Adware.Dowgin.1944

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Dowgin.14.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) t.p####.ico####.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) p####.ico####.com:80
TCP(HTTP/1.1) api.s####.mob.com:80
TCP(HTTP/1.1) 7s####.v2.com.####.com:80
TCP(TLS/1.0) gl####.w.kunl####.####.com:443
TCP(TLS/1.0) tinyq####.ove####.b0.####.com:443

Запросы DNS:

a####.exc.mob.com
a####.u####.com
api.s####.mob.com
c####.comi####.cn
c####.comi####.cn
cdn.ico####.com
oc.u####.com
p####.ico####.com
t.p####.ico####.com

Запросы HTTP GET:

7s####.v2.com.####.com/11251_ccover_hp_39da72f1c436bfe6.jpg?imageVi####
7s####.v2.com.####.com/11607_50_acover_5debaa73f7296bbc.jpg?imageVi####
7s####.v2.com.####.com/11607_51_acover_1e92e4a2bd3e59f8.jpg?imageVi####
7s####.v2.com.####.com/11607_52_acover_bf82a0f9c49d9af8.jpg?imageVi####
7s####.v2.com.####.com/11607_53_acover_c82dfd078dcce6ff.jpg?imageVi####
7s####.v2.com.####.com/11607_54_acover_deb6e2832631c2a8.jpg?imageVi####
7s####.v2.com.####.com/11607_55_acover_54baf367db0d391d.jpg?imageVi####
7s####.v2.com.####.com/11607_56_acover_c501a97598910004.jpg?imageVi####
7s####.v2.com.####.com/11607_57_acover_be24c1059427d4e9.jpg?imageVi####
7s####.v2.com.####.com/11607_58_acover_e796a38a234db49e.jpg?imageVi####
7s####.v2.com.####.com/11607_59_acover_cd1c4e05dfceccad.jpg?imageVi####
7s####.v2.com.####.com/11607_60_acover_b3fd8ab2fda7d03a.jpg?imageVi####
7s####.v2.com.####.com/11607_61_10_9a4ddddf96cd0038.jpg?imageMo####
7s####.v2.com.####.com/11607_61_11_cd4ade5bfa6e4f92.jpg?imageMo####
7s####.v2.com.####.com/11607_61_12_e93b481aac085caf.jpg?imageMo####
7s####.v2.com.####.com/11607_61_13_24f2c282a120d714.jpg?imageMo####
7s####.v2.com.####.com/11607_61_14_d901fb390d120610.jpg?imageMo####
7s####.v2.com.####.com/11607_61_15_d329ee9194af8b2c.jpg?imageMo####
7s####.v2.com.####.com/11607_61_16_9c25b62e619f10e0.jpg?imageMo####
7s####.v2.com.####.com/11607_61_17_39996b1c501f4e60.jpg?imageMo####
7s####.v2.com.####.com/11607_61_18_c403dd41c8976377.jpg?imageMo####
7s####.v2.com.####.com/11607_61_19_d302ee43ecfcb74c.jpg?imageMo####
7s####.v2.com.####.com/11607_61_1_8df3daeb9da93f5b.jpg?imageMo####
7s####.v2.com.####.com/11607_61_20_9f3af1fa50623b88.jpg?imageMo####
7s####.v2.com.####.com/11607_61_21_e3e17f09b4b5ae63.jpg?imageMo####
7s####.v2.com.####.com/11607_61_22_e56a8c925a0e37a6.jpg?imageMo####
7s####.v2.com.####.com/11607_61_23_549c4b0615c33421.jpg?imageMo####
7s####.v2.com.####.com/11607_61_24_8151a448b07f6250.jpg?imageMo####
7s####.v2.com.####.com/11607_61_25_37fb946ed43081b6.jpg?imageMo####
7s####.v2.com.####.com/11607_61_26_0cbd37c2ef26d6dc.jpg?imageMo####
7s####.v2.com.####.com/11607_61_27_76e89da6b44df13c.jpg?imageMo####
7s####.v2.com.####.com/11607_61_28_5f90567d62f510a1.jpg?imageMo####
7s####.v2.com.####.com/11607_61_29_64b0c20fbb6cfb27.jpg?imageMo####
7s####.v2.com.####.com/11607_61_2_54342ea365d8ca32.jpg?imageMo####
7s####.v2.com.####.com/11607_61_30_654f59072c895999.jpg?imageMo####
7s####.v2.com.####.com/11607_61_31_64cca9cce9607f8c.jpg?imageMo####
7s####.v2.com.####.com/11607_61_32_6779e8503d71c2d4.jpg?imageMo####
7s####.v2.com.####.com/11607_61_33_b2d16a367d9f0924.jpg?imageMo####
7s####.v2.com.####.com/11607_61_34_b3bcc6eabd703ac7.jpg?imageMo####
7s####.v2.com.####.com/11607_61_35_05dbbb9d00697d38.jpg?imageMo####
7s####.v2.com.####.com/11607_61_36_3e2122bb631354a9.jpg?imageMo####
7s####.v2.com.####.com/11607_61_37_f51bb008a741d8f7.jpg?imageMo####
7s####.v2.com.####.com/11607_61_38_f5ef6bb18eb2db22.jpg?imageMo####
7s####.v2.com.####.com/11607_61_39_416c716ebe9e9c38.jpg?imageMo####
7s####.v2.com.####.com/11607_61_3_069534b421a7ed86.jpg?imageMo####
7s####.v2.com.####.com/11607_61_40_82f982dcfbb37ad2.jpg?imageMo####
7s####.v2.com.####.com/11607_61_41_41ba3be14d441843.jpg?imageMo####
7s####.v2.com.####.com/11607_61_42_cc8ccc48b85741bc.jpg?imageMo####
7s####.v2.com.####.com/11607_61_43_1b5c70f3b78c7787.jpg?imageMo####
7s####.v2.com.####.com/11607_61_44_e4cbf905c568a0e6.jpg?imageMo####
7s####.v2.com.####.com/11607_61_45_1555c94509355240.jpg?imageMo####
7s####.v2.com.####.com/11607_61_46_4f4874e7f127186a.jpg?imageMo####
7s####.v2.com.####.com/11607_61_47_e276ccfedc2e8b78.jpg?imageMo####
7s####.v2.com.####.com/11607_61_48_1f45c10d92352918.jpg?imageMo####
7s####.v2.com.####.com/11607_61_49_5db254705d9c2d7e.jpg?imageMo####
7s####.v2.com.####.com/11607_61_4_c928cd073bdf732e.jpg?imageMo####
7s####.v2.com.####.com/11607_61_50_c9509329228e0d0b.jpg?imageMo####
7s####.v2.com.####.com/11607_61_51_d41bd798309c4f13.jpg?imageMo####
7s####.v2.com.####.com/11607_61_52_6e992f0c1a0d740f.jpg?imageMo####
7s####.v2.com.####.com/11607_61_53_c6ddd403a21a52b3.jpg?imageMo####
7s####.v2.com.####.com/11607_61_54_a9628ba5cbd5568c.jpg?imageMo####
7s####.v2.com.####.com/11607_61_55_95e860531647b250.jpg?imageMo####
7s####.v2.com.####.com/11607_61_56_c5dd46c4b7fd2a24.jpg?imageMo####
7s####.v2.com.####.com/11607_61_57_c42caeaf512bf71b.jpg?imageMo####
7s####.v2.com.####.com/11607_61_58_9ac0bd9e7a9ea2f4.jpg?imageMo####
7s####.v2.com.####.com/11607_61_59_3c7154dabb545c70.jpg?imageMo####
7s####.v2.com.####.com/11607_61_5_2aa4d73c52c7a3a6.jpg?imageMo####
7s####.v2.com.####.com/11607_61_60_8f5693ee6c7285be.jpg?imageMo####
7s####.v2.com.####.com/11607_61_61_a01780579995b629.jpg?imageMo####
7s####.v2.com.####.com/11607_61_62_e2f17e774029157d.jpg?imageMo####
7s####.v2.com.####.com/11607_61_63_dd58fe4cc72651db.jpg?imageMo####
7s####.v2.com.####.com/11607_61_64_042aea7078e5301e.jpg?imageMo####
7s####.v2.com.####.com/11607_61_65_a6e4df4a693e3bc2.jpg?imageMo####
7s####.v2.com.####.com/11607_61_66_973f938aaed4b18b.jpg?imageMo####
7s####.v2.com.####.com/11607_61_67_b4110a43f655cd3b.jpg?imageMo####
7s####.v2.com.####.com/11607_61_68_5114fa71d22e0576.jpg?imageMo####
7s####.v2.com.####.com/11607_61_69_83fc9d2f7de51840.jpg?imageMo####
7s####.v2.com.####.com/11607_61_6_098ca3e14765640f.jpg?imageMo####
7s####.v2.com.####.com/11607_61_70_2365f5ac8f114d04.jpg?imageMo####
7s####.v2.com.####.com/11607_61_71_96d0dfad0c44a993.jpg?imageMo####
7s####.v2.com.####.com/11607_61_72_b7c735fc94e97d29.jpg?imageMo####
7s####.v2.com.####.com/11607_61_73_e265933ab85518b9.jpg?imageMo####
7s####.v2.com.####.com/11607_61_74_a32f79ea46e1e8cb.jpg?imageMo####
7s####.v2.com.####.com/11607_61_75_6e23baf10f094478.jpg?imageMo####
7s####.v2.com.####.com/11607_61_76_f172d82b1e2a2835.jpg?imageMo####
7s####.v2.com.####.com/11607_61_77_674902c86520f270.jpg?imageMo####
7s####.v2.com.####.com/11607_61_78_31307d456544e7b2.jpg?imageMo####
7s####.v2.com.####.com/11607_61_79_e5480828f422f732.jpg?imageMo####
7s####.v2.com.####.com/11607_61_7_47b94504cfcc4a8c.jpg?imageMo####
7s####.v2.com.####.com/11607_61_80_3b1b3abdcb7266bd.jpg?imageMo####
7s####.v2.com.####.com/11607_61_81_34eebf149951700b.jpg?imageMo####
7s####.v2.com.####.com/11607_61_82_96ea603821438acd.jpg?imageMo####
7s####.v2.com.####.com/11607_61_83_da8c8914fe957197.jpg?imageMo####
7s####.v2.com.####.com/11607_61_84_f9fc54927bf6da8e.jpg?imageMo####
7s####.v2.com.####.com/11607_61_85_61cf11c076511b21.jpg?imageMo####
7s####.v2.com.####.com/11607_61_86_4e08d6e68ef5bca0.jpg?imageMo####
7s####.v2.com.####.com/11607_61_8_207c8a329ec4a157.jpg?imageMo####
7s####.v2.com.####.com/11607_61_9_e4a2a81955f2cb4e.jpg?imageMo####
7s####.v2.com.####.com/11607_61_acover_daca1b6f6aeb60d2.jpg?imageVi####
7s####.v2.com.####.com/11607_ccover_a56b6c3b1a75ee23.jpg?imageVi####
7s####.v2.com.####.com/11607_ccover_hp_e04b603a726cc41e.jpg?imageVi####
7s####.v2.com.####.com/11813_ccover_hp_559ad394c6d8dd0c.jpg?imageVi####
7s####.v2.com.####.com/12294_ccover_hp_5717e8380b6ff7a7.jpg?imageVi####
7s####.v2.com.####.com/12955_ccover_hp_d3fb61c54730a263.jpg?imageVi####
7s####.v2.com.####.com/13012_ccover_hp_10ce8f15bd0fc06f.jpg?imageVi####

Запросы HTTP POST:

a####.exc.mob.com/errconf
a####.u####.com/app_logs
api.s####.mob.com/conf4
api.s####.mob.com/conn
api.s####.mob.com/data2
api.s####.mob.com/log4
api.s####.mob.com/snsconf
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
p####.ico####.com/categorylist
p####.ico####.com/handshake
p####.ico####.com/homepage
t.p####.ico####.com/comicdetail
t.p####.ico####.com/epinfo
t.p####.ico####.com/getcomments2
t.p####.ico####.com/getextinfo
t.p####.ico####.com/splashinfo
t.p####.ico####.com/syncextinfo

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/ContextData.xml
/data/data/####/ICOMICO_PREFERENCE.xml
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/icomico_db-journal
/data/data/####/libjiagu1300469306.so
/data/data/####/mob_sdk_exception_1.xml
/data/data/####/mobclick_agent_cached_com.txj.anime.complete490
/data/data/####/mobclick_agent_online_setting_com.txj.anime.complete.xml
/data/data/####/share_sdk_1.xml
/data/data/####/sharesdk.db-journal
/data/data/####/ufvmaz.jar
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/ze34d6517.xml
/data/media/####/.ba
/data/media/####/.dk
/data/media/####/.lock
/data/media/####/128bfqtlwmgvnoysepmxqk44h.0.tmp
/data/media/####/128bfqtlwmgvnoysepmxqk44h.downtmp.downtmp
/data/media/####/15hh014wxoa5oc92fzrq221b8.0.tmp
/data/media/####/15hh014wxoa5oc92fzrq221b8.downtmp.downtmp
/data/media/####/19nd0vgyv0nd8t3j1wtiyryzx.0.tmp
/data/media/####/19nd0vgyv0nd8t3j1wtiyryzx.downtmp.downtmp
/data/media/####/19y6210lnoqqwvc1vzg7mk550.0.tmp
/data/media/####/1egmsa7eyrl0apr6iuzpz1ttx.0.tmp
/data/media/####/1egmsa7eyrl0apr6iuzpz1ttx.downtmp.downtmp
/data/media/####/1o7u0du72xpcqyzjneo3rzmzk.0.tmp
/data/media/####/1o7u0du72xpcqyzjneo3rzmzk.downtmp.downtmp
/data/media/####/1qqy6hfkb7mbovew1norx8omk.0.tmp
/data/media/####/1qqy6hfkb7mbovew1norx8omk.downtmp.downtmp
/data/media/####/1uuggn0984nukfm2q9ga2k3g5.0.tmp
/data/media/####/1uuggn0984nukfm2q9ga2k3g5.downtmp.downtmp
/data/media/####/1uv5o6ls9bht7j3ibsj7hapjh.0.tmp
/data/media/####/1uv5o6ls9bht7j3ibsj7hapjh.downtmp.downtmp
/data/media/####/1vjiepdrztues1oh4jz6k408p.0.tmp
/data/media/####/1vjiepdrztues1oh4jz6k408p.downtmp.downtmp
/data/media/####/1x14rvbxq1vrxd30pi58y80jx.0.tmp
/data/media/####/1x14rvbxq1vrxd30pi58y80jx.downtmp.downtmp
/data/media/####/1y7gn73qyuuu1hoffahcf1ka.0.tmp
/data/media/####/1ybcf7dzo4jksz3m46jty8grv.0.tmp
/data/media/####/1ybcf7dzo4jksz3m46jty8grv.downtmp.downtmp
/data/media/####/2090kzo6upemh1yy8li5hj1rp.0.tmp
/data/media/####/2090kzo6upemh1yy8li5hj1rp.downtmp.downtmp
/data/media/####/24p5nnb0lmcjk49gkxpz3kggt.0.tmp
/data/media/####/24p5nnb0lmcjk49gkxpz3kggt.downtmp.downtmp
/data/media/####/27zq3sdy1onum6a1spx6hqyhf.0.tmp
/data/media/####/28o227jm8kggnbhu0rcjyzlzp.0.tmp
/data/media/####/28o227jm8kggnbhu0rcjyzlzp.downtmp.downtmp
/data/media/####/29022b4znnuof3tds6t5vxca3.0.tmp
/data/media/####/29iggrm04w95sl4ahpkxia5v8.0.tmp
/data/media/####/29iggrm04w95sl4ahpkxia5v8.downtmp.downtmp
/data/media/####/2bmjscesxk06gilz4uvoisd38.0.tmp
/data/media/####/2bmjscesxk06gilz4uvoisd38.downtmp.downtmp
/data/media/####/2cwmpmwu64g90yi6bnqklula1.0.tmp
/data/media/####/2cwmpmwu64g90yi6bnqklula1.downtmp.downtmp
/data/media/####/2dqv287v8zskcwvvmbhk7yi6b.0.tmp
/data/media/####/2dqv287v8zskcwvvmbhk7yi6b.downtmp.downtmp
/data/media/####/2dwklnbr29xannr2689a314e2.0.tmp
/data/media/####/2dwklnbr29xannr2689a314e2.downtmp.downtmp
/data/media/####/2edopznx1u5n463002tbxogbw.0.tmp
/data/media/####/2edopznx1u5n463002tbxogbw.downtmp.downtmp
/data/media/####/2f0pe4zfx4hvd6jzj4jvcphrt.0.tmp
/data/media/####/2f0pe4zfx4hvd6jzj4jvcphrt.downtmp.downtmp
/data/media/####/2f6dxflvpwln9vdgyvascoaul.0.tmp
/data/media/####/2hvo0wcqysqeltyl4zx4f66o3.0.tmp
/data/media/####/2ilpuy8dotwys4swc2q1l5xva.0.tmp
/data/media/####/2ilpuy8dotwys4swc2q1l5xva.downtmp.downtmp
/data/media/####/2nm1helnhsniuqecav8t2q5p9.0.tmp
/data/media/####/2nm1helnhsniuqecav8t2q5p9.downtmp.downtmp
/data/media/####/2ogoelelnp588kk9ir20818t7.0.tmp
/data/media/####/2ogoelelnp588kk9ir20818t7.downtmp.downtmp
/data/media/####/2rxffy8rjblleu2x427tsbrj8.0.tmp
/data/media/####/2rxffy8rjblleu2x427tsbrj8.downtmp.downtmp
/data/media/####/2vdke6yoxo5aqbl7unna7etdj.0.tmp
/data/media/####/2xkm004vqbmx9dhax82dmirp7.0.tmp
/data/media/####/2xkm004vqbmx9dhax82dmirp7.downtmp.downtmp
/data/media/####/2y8mtbz6k6d56q91fv3yxu3vn.0.tmp
/data/media/####/2y8mtbz6k6d56q91fv3yxu3vn.downtmp.downtmp
/data/media/####/30n3kubvsk0cz84zwkr9ll3v5.0.tmp
/data/media/####/30n3kubvsk0cz84zwkr9ll3v5.downtmp.downtmp
/data/media/####/348lexqoghxv0fh675n7lljd0.0.tmp
/data/media/####/38bx8omvsrx5wnq2zq8tcvbhq.0.tmp
/data/media/####/3cmg0khp03p0jfmqyldl80vqv.0.tmp
/data/media/####/3cmg0khp03p0jfmqyldl80vqv.downtmp.downtmp
/data/media/####/3fe6njtbv91pm7qunrl1fdcgd.0.tmp
/data/media/####/3fe6njtbv91pm7qunrl1fdcgd.downtmp.downtmp
/data/media/####/3glurq7ngp0z6mrpxyyh93ien.0.tmp
/data/media/####/3glurq7ngp0z6mrpxyyh93ien.downtmp.downtmp
/data/media/####/3hslv6ge24yjg5s3mzfosgnsi.0.tmp
/data/media/####/3hslv6ge24yjg5s3mzfosgnsi.downtmp.downtmp
/data/media/####/3jq7i2kn9ptyz79f004h8k2ix.0.tmp
/data/media/####/3jq7i2kn9ptyz79f004h8k2ix.downtmp.downtmp
/data/media/####/3kva74neenqhhmoa8uyi4k9ia.0.tmp
/data/media/####/3kva74neenqhhmoa8uyi4k9ia.downtmp.downtmp
/data/media/####/3pfnsrvpa4mpm25s1dih74kdr.0.tmp
/data/media/####/3pfnsrvpa4mpm25s1dih74kdr.downtmp.downtmp
/data/media/####/3q5at2a9kihlta73a97sq9yph.0.tmp
/data/media/####/3q5at2a9kihlta73a97sq9yph.downtmp.downtmp
/data/media/####/3s7jmy1r1z8lk1gt9fk6es29s.0.tmp
/data/media/####/3s7jmy1r1z8lk1gt9fk6es29s.downtmp.downtmp
/data/media/####/3sfssnx10yriwukqsa2yq0mai.0.tmp
/data/media/####/3srzw8qk20a9cie71kfsppxfd.0.tmp
/data/media/####/3srzw8qk20a9cie71kfsppxfd.downtmp.downtmp
/data/media/####/434c95l5w5t33vn8mryyur8zi.0.tmp
/data/media/####/434c95l5w5t33vn8mryyur8zi.downtmp.downtmp
/data/media/####/43ifndw68zfj0queqqdkbxzou.0.tmp
/data/media/####/43ifndw68zfj0queqqdkbxzou.downtmp.downtmp
/data/media/####/4bnf047g9my4vnjdrju3mmfzk.0.tmp
/data/media/####/4bnf047g9my4vnjdrju3mmfzk.downtmp.downtmp
/data/media/####/4eh1uoyfsxxkf16blh4x9emkh.0.tmp
/data/media/####/4eh1uoyfsxxkf16blh4x9emkh.downtmp.downtmp
/data/media/####/4fdbf570rb9f4l1btmjkryuo8.0.tmp
/data/media/####/4fdbf570rb9f4l1btmjkryuo8.downtmp.downtmp
/data/media/####/4l2gakzi7gtuphjxyxes1c32f.0.tmp
/data/media/####/4l6164ibhgvlsuts817my200x.0.tmp
/data/media/####/4l6164ibhgvlsuts817my200x.downtmp.downtmp
/data/media/####/4lo7gnfsh5oj1k6u1mt6at0z8.0.tmp
/data/media/####/4occq9hetely1mmp3asbry5m.0.tmp
/data/media/####/4occq9hetely1mmp3asbry5m.downtmp.downtmp
/data/media/####/4q67ucfmpz9mutz377mfkmzcy.0.tmp
/data/media/####/53n4y19hux9mgwwsqj7623e3t.0.tmp
/data/media/####/53n4y19hux9mgwwsqj7623e3t.downtmp.downtmp
/data/media/####/574sznsb7ez9jl9if4s879mns.0.tmp
/data/media/####/574sznsb7ez9jl9if4s879mns.downtmp.downtmp
/data/media/####/5ci5fs6bisxyhsiqeytt1rn03.0.tmp
/data/media/####/5ci5fs6bisxyhsiqeytt1rn03.downtmp.downtmp
/data/media/####/5dfsxyx9qvk953i4x2v9hy161.0.tmp
/data/media/####/5dfsxyx9qvk953i4x2v9hy161.downtmp.downtmp
/data/media/####/5j4mjpyydpwldwxpkx4l6g5ak.0.tmp
/data/media/####/5kdqh9h13qgjqkyba38wfmnqj.0.tmp
/data/media/####/5kdqh9h13qgjqkyba38wfmnqj.downtmp.downtmp
/data/media/####/5sxbae1nvo3cm1xbntyakf7zl.0.tmp
/data/media/####/5sxbae1nvo3cm1xbntyakf7zl.downtmp.downtmp
/data/media/####/5vkoqftzh631r0sg1t120qjwg.0.tmp
/data/media/####/5vkoqftzh631r0sg1t120qjwg.downtmp.downtmp
/data/media/####/61yq5s7nsv2999s03s9bkjrfz.0.tmp
/data/media/####/61yq5s7nsv2999s03s9bkjrfz.downtmp.downtmp
/data/media/####/62ign02fwti2lu2gb1gptuyk6.0.tmp
/data/media/####/62ign02fwti2lu2gb1gptuyk6.downtmp.downtmp
/data/media/####/6475zj02r81d2thyr3r8o9r3.0.tmp
/data/media/####/6475zj02r81d2thyr3r8o9r3.downtmp.downtmp
/data/media/####/65wc04j26sniz45po7ljinz6o.0.tmp
/data/media/####/65wc04j26sniz45po7ljinz6o.downtmp.downtmp
/data/media/####/678qic503bru7xb4o2hv6j7dl.0.tmp
/data/media/####/678qic503bru7xb4o2hv6j7dl.downtmp.downtmp
/data/media/####/683uq4l3ugjp6nxexs2wgvf43.0.tmp
/data/media/####/683uq4l3ugjp6nxexs2wgvf43.downtmp.downtmp
/data/media/####/6awlnk5tq9xn4k1tp7xredrvk.0.tmp
/data/media/####/6awlnk5tq9xn4k1tp7xredrvk.downtmp.downtmp
/data/media/####/6bg68vxpg5focnzvrzr6s1p48.0.tmp
/data/media/####/6bg68vxpg5focnzvrzr6s1p48.downtmp.downtmp
/data/media/####/6ce9422ylb0irxx6xen0qsu2p.0.tmp
/data/media/####/6ce9422ylb0irxx6xen0qsu2p.downtmp.downtmp
/data/media/####/6iipf4ddnkxs2h7olh8ce4utj.0.tmp
/data/media/####/6iipf4ddnkxs2h7olh8ce4utj.downtmp.downtmp
/data/media/####/6m9v5mq2i0ru57yhlt2rakkzx.0.tmp
/data/media/####/6m9v5mq2i0ru57yhlt2rakkzx.downtmp.downtmp
/data/media/####/6ok177o2oekec8cc7uxw7zf5u.0.tmp
/data/media/####/6ok177o2oekec8cc7uxw7zf5u.downtmp.downtmp
/data/media/####/6op0afz3mkjbaohf2hpowswg0.0.tmp
/data/media/####/6op0afz3mkjbaohf2hpowswg0.downtmp.downtmp
/data/media/####/6pjjrssh3i99xcp25wt7l0vq1.0.tmp
/data/media/####/6pjjrssh3i99xcp25wt7l0vq1.downtmp.downtmp
/data/media/####/6pqcgc7cbsih05ezu4zqtcmf2.0.tmp
/data/media/####/6rp61skcmw0cxs1l6erc7bdd0.0.tmp
/data/media/####/6rp61skcmw0cxs1l6erc7bdd0.downtmp.downtmp
/data/media/####/6zt01gez1fqt1drp0zj1w9d9u.0.tmp
/data/media/####/71mktlu3ubwb7wffznue8z3ym.0.tmp
/data/media/####/71mktlu3ubwb7wffznue8z3ym.downtmp.downtmp
/data/media/####/747l527s1co7s4rcg879tm1ub.0.tmp
/data/media/####/747l527s1co7s4rcg879tm1ub.downtmp.downtmp
/data/media/####/751muc9ira96pr4nuijtl8oix.0.tmp
/data/media/####/751muc9ira96pr4nuijtl8oix.downtmp.downtmp
/data/media/####/77mp5nda86iwdf6nulau6ihr4.0.tmp
/data/media/####/78diog86jmcu14ian04b9latf.0.tmp
/data/media/####/78diog86jmcu14ian04b9latf.downtmp.downtmp
/data/media/####/7ajr4mwen584gaagfwmf21kpm.0.tmp
/data/media/####/7ajr4mwen584gaagfwmf21kpm.downtmp.downtmp
/data/media/####/7b689l62fgpermxng9xrvutak.0.tmp
/data/media/####/7b689l62fgpermxng9xrvutak.downtmp.downtmp
/data/media/####/7bj247oo8mwis3mt4mcg0nycy.0.tmp
/data/media/####/9cevsrgrllqbunxzp5ernc1w.0.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/akv39dat5b9piqylplbnqk55.0.tmp
/data/media/####/b3u30d78ro54cy2wyq98b6zm.0.tmp
/data/media/####/bdh681rsik6ofa04kiuvvnyq.0.tmp
/data/media/####/fjwk00uhnw1efelnh4fm6mdv.0.tmp
/data/media/####/fjwk00uhnw1efelnh4fm6mdv.downtmp.downtmp
/data/media/####/fsa3cmz8275virucb89cpemb.0.tmp
/data/media/####/fsa3cmz8275virucb89cpemb.downtmp.downtmp
/data/media/####/gzf3u5s6xoqadey0zzrq7nrm.0.tmp
/data/media/####/gzf3u5s6xoqadey0zzrq7nrm.downtmp.downtmp
/data/media/####/journal.tmp
/data/media/####/lmlxn52vfzoh4netjtem0w72.0.tmp
/data/media/####/lmlxn52vfzoh4netjtem0w72.downtmp.downtmp
/data/media/####/ngqc7z7lqe7xeh07h1i1oky0.0.tmp
/data/media/####/ngqc7z7lqe7xeh07h1i1oky0.downtmp.downtmp
/data/media/####/p1odgtf9sc1p7npgbpq9bsbx.0.tmp
/data/media/####/p1odgtf9sc1p7npgbpq9bsbx.downtmp.downtmp
/data/media/####/pjfirjeferke3d8m833wd0uo.0.tmp
/data/media/####/pjfirjeferke3d8m833wd0uo.downtmp.downtmp
/data/media/####/pwcqbckpfwqnqs0otw8cnhsi.0.tmp
/data/media/####/pwcqbckpfwqnqs0otw8cnhsi.downtmp.downtmp
/data/media/####/tgwv7cr5qrhv17a93kyonxvz.0.tmp
/data/media/####/tgwv7cr5qrhv17a93kyonxvz.downtmp.downtmp
/data/media/####/tv8034rlhh74fr257nvypglp.0.tmp
/data/media/####/tv8034rlhh74fr257nvypglp.downtmp.downtmp

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu1300469306.so

Загружает динамические библиотеки:

libjiagu1300469306
neh

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding
DES

Использует следующие алгоритмы для расшифровки данных:

AES-ECB-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней