Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Spy.127.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) x####.tc.qq.com:80
- TCP(HTTP/1.1) m####.qy.net:80
- TCP(HTTP/1.1) st####.i####.com.####.net:80
- TCP(HTTP/1.1) contr####.i####.com:80
- TCP(HTTP/1.1) m####.v####.i####.com:80
- TCP(HTTP/1.1) fupi####.biaoqin####.com.####.cn:80
- TCP(HTTP/1.1) t7z.c####.i####.com:80
- TCP(HTTP/1.1) pa####.i####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) i####.i####.com:80
- TCP(HTTP/1.1) v.qq.com.####.net:80
- TCP(HTTP/1.1) fuciyua####.biaoqin####.com.####.cn:80
- TCP(HTTP/1.1) secu####.i####.com:80
- TCP(HTTP/1.1) iqiy####.com.edg####.net:80
- TCP(HTTP/1.1) subscri####.i####.com:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) d####.v####.i####.com:80
- TCP(HTTP/1.1) fuciyua####.biaoqin####.com:80
- TCP(HTTP/1.1) d####.b####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) u####.biaoqin####.com:80
- TCP(HTTP/1.1) sns-com####.i####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) i####.com.edg####.net:80
- TCP(TLS/1.0) x####.tc.qq.com:443
- TCP(TLS/1.0) ipv6-as####.m.ta####.com:443
- TCP(TLS/1.0) 1####.217.168.238:443
- TCP(TLS/1.0) c####.i####.com:443
- TCP(TLS/1.0) secu####.i####.com:443
- TCP(TLS/1.0) v.qq.com.####.net:443
- TCP(TLS/1.0) bt####.qq.com:443
- TCP(TLS/1.0) v####.qq.com.####.net:443
- TCP(TLS/1.0) d####.b####.com:443
Запросы DNS:
- a####.u####.com
- api.y####.com
- b.scoreca####.com
- bt####.qq.com
- c####.i####.com
- c####.v####.i####.com
- car####.chu####.com
- contr####.i####.com
- d####.b####.com
- d####.v####.i####.com
- fuciyua####.biaoqin####.com
- fuciyua####.biaoqin####.com
- fupi####.biaoqin####.com
- hm.b####.com
- i####.i####.com
- i.g####.cn
- m####.qy.net
- m####.v####.i####.com
- m.i####.com
- m.iqiy####.com
- m.v.q####.com
- mo####.b####.com
- oc.u####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.q####.cn
- pa####.i####.com
- pub.m.i####.com
- secu####.i####.com
- sns-com####.i####.com
- st####.i####.com
- subscri####.i####.com
- t7z.c####.i####.com
- u####.biaoqin####.com
- v####.qq.com
- v.q####.com
- vm.g####.cn
- w####.qy.net
- www.i####.com
- www.iqiy####.com
Запросы HTTP GET:
- b.scoreca####.com.####.net/beacon.js
- contr####.i####.com/control/content_config?business=####&is_iqiyi=####&i...
- d####.b####.com/x.gif?he=[mag####&prot_ver=####&app_id=####&rnd=####&log...
- d####.b####.com/x.js?si=####&dm=####
- d####.v####.i####.com/v.mp4?_=####&callback=####
- fuciyua####.biaoqin####.com.####.cn/works/0/102050.jpg
- fuciyua####.biaoqin####.com.####.cn/works/0/108340.jpg
- fuciyua####.biaoqin####.com.####.cn/works/1/102051.jpg
- fuciyua####.biaoqin####.com.####.cn/works/2/108312.jpg
- fuciyua####.biaoqin####.com.####.cn/works/2/108332.jpg
- fuciyua####.biaoqin####.com.####.cn/works/3/108313.jpg
- fuciyua####.biaoqin####.com.####.cn/works/4/36184.jpg
- fuciyua####.biaoqin####.com.####.cn/works/4/36194.jpg
- fuciyua####.biaoqin####.com.####.cn/works/5/102025.jpg
- fuciyua####.biaoqin####.com.####.cn/works/5/108325.jpg
- fuciyua####.biaoqin####.com.####.cn/works/6/102046.jpg
- fuciyua####.biaoqin####.com.####.cn/works/6/108336.jpg
- fuciyua####.biaoqin####.com.####.cn/works/6/36316.jpg
- fuciyua####.biaoqin####.com.####.cn/works/6/95656.jpg
- fuciyua####.biaoqin####.com.####.cn/works/7/102047.jpg
- fuciyua####.biaoqin####.com.####.cn/works/7/108337.jpg
- fuciyua####.biaoqin####.com.####.cn/works/8/102058.jpg
- fuciyua####.biaoqin####.com.####.cn/works/8/108338.jpg
- fuciyua####.biaoqin####.com.####.cn/works/8/81838.jpg
- fuciyua####.biaoqin####.com.####.cn/works/9/102049.jpg
- fuciyua####.biaoqin####.com.####.cn/works/9/108339.jpg
- fuciyua####.biaoqin####.com.####.cn/works/9/36419.jpg
- fuciyua####.biaoqin####.com.####.cn/works/9/40249.jpg
- fuciyua####.biaoqin####.com.####.cn/works/9/78959.jpg
- fuciyua####.biaoqin####.com/config/adcontrol.json?plat=####&ver=####&uid...
- fuciyua####.biaoqin####.com/fuciyuan/v1//videov1main_1.json?plat=####&ve...
- fuciyua####.biaoqin####.com/fuciyuan/v1/comic1_1.json?plat=####&ver=####...
- fuciyua####.biaoqin####.com/fuciyuan/v1/comic3_1.json?plat=####&ver=####...
- fuciyua####.biaoqin####.com/fuciyuan/v1/comic4_1.json?plat=####&ver=####...
- fuciyua####.biaoqin####.com/fuciyuan/v1/comic6_1.json?plat=####&ver=####...
- fuciyua####.biaoqin####.com/fuciyuan/v1/comichot_1.json?plat=####&ver=##...
- fuciyua####.biaoqin####.com/fuciyuan/v1/comicmain_1.json?plat=####&ver=#...
- fuciyua####.biaoqin####.com/fupic/v1/fupicmain_1.json?plat=####&ver=####...
- fuciyua####.biaoqin####.com/fupic/v1/pics/hot/1.json?plat=####&ver=####&...
- fupi####.biaoqin####.com.####.cn/16/16.jpg
- fupi####.biaoqin####.com.####.cn/167/167.jpg
- fupi####.biaoqin####.com.####.cn/269/269.jpg
- fupi####.biaoqin####.com.####.cn/272/272.jpg
- fupi####.biaoqin####.com.####.cn/288/288.jpg
- fupi####.biaoqin####.com.####.cn/419/419.jpg
- fupi####.biaoqin####.com.####.cn/48/48.jpg
- fupi####.biaoqin####.com.####.cn/596/596.jpg
- fupi####.biaoqin####.com.####.cn/97/97.jpg
- fupi####.biaoqin####.com.####.cn/channels/17/17.jpg
- fupi####.biaoqin####.com.####.cn/channels/21/21.jpg
- fupi####.biaoqin####.com.####.cn/channels/27/27.jpg
- fupi####.biaoqin####.com.####.cn/channels/28/28.jpg
- fupi####.biaoqin####.com.####.cn/channels/30/30.jpg
- fupi####.biaoqin####.com.####.cn/channels/34/34.jpg
- fupi####.biaoqin####.com.####.cn/channels/40/40.jpg
- fupi####.biaoqin####.com.####.cn/channels/43/43.jpg
- fupi####.biaoqin####.com.####.cn/channels/44/44.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/103/103.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/104/104.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/110/110.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/114/114.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/16/16.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/28/28.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/47/47.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/91/91.jpg
- fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/94/94.jpg
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?5df871a####
- i####.com.edg####.net/css/2018090317/h5-comment-aura2.css
- i####.com.edg####.net/css/2018090317/h5-play-v4.css
- i####.com.edg####.net/ext/common/fontIcon20180912/iconfont.ttf
- i####.com.edg####.net/js/common/7d183edd03bc4414b315e8964fb41826.js
- i####.com.edg####.net/js/common/ares4-h5.min.js
- i####.com.edg####.net/js/html5/js/lib/clipboard.min.js
- i####.com.edg####.net/js/html5/js/lib/lib.2.0.8.min.js?sea1.2.####
- i####.com.edg####.net/js/html5/js/lib/qoe.3.0.3.min.js?v=####
- i####.com.edg####.net/js/html5/js/page/playVip/6624ae4fce!app.js
- i####.com.edg####.net/w_19rrm9x1p1.html
- i####.i####.com/irt?_iwt_t=####&_iwt_id=####&_iwt_UA=####&r=####
- iqiy####.com.edg####.net/common/20180627/reliao_1530091658440.png
- iqiy####.com.edg####.net/common/fix/h5-aura/foot.png
- iqiy####.com.edg####.net/common/fix/h5-aura/picicon-bg-20180509.png
- iqiy####.com.edg####.net/common/fix/h5-aura/player-bg.png
- iqiy####.com.edg####.net/common/fix/h5-aura/player-default-logo.png
- iqiy####.com.edg####.net/common/fix/h5-v3/iqiyi-logo.png
- iqiy####.com.edg####.net/common/fix/h5-v3/logoH5_v-2x.png
- iqiy####.com.edg####.net/common/fix/h5-v3/player-tip-bg.jpg
- iqiy####.com.edg####.net/common/fix/h5-v3/privilege-gold-icon.png
- iqiy####.com.edg####.net/common/fix/h5-v3/video-comment-new.png
- iqiy####.com.edg####.net/image/20160426/4a/21/a_100024574_m_601_m2_195_2...
- iqiy####.com.edg####.net/image/20170702/0b/65/a_100058449_m_601_m1_195_2...
- iqiy####.com.edg####.net/image/20171222/20/9d/a_100117057_m_601_m1_195_2...
- iqiy####.com.edg####.net/image/20180129/d8/51/a_100039926_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20180209/4a/2b/a_100094385_m_601_m8_195_2...
- iqiy####.com.edg####.net/image/20180217/98/36/v_109199711_m_601_m2_195_2...
- iqiy####.com.edg####.net/image/20180220/93/eb/v_113763212_m_601_m2_195_2...
- iqiy####.com.edg####.net/image/20180220/bb/b8/v_112870244_m_601_m1_195_2...
- iqiy####.com.edg####.net/image/20180301/16/16/a_100124019_m_601_m5_195_2...
- iqiy####.com.edg####.net/image/20180323/93/eb/a_100048851_m_601_m11_195_...
- iqiy####.com.edg####.net/image/20180420/e1/c0/v_113158420_m_601_m5_195_2...
- iqiy####.com.edg####.net/image/20180427/dc/0d/a_100143170_m_601_195_260....
- iqiy####.com.edg####.net/image/20180508/07/b8/a_100025409_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20180605/79/f5/a_100041454_m_601_m4_195_2...
- iqiy####.com.edg####.net/image/20180630/23/24/a_100047333_m_601_m19_195_...
- iqiy####.com.edg####.net/image/20180715/ab/fd/a_100052075_m_601_m2_195_2...
- iqiy####.com.edg####.net/image/20180909/db/af/v_114991190_m_601_m11_195_...
- iqiy####.com.edg####.net/image/20180930/84/a8/v_112882553_m_601_m5_195_2...
- iqiy####.com.edg####.net/image/20181001/27/08/a_100184644_m_601_m1_195_2...
- iqiy####.com.edg####.net/image/20181001/55/a1/a_100195478_m_601_195_260....
- iqiy####.com.edg####.net/image/20181001/ac/94/a_100195488_m_601_195_260....
- iqiy####.com.edg####.net/image/20181011/32/36/a_100104204_m_601_m3_195_2...
- iqiy####.com.edg####.net/image/20181012/f5/ed/a_100011754_m_601_m2_195_2...
- iqiy####.com.edg####.net/image/20181012/fc/85/a_100134561_m_601_m1_195_2...
- iqiy####.com.edg####.net/image/20181017/86/11/a_100042872_m_601_m4_195_2...
- iqiy####.com.edg####.net/image/20181022/e6/26/a_100198737_m_601_m4_195_2...
- iqiy####.com.edg####.net/image/20181023/f8/bd/a_100104662_m_601_m4_195_2...
- iqiy####.com.edg####.net/image/20181026/af/93/a_100109327_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20181031/24/f2/v_114319402_m_601_m10_195_...
- iqiy####.com.edg####.net/image/20181122/17/d4/a_100209533_m_601_m10_195_...
- iqiy####.com.edg####.net/image/20181214/96/1c/a_100137561_m_601_m1_195_2...
- iqiy####.com.edg####.net/image/20181217/d1/87/a_100219049_m_601_m3_195_2...
- iqiy####.com.edg####.net/image/20181220/f7/1f/v_115505711_m_601_m18_195_...
- iqiy####.com.edg####.net/image/20181226/74/0a/a_100091879_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20181226/9d/f5/a_100170635_m_601_m3_195_2...
- iqiy####.com.edg####.net/image/20190104/dc/de/a_100158523_m_601_m5_195_2...
- iqiy####.com.edg####.net/image/20190108/03/50/a_100131469_m_601_m7_195_2...
- iqiy####.com.edg####.net/image/20190109/61/de/a_100093613_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20190123/3e/c6/a_100158488_m_601_m8_195_2...
- iqiy####.com.edg####.net/image/20190123/5f/5b/v_119121314_m_601_m11_195_...
- iqiy####.com.edg####.net/image/20190124/3f/eb/v_113937132_m_601_m8_195_2...
- iqiy####.com.edg####.net/image/20190125/f9/e1/v_123812601_m_601_m11_195_...
- iqiy####.com.edg####.net/image/20190126/25/a4/v_112883389_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20190128/4e/47/v_120865543_m_601_m10_195_...
- iqiy####.com.edg####.net/image/20190128/d0/2b/v_121317444_m_601_m5_195_2...
- iqiy####.com.edg####.net/image/20190128/ed/a7/a_100013977_m_601_m15_195_...
- iqiy####.com.edg####.net/image/20190130/4e/74/v_114536239_m_601_m16_195_...
- iqiy####.com.edg####.net/image/20190131/85/1a/v_121598276_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20190131/b3/a5/v_124600672_m_601_m7_195_2...
- iqiy####.com.edg####.net/image/20190131/b6/a4/v_122211083_m_601_m6_195_2...
- iqiy####.com.edg####.net/image/20190201/25/01/a_100212863_m_601_m4_195_2...
- iqiy####.com.edg####.net/image/20190201/27/79/a_100212855_m_601_m5_195_2...
- iqiy####.com.edg####.net/image/20190201/35/73/v_115489340_m_601_m5_195_2...
- iqiy####.com.edg####.net/image/20190201/68/37/v_124143977_m_601_m1_195_2...
- iqiy####.com.edg####.net/image/20190202/bb/ce/v_124464831_m_601_m8_195_2...
- iqiy####.com.edg####.net/u0/image/20140111/c4/3d/65/uv_456577_m_601_m1_4...
- m####.qy.net/b?t=####&bstp=####&pf=####&p=####&p1=####&u=####&pu=####&bl...
- m####.qy.net/cp2.gif?p=####&rd=####&rc=####&t=####&e=####&y=####&u=####&...
- m####.qy.net/cp2.gif?p=####&t=####&lc=####&e=####&y=####&u=####&av=####&...
- m####.qy.net/cp2.gif?p=####&t=####&rc=####&rd=####&ai=####&e=####&y=####...
- m####.qy.net/jpb.gif?rdm=####&qtcurl=####&rfr=####&flshuid=####&lrfr=###...
- m####.qy.net/tmpstats.gif?type=####&des=####&mse=####&p2p=####&p=####
- m####.v####.i####.com/jp/recommend/videos?type=####&page=####&size=####&...
- pa####.i####.com/apis/e/paopao/list.action?authcookie=####&m_device_id=#...
- pa####.i####.com/apis/e/starwall/basic_wall.action?wallId=####&qypid=###...
- s####.tc.qq.com/error.html?ptag=####&
- secu####.i####.com/jp/h5/count/hotDisplay/?qipuId=####&channelId=####&vi...
- secu####.i####.com/jp/h5/othlist/507367609/?type=####&_=####&callback=####
- secu####.i####.com/jp/h5/play/fragment/507367609/?albumId=####&_=####&ca...
- sns-com####.i####.com/v3/comment/get_count_data.action?contentId=####&bu...
- st####.i####.com.####.net/jp/dash?tvid=####&vid=####&bid=####&abid=####&...
- subscri####.i####.com/dingyue/api/isSubscribed.action?agent_type=####&su...
- t7z.c####.i####.com/show2?e=####&h=####&a=####&u=####&p=####&s=####&_=##...
- t7z.c####.i####.com/track2?w=####&dts=####&nr=####&c=####&f=####&g=####&...
- v.qq.com.####.net/cover/q/qoy263ioaan7g0e.html?vid=####
- v.qq.com.####.net/detail/q/qoy263ioaan7g0e.html?vid=####
- v.qq.com.####.net/tencentvideo/module/appbanner/txv.js
- v.qq.com.####.net/vcover_hz_pic/0/7ae7ryh30iv3gpm1513246891/0
- v.qq.com.####.net/vcover_hz_pic/0/9ezmjzjgehkhcvlt1444782386.jpg/0
- v.qq.com.####.net/vcover_hz_pic/0/9hlxl3qzq6ds33c1480461021/0
- v.qq.com.####.net/vcover_hz_pic/0/bymafsjpccgo4bwt1444788585.jpg/0
- v.qq.com.####.net/vcover_hz_pic/0/coftfal1pyf95811496628236/0
- v.qq.com.####.net/vcover_hz_pic/0/emneqo0lf005ga41480433721/0
- v.qq.com.####.net/vcover_hz_pic/0/gtn6ik9kapbiqm01549072441/0
- v.qq.com.####.net/vcover_hz_pic/0/h2bxosnwr9jssqot1472448903.jpg/0
- v.qq.com.####.net/vcover_hz_pic/0/odl9syhuo2df0k41487574304/0
- v.qq.com.####.net/vcover_hz_pic/0/qjoizo0oirx43ja1510284768/0
- v.qq.com.####.net/vcover_hz_pic/0/srrq91kwr1fc34mt1444830170.jpg/0
- v.qq.com.####.net/vcover_hz_pic/0/uliokyyzrtrcl691522860636/0
- v.qq.com.####.net/vcover_hz_pic/0/y3nclx6tfy8ptl1t1447054225.jpg/0
- v.qq.com.####.net/vcover_hz_pic/0/z57iqzs8ttl7b1kt1472628616.jpg/0
- v.qq.com.####.net/vcover_hz_pic/0/zowhuqn2hvz7x5l1542711940/0
- v.qq.com.####.net/vupload/0/20180328_504_doki.png/0
- v.qq.com.####.net/x/cover/qoy263ioaan7g0e.html?vid=####
- v.qq.com.####.net/x/page/6E47dl0y2E4.html?ptag=####
- x####.tc.qq.com/qqlive/img/jpgcache/files/qqvideo/q/qoy263ioaan7g0e.jpg
Запросы HTTP POST:
- a####.u####.com/app_logs
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- u####.biaoqin####.com/uplog?ver=####&uid=####&sid=####&app=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/Alvin2.xml
- /data/data/####/AppInfo.xml
- /data/data/####/AppStore.xml
- /data/data/####/ContextData.xml
- /data/data/####/PlayerUIApk.apk
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/analytics_agent_header_.xml
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/f_00003b
- /data/data/####/ftime.xml
- /data/data/####/funvcomic.db-journal
- /data/data/####/index
- /data/data/####/libjiagu-1667460499.so
- /data/data/####/mobclick_agent_cached_mobi.c58579.m5467yte30
- /data/data/####/mobclick_agent_online_setting_mobi.c58579.m5467yte.xml
- /data/data/####/mobi.c58579.m5467yte_preferences.xml
- /data/data/####/umeng_feedback_user_info.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/-1002467377.jpg
- /data/media/####/-1057758762.jpg
- /data/media/####/-1072650289.jpg
- /data/media/####/-1126457235.jpg
- /data/media/####/-1169701791.jpg
- /data/media/####/-1180627701.jpg
- /data/media/####/-1198330942.jpg
- /data/media/####/-1253375639.jpg
- /data/media/####/-1310633941.jpg
- /data/media/####/-141390891.jpg
- /data/media/####/-1424516500.jpg
- /data/media/####/-1455792010.jpg
- /data/media/####/-1484758968.jpg
- /data/media/####/-1560594742.jpg
- /data/media/####/-1646140817.jpg
- /data/media/####/-1681232273.jpg
- /data/media/####/-1690600982.jpg
- /data/media/####/-1756789128.jpg
- /data/media/####/-1760369769
- /data/media/####/-1764603554
- /data/media/####/-1845058417.jpg
- /data/media/####/-1919660356.jpg
- /data/media/####/-1924673482.jpg
- /data/media/####/-194963048.jpg
- /data/media/####/-1962717524.jpg
- /data/media/####/-2008884561.jpg
- /data/media/####/-219359438.jpg
- /data/media/####/-230059249.jpg
- /data/media/####/-343331959.jpg
- /data/media/####/-473338199.jpg
- /data/media/####/-549173973.jpg
- /data/media/####/-603344439.jpg
- /data/media/####/-650551062.jpg
- /data/media/####/-722291284.jpg
- /data/media/####/-733350679.jpg
- /data/media/####/-791763376.jpg
- /data/media/####/-809186453.jpg
- /data/media/####/-827015432
- /data/media/####/-891986070.jpg
- /data/media/####/-939192693.jpg
- /data/media/####/1006482990.jpg
- /data/media/####/1039693242
- /data/media/####/1079183983.jpg
- /data/media/####/1396015500.jpg
- /data/media/####/1410450208.jpg
- /data/media/####/1513659480
- /data/media/####/1658472444.jpg
- /data/media/####/1681409273.jpg
- /data/media/####/187710210.jpg
- /data/media/####/1990760606
- /data/media/####/2057316639
- /data/media/####/2083244688
- /data/media/####/284125900.jpg
- /data/media/####/415252476.jpg
- /data/media/####/49741814.jpg
- /data/media/####/667888853
- /data/media/####/671083567.jpg
- /data/media/####/870001167.jpg
- /data/media/####/873571446.jpg
- /data/media/####/990167062.jpg
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu-1667460499.so
Загружает динамические библиотеки:
- libjiagu-1667460499
- luajava
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- DES
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
