y####.net/offer/dist/aos/pkg/2.7.4/offers_2.7.4.zip
- c47.a####.com/user/672/43659672/1005/card/47730498/47730498_800.jpg
- c47.a####.com/user/672/43659672/1005/card/47997547/card.mp4?l=####&to=####
- c47.a####.com/user/672/43659672/1005/card/47997547/info.xml
- c47.a####.com/user/672/43659672/1005/card/48029529/48029529_800.jpg
- c47.a####.com/user/672/43659672/1005/card/48036357/48036357_800.jpg
- c47.a####.com/user/672/43659672/1005/card/48036357/card.mp4?l=####&to=####
- c47.a####.com/user/672/43659672/1005/card/48042533/48042533_800.jpg
- c47.a####.com/user/892/24885892/1005/card/47724456/47724456_800.jpg
- c47.a####.com/user/969/56279969/1005/card/47769384/47769384_800.jpg
- c50.a####.com/user/460/58437460/1006/card/48053974/48053974_400.jpg
- c50.a####.com/user/487/22698487/1006/card/48041195/48041195_400.jpg
- c50.a####.com/user/549/63072549/1006/card/48050464/48050464_400.jpg
- c50.a####.com/user/680/55476680/1006/card/48007929/48007929_400.jpg
- c50.a####.com/user/858/63065858/1006/card/47992899/47992899_800.jpg
- c50.a####.com/user/858/63065858/1006/card/47994174/47994174_800.jpg
- c50.a####.com/user/858/63065858/1006/card/48005223/48005223_800.jpg
- cdn.app.ne####.####.com/swenjian/fiv
- cdn.app.win####.top/upload/201805/10/app/20180510210304434.apk
- cdn.game####.org/strategy/UnknownDev
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/larger4.3
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- cdn.game####.org/strategy/symlink-adbd
- cdn.img.h####.####.com/upload/201805/10/img/20180510210257372.png
- cs102-####.a####.com/user/549/63072549/1006/card/48050464/48050464_400.jpg
- cs102-####.a####.com/user/831/60717831/1006/card/48062457/48062457_800.jpg
- cs102-####.a####.com/user/969/56279969/1005/card/47769384/47769384_800.jpg
- cs106-####.a####.com/user/672/43659672/1005/card/47997547/47997547_800.jpg
- cs106-####.a####.com/user/672/43659672/1005/card/48036357/48036357_800.jpg
- cs107-####.a####.com/user/672/43659672/1005/card/47730498/47730498_800.jpg
- cs107-####.a####.com/user/672/43659672/1005/card/48042533/48042533_800.jpg
- cs110-####.a####.com/user/831/60717831/1006/card/48062457/48062457_400.jpg
- cs230-####.a####.com/user/672/43659672/1005/card/47997547/card.mp4?l=###...
- cs230-####.a####.com/user/672/43659672/1005/card/48029529/48029529_800.jpg
- cs230-####.a####.com/user/672/43659672/1005/card/48036357/48036357_800.jpg
- cs230-####.a####.com/user/672/43659672/1005/card/48036357/card.mp4?l=###...
- cs230-####.a####.com/user/858/63065858/1006/card/47992899/47992899_800.jpg
- cs230-####.a####.com/user/892/24885892/1005/card/47724456/47724456_800.jpg
- cs246-####.a####.com/user/672/43659672/1005/card/47997547/info.xml
- cs246-####.a####.com/user/680/55476680/1006/card/48007929/48007929_400.jpg
- cs246-####.a####.com/user/858/63065858/1006/card/47994174/47994174_800.jpg
- cs246-####.a####.com/user/858/63065858/1006/card/48005223/48005223_800.jpg
- cs251-####.a####.com/user/487/22698487/1006/card/48041195/48041195_400.jpg
- fs007-####.a####.com/user/460/58437460/1006/card/48053974/48053974_400.jpg
- fs012-####.a####.com/user/672/43659672/1005/card/48036357/info.xml
- fu1.a####.com/account/672/43659672/account/43659672_normal.jpg
- fu1.a####.com/account/672/43659672/account/43659672_normal.jpg?4227####
- fu1.a####.com/account/672/43659672/account/43659672_normal.jpg?482####
- fu1.a####.com/account/831/60717831/account/60717831_normal.jpg
- fu1.a####.com/account/858/63065858/account/63065858_normal.jpg
- fu1.a####.com/account/892/24885892/account/24885892_normal.jpg
- fu1.a####.com/account/969/56279969/account/56279969_normal.jpg
- h####.a####.com/user/460/58437460/1006/card/48053974/48053974_400.jpg
- h####.a####.com/user/487/22698487/1006/card/48041195/48041195_400.jpg
- h####.a####.com/user/549/63072549/1006/card/48050464/48050464_400.jpg
- h####.a####.com/user/672/43659672/1005/card/47730498/47730498_800.jpg
- h####.a####.com/user/672/43659672/1005/card/47997547/47997547_800.jpg
- h####.a####.com/user/672/43659672/1005/card/47997547/card.mp4?l=####
- h####.a####.com/user/672/43659672/1005/card/47997547/info.xml
- h####.a####.com/user/672/43659672/1005/card/48029529/48029529_800.jpg
- h####.a####.com/user/672/43659672/1005/card/48036357/48036357_800.jpg
- h####.a####.com/user/672/43659672/1005/card/48036357/card.mp4?l=####
- h####.a####.com/user/672/43659672/1005/card/48036357/info.xml
- h####.a####.com/user/672/43659672/1005/card/48042533/48042533_800.jpg
- h####.a####.com/user/680/55476680/1006/card/48007929/48007929_400.jpg
- h####.a####.com/user/831/60717831/1006/card/48062457/48062457_400.jpg
- h####.a####.com/user/831/60717831/1006/card/48062457/48062457_800.jpg
- h####.a####.com/user/858/63065858/1006/card/47992899/47992899_800.jpg
- h####.a####.com/user/858/63065858/1006/card/47994174/47994174_800.jpg
- h####.a####.com/user/858/63065858/1006/card/48005223/48005223_800.jpg
- h####.a####.com/user/892/24885892/1005/card/47724456/47724456_800.jpg
- h####.a####.com/user/969/56279969/1005/card/47769384/47769384_800.jpg
- ip.ta####.com/service/getIpInfo2.php?ip=####
- kvt####.m####.a####.com/kvinfo.php
- l####.c####.q####.####.com/core/aos-dex/1701/7011/6f830529.jar
- l####.c####.q####.####.com/core/aos-so/1611/7000/ad389c56.so
- l####.v####.b####.com/corp/corpframe.html
- l####.v####.b####.com/p.gif?pid=####&tn=####&tpl=####&t=####
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
- qs.lago####.com:8982/loadtime.shtml?clientIp=183.131.183.62&st=android&l...
- qs.lago####.com:8982/notify.shtml?saddr=aipai-android480003-ewg&definiti...
- res.we####.cn.####.com/aipai_platform/mobile/common/dist/apm/manifest_v2...
- res.we####.cn.####.com/aipai_platform/mobile/common/dist/apm/sea.js
- res.we####.cn.####.com/aipai_platform/mobile/common/dist/mobile/xifen/js...
- res.we####.cn.####.com/aipai_platform/mobile/common/dist/weixin/1.0.0/jw...
- res.we####.cn.####.com/aipai_platform/mobile/xifen/css/img/video/aipai.png
- res.we####.cn.####.com/aipai_platform/mobile/xifen/css/img/video/icon_cl...
- res.we####.cn.####.com/aipai_platform/mobile/xifen/css/img/video/stance_...
- res.we####.cn.####.com/aipai_platform/mobile/xifen/css/video.css
- res.we####.cn.####.com/api/specialTopic/view/211
- res.we####.cn.####.com/api/specialTopic/viewData/211
- res.we####.cn.####.com/app/www/templates/aipai_platform/mobile/_public/c...
- res.we####.cn.####.com/common/img/upload/xifen/1482832602_342.png
- res.we####.cn.####.com/common/img/upload/xifen/1482832667_46.png
- res.we####.cn.####.com/common/img/upload/xifen/1482832678_323.png
- res.we####.cn.####.com/common/img/upload/xifen/1482832711_538.png
- res.we####.cn.####.com/common/img/upload/xifen/1482832731_917.png
- res.we####.cn.####.com/common/img/upload/xifen/1482832745_450.png
- res.we####.cn.####.com/common/img/upload/xifen/1482832758_817.png
- res.we####.cn.####.com/common/img/upload/xifen/1483942737_196.png
- res.we####.cn.####.com/mobile/apps/apps.php?module=####&func=####&app=##...
- res.we####.cn.####.com/mobile/apps/apps.php?module=####&func=####&os=###...
- res.we####.cn.####.com/mobile/apps/apps.php?module=####&func=####&platfo...
- res.we####.cn.####.com/mobile/apps/apps.php?module=####&func=####&test=#...
- res.we####.cn.####.com/mobile/apps/apps.php?module=####&platform=####&ap...
- s.y####.net/aos/v3/initf?s=####
- s.y####.net/stat/aos/v3/pkc?s=####
- s.y####.net/stat/aos/v3/pku?s=####
- s.y####.net/stat/v3/udt2?appid=####&s=####
- s.y####.net/v3/zip_upd?s=####
- so.a####.com.####.com/api/aipaiApp_action-getCommentNew_mobile-1_type-2_...
- so.a####.com.####.com/app/www/templates/cdn_policy_telecom.txt?platform=...
- so.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&os=####...
- so.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&platfor...
- so.a####.com.####.com/pc/operator
- www.a####.com.####.com/api/asset/userlist/43659672?gameId=####&appId=###...
- www.a####.com.####.com/api/asset/userlist/43659672?platform=####&appver=...
- www.a####.com.####.com/api/framework/adConf/33?platform=####&appver=####...
- www.a####.com.####.com/api/framework/jifen/enter/33?platform=####&appver...
- www.a####.com.####.com/api/gonglue/list/2367?appId=####&platform=####&ap...
- www.a####.com.####.com/api/hot/bannerItem/625?platform=####&appver=####&...
- www.a####.com.####.com/api/hot/titleItem/626?platform=####&appver=####&o...
- www.a####.com.####.com/api/hot/videos/2367?appId=####&xifenId=####&platf...
- www.a####.com.####.com/api/jifen/firstInstallInit?platform=####&appver=#...
- www.a####.com.####.com/api/specialTopic/itemList/628?platform=####&appve...
- www.a####.com.####.com/mobile/apps/apps_module-badDomain.html
Запросы HTTP POST:
- a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
- a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
- a####.u####.com/app_logs
- app.w####.cn/action/user_info
- pis.al####.com/p/pcdn/i.php?v=####
- pss.al####.com/iku/log/acc
- pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
- res.we####.cn.####.com/i.gif
- so.a####.com.####.com/i.gif
- t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
- t####.dmp.y####.net/v2/android/pkgtime?rt=####&sign=####
- www.a####.com.####.com/i.gif
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/01193f3363841c88c1f901df1f72f35722252ed4806d2e2....0.tmp
- /data/data/####/0133853427e6c83cdf67bef7fdf42f3b.zip
- /data/data/####/05486f7e-0c4c-4522-aa50-9ecc0c25e953
- /data/data/####/0b0ad8e587b8c26b6b3787712856aaf0e919fd8155e514e....0.tmp
- /data/data/####/11929d3f-2527-4353-85e6-a62f408a8d38
- /data/data/####/1265440675384a211b29d2c814ba66b7d79919b910bc0d7....0.tmp
- /data/data/####/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/1f3aca4c5f6c57582b40a2db67781e4ce3c19b0d96c361c....0.tmp
- /data/data/####/2dc94d05-794e-4d0f-8191-dc5b5464615c.jar
- /data/data/####/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/38871346f3baa2e5b8defa075d1d4428.0.tmp
- /data/data/####/38871346f3baa2e5b8defa075d1d4428.1.tmp
- /data/data/####/3e92c90106cc1456b33c08b96947216ec71458d120a50a5....0.tmp
- /data/data/####/4382630f022068cada4598d0f2d8d60f.0.tmp
- /data/data/####/4382630f022068cada4598d0f2d8d60f.1.tmp
- /data/data/####/4a1e15baa6a3be653d7d951a6614d8ad7abccdd2523e672....0.tmp
- /data/data/####/4ffb9938eaeed2dfadf417280cc8139f6c8466f6f1b0a79....0.tmp
- /data/data/####/5c871bac-9496-4790-b0f1-9439c52bcbd2
- /data/data/####/79c6efac7d63d36acd06d868c19eeadf.0.tmp
- /data/data/####/79c6efac7d63d36acd06d868c19eeadf.1.tmp
- /data/data/####/7c652f13-cb18-4c5e-aea4-dcaa5c1a7538
- /data/data/####/7db0067823efebfea399d9c005f73500.0.tmp
- /data/data/####/7db0067823efebfea399d9c005f73500.1.tmp
- /data/data/####/8718e7db74afe31e679133e1b4ce58f28f5ca0ea403e832....0.tmp
- /data/data/####/8b6f263391259b7a8e5f58ee71852ca8
- /data/data/####/8ffe047bec5f53815bd14cdb017a78d32f9dcdb9d7d6fc8....0.tmp
- /data/data/####/918dec76be34479fd87ff46e63f1167b20f3a022158dda1....0.tmp
- /data/data/####/9ca7ec7c81cffe92500234fd0787e98f
- /data/data/####/9ca7ec7c81cffe92500234fd0787e98f-journal
- /data/data/####/Alvin2.xml
- /data/data/####/AppSettings.xml
- /data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
- /data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml
- /data/data/####/CacheTime.dat
- /data/data/####/ContextData.xml
- /data/data/####/CookiePersistence.xml
- /data/data/####/FerActivity.xml
- /data/data/####/Matrix
- /data/data/####/OFFERSCONFIG1.xml
- /data/data/####/OxgHkj2lz09F
- /data/data/####/OxgHkj2lz09F-journal
- /data/data/####/P15pKIjsm64m
- /data/data/####/P15pKIjsm64m-journal
- /data/data/####/PziService.jar
- /data/data/####/RptKVStrategy.txt
- /data/data/####/SUBOXLOG_
- /data/data/####/ShowAdFlag.xml
- /data/data/####/T1oX0rhhuXWt
- /data/data/####/T1oX0rhhuXWt-journal
- /data/data/####/UTCommon.xml
- /data/data/####/UTMCConf-1767176530.xml
- /data/data/####/UTMCLog-1767176530.xml
- /data/data/####/XKwVoK0huy3R
- /data/data/####/XKwVoK0huy3R-journal
- /data/data/####/a25a936e10d85a025745f99172d40c75-journal
- /data/data/####/aad57e0317a3c99d91f7dcd0f0fe395da46df691bad358f....0.tmp
- /data/data/####/ad_system_config.xml
- /data/data/####/aipai.btconfig
- /data/data/####/aipai.db
- /data/data/####/aipai.db-journal
- /data/data/####/aipai.guid
- /data/data/####/alldown.xml
- /data/data/####/arrow-left.png
- /data/data/####/arrow-right.png
- /data/data/####/b0141e478b25af7c40a8cca8de6c4708
- /data/data/####/b123c3556bb6e1dc408c28bd49ac5ba896565f0be223eaa....0.tmp
- /data/data/####/b18a021d11a3004d25017230b681476b
- /data/data/####/blank.gif
- /data/data/####/bzwn.db-journal
- /data/data/####/c61913b615fb6224701377a119081f36
- /data/data/####/c651b72b-281c-43cd-8c7d-aada3a219c93
- /data/data/####/c8c2a7e8-8a7b-478a-bbf6-75a8ebd6f1b8
- /data/data/####/cf04952528871c4ebdca8e86834c6acb6467d7bcef32f18....0.tmp
- /data/data/####/close-icon.png
- /data/data/####/com.ewtf.ewg_ewg_preferences.xml
- /data/data/####/config.json
- /data/data/####/d16d2da207a12e90d3769a6a65a3405356d096622f60bf4....0.tmp
- /data/data/####/d2e6e3858ecaccd210aefafa10716ee5.0.tmp
- /data/data/####/d2e6e3858ecaccd210aefafa10716ee5.1.tmp
- /data/data/####/d5d60548556150f3b5e28a754a2e31eaba98ea8e64be8f3....0.tmp
- /data/data/####/d87bc5d4-b78c-4288-a578-f0dacd96d365
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/ddexe
- /data/data/####/debuggerd
- /data/data/####/default.png
- /data/data/####/detail-wx-arti.html
- /data/data/####/detail-wx-miniprogram.html
- /data/data/####/detail-wx-miniprogram.js
- /data/data/####/detail-wx.html
- /data/data/####/detail-wx.js
- /data/data/####/detail.html
- /data/data/####/detail.js
- /data/data/####/device.db
- /data/data/####/e07388f1320561ad4bdef855c3326dca.0.tmp
- /data/data/####/e07388f1320561ad4bdef855c3326dca.1.tmp
- /data/data/####/e0888850d29ef11a195e5b377efd4265.0.tmp
- /data/data/####/e0888850d29ef11a195e5b377efd4265.1.tmp
- /data/data/####/e9d11c08bbbf1d6f74ddadbe746a5efe.0.tmp
- /data/data/####/e9d11c08bbbf1d6f74ddadbe746a5efe.1.tmp
- /data/data/####/ebn.xml
- /data/data/####/ecb8066ab461d27a519de0ea191adde1
- /data/data/####/ecb8066ab461d27a519de0ea191adde1-journal
- /data/data/####/edbbc292-ca5a-48b2-a024-63e03c6570ce
- /data/data/####/exchangeIdentity.json
- /data/data/####/f1a5f7524a9b48e27530916719cf4e83.0.tmp
- /data/data/####/f1a5f7524a9b48e27530916719cf4e83.1.tmp
- /data/data/####/f5b5f52edcd1ff3eb73c77e5ca578f373c39cf01b113cd1....0.tmp
- /data/data/####/f6d6795831b3dca3ddf325b178051401d45846fc46bf930....0.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/fbd24328-cb7f-4d21-8c59-3b78a881aa8e
- /data/data/####/feedback.html
- /data/data/####/feedback.js
- /data/data/####/fileWork
- /data/data/####/form.css
- /data/data/####/global.js
- /data/data/####/index
- /data/data/####/install-recovery.sh
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/jg_so_upgrade_setting.xml.bak
- /data/data/####/journal.tmp
- /data/data/####/jqIqJYOT3JpT
- /data/data/####/jqIqJYOT3JpT-journal
- /data/data/####/libabcdefgh.so.new
- /data/data/####/libjiagu.so
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/lists.css
- /data/data/####/lists.html
- /data/data/####/lists.js
- /data/data/####/md5.js
- /data/data/####/multidex.version.xml
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pic_friend_step1.png
- /data/data/####/pic_friend_step2.png
- /data/data/####/pic_friend_step3.png
- /data/data/####/pic_friend_step4.png
- /data/data/####/pic_friend_step5.png
- /data/data/####/pic_m.png
- /data/data/####/pic_tips_01.png
- /data/data/####/pic_tips_02.png
- /data/data/####/pic_xiaochengxu_kefu_step1.png
- /data/data/####/pic_xiaochengxu_kefu_step2.png
- /data/data/####/pic_xiaochengxu_kefu_step3.png
- /data/data/####/pic_xiaochengxu_kefu_step4.png
- /data/data/####/pic_xiaochengxu_kefu_step5.png
- /data/data/####/pic_xiaochengxu_kefu_step6.png
- /data/data/####/pic_xiaochengxu_step1.png
- /data/data/####/pic_xiaochengxu_step2.png
- /data/data/####/pic_xiaochengxu_step3.png
- /data/data/####/pic_xiaochengxu_step4.png
- /data/data/####/pic_xiaochengxu_step5.png
- /data/data/####/pidof
- /data/data/####/result.png
- /data/data/####/root3
- /data/data/####/rule.html
- /data/data/####/rx_sf_account.xml
- /data/data/####/rx_sf_app.xml
- /data/data/####/sdetail.html
- /data/data/####/share.css
- /data/data/####/share.html
- /data/data/####/share.js
- /data/data/####/sp.lock
- /data/data/####/sprite-face.png
- /data/data/####/sprite-icons.png
- /data/data/####/sprite-icons2.png
- /data/data/####/su
- /data/data/####/supolicy
- /data/data/####/toolbox
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/wIU6pTyUBYWX
- /data/data/####/wIU6pTyUBYWX-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/wsUL1uCdKvjD
- /data/data/####/wsUL1uCdKvjD-journal
- /data/data/####/wsroot.sh
- /data/data/####/wx-step1.jpg
- /data/data/####/wx-step2.jpg
- /data/data/####/wx-step3.jpg
- /data/data/####/wx-step4.jpg
- /data/data/####/wx-step5.jpg
- /data/data/####/ymdex.jar
- /data/data/####/ymdex.jar.new
- /data/data/####/ywPrefsTools.xml
- /data/media/####/.nomedia
- /data/media/####/4cb36fb85bff56d757a092288077c3b0.apk
- /data/media/####/6c709c11d2d46a7b
- /data/media/####/Alvin2.xml
- /data/media/####/AppPackage.dat
- /data/media/####/CacheTime.dat
- /data/media/####/ContextData.xml
- /data/media/####/DXTX902KJZX9JASLDJF
- /data/media/####/DXTX902KJZX9JASLDJF.ymtf
- /data/media/####/SOX90123JSOALK2098SD
- /data/media/####/SOX90123JSOALK2098SD.ymtf
- /data/media/####/UnPackage.dat
- /data/media/####/android
- /data/media/####/ap316.tmp
- /data/media/####/dd7893586a493dc3
- /data/media/####/dd935b7a69a8e44a5eff3ddc552f5695
- /data/media/####/dd935b7a69a8e44a5eff3ddc552f5695.ymtf
- /data/media/####/e82134ad92409
- /data/media/####/i42d45df023jnkdd93la483f9xGFKXI
- /data/media/####/im316.tmp
- /data/media/####/myself.dat
- /data/media/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/kernel_max
- cat /proc/cpuinfo | grep Serial
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/instal/4cb36fb85bff56d757a092288077c3b0.apk
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- ls -l /system/xbin/su
- sh
Загружает динамические библиотеки:
- abcdefgh
- libjiagu
- libpcdn_acc
- pcdn_acc
- securitysdk-3.1
- xifen
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
- DES-CBC-PKCS5Padding
- PBEWITHMD5andDES
Использует следующие алгоритмы для расшифровки данных:
- DES-CBC-PKCS5Padding
- PBEWITHMD5andDES
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
