Android.Triada.4469

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.906.origin
Android.Triada.482.origin
Android.Triada.483.origin

Сетевая активность:

Подключается к:

UDP(DNS) 1####.114.114.114:53
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) v.adma####.com.cn:80
TCP(HTTP/1.1) 47.1####.185.46:80
TCP(HTTP/1.1) res####.a####.top:80
TCP(HTTP/1.1) u####.a####.top:80
TCP(HTTP/1.1) ivy.pcon####.com.cn:80
TCP(HTTP/1.1) api.lubang####.com:80
TCP(HTTP/1.1) kou####.a####.top:80
TCP(HTTP/1.1) 47.1####.211.73:80
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) ip.j####.com:99
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) ym####.89####.com:34656
TCP(HTTP/1.1) i####.pcon####.com.cn:80
TCP(HTTP/1.1) z####.heyc####.net:80
TCP(HTTP/1.1) cdn.i.arie####.com:80
TCP(HTTP/1.1) j####.o####.com:13967
TCP(HTTP/1.1) jp####.njt####.com:10091
TCP(HTTP/1.1) q####.0####.com:13967
TCP(HTTP/1.1) 2####.187.227.204:99
TCP(HTTP/1.1) s.zhito####.com:88
TCP(HTTP/1.1) filt####.a####.top:80
TCP(HTTP/1.1) xt####.g8####.com:20149
TCP(HTTP/1.1) e4####.0r####.com:10293
TCP(HTTP/1.1) le####.gl####.cn:80
TCP(HTTP/1.1) s.zhito####.com:808
TCP(HTTP/1.1) s.zhito####.com:807
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) f####.a####.com:8000
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) 1####.62.44.93:80
TCP(HTTP/1.1) i####.com.edg####.net:80
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) wild####.go-mp####.net.####.net:443
TCP(TLS/1.0) m####.qy.net:443
TCP(TLS/1.0) t.hy####.com.cn:443
TCP(TLS/1.0) mg####.pcon####.com.cn:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) wildca####.go-mp####.net.####.net:443
TCP(TLS/1.0) i####.com.edg####.net:443
TCP(TLS/1.0) cili####.cn:443
TCP(TLS/1.0) js.3con####.com:443
TCP(TLS/1.0) 1####.217.19.206:443
TCP(TLS/1.0) cr.3con####.com:443
TCP(TLS/1.0) g.cn.miao####.com:443
TCP(TLS/1.0) pc####.i####.com:443
TCP(TLS/1.0) sb.scoreca####.com.####.net:443
TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) img.pcon####.com.####.cn:443
TCP(TLS/1.0) p####.pc####.com.cn:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) i####.pcon####.com.cn:443
TCP(TLS/1.0) i####.jd.com:443
TCP(TLS/1.0) v.adma####.com.cn:443
TCP(TLS/1.0) www.pc####.com.####.cn:443
TCP(TLS/1.0) 1####.217.17.74:443
TCP(TLS/1.0) c####.i####.com:443
TCP(TLS/1.0) ivy.pcon####.com.cn:443
TCP(TLS/1.0) pro####.pcon####.com.cn:443
TCP(TLS/1.0) stc.iqiy####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) c####.pc####.com.cn:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) st####.i####.com.####.net:443
TCP(TLS/1.0) p####.m.jd.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) iqiy####.com.edg####.net:443
TCP(TLS/1.0) g####.b####.com:443
TCP(TLS/1.0) u.j####.com:443
TCP(TLS/1.0) api.g####.vip:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) cdn.boo####.com.####.com:443
TCP(TLS/1.0) i####.i####.com:443
TCP(TLS/1.0) ad.doublec####.net:443
TCP(TLS/1.0) a####.i####.com.####.net:443
TCP(TLS/1.2) 1####.217.17.74:443

Запросы DNS:

617.a####.top
617.a####.top.####.8
a3####.fj####.cn
ad.doublec####.net
and####.google####.com
api.g####.vip
api.lubang####.com
api.meiju####.n####.####.8
api.meiju####.net/
api.yunco####.com
c####.i####.com
c####.m.i####.com
c####.mm####.com
c####.pc####.com.cn
c####.v####.i####.com
c.c####.com
c.go-mp####.net
cdn.boo####.com
cdn.i.arie####.com
cgi.con####.qq.com
cili####.cn
cr.3con####.com
d####.b####.com
dl.pcon####.com.cn
dup.baidust####.com
e4####.0r####.com
f####.a####.com
filt####.a####.top
g####.b####.com
g.cn.miao####.com
hm.b####.com
i####.i####.com
i####.iqiy####.com
i####.jd.com
i####.pcon####.com.cn
im####.pcon####.com.cn
img.pcon####.com.cn
instant####.google####.com
ip.j####.com
ip.zhito####.com
ivy.pc####.com.cn
ivy.pcon####.com.cn
j####.o####.com
jp####.njt####.com
js.3con####.com
kou####.a####.top
le####.gl####.cn
lhyysdk####.oss-cn-####.aliy####.com
m####.qy.net
mg####.pcon####.com.cn
mo####.pcon####.com.cn
note####.pcon####.com.cn
o6####.ns####.cn
p####.m.jd.com
p####.pc####.com.cn
pc####.i####.com
pcw####.i####.com
plb####.u####.com
pos.b####.com
pro####.pcon####.com.cn
q####.0####.com
res####.a####.top
s.go-mp####.net
s.zhito####.com
s4.c####.com
s5.c####.com
s9.c####.com
s96.c####.com
sb.scoreca####.com
secu####.i####.com
sn####.kv####.com
st####.i####.com
st####.q####.com
stc.iqiy####.com
t-####.hy####.com.cn
t7z.c####.i####.com
u####.a####.top
u####.u####.com
u.j####.com
v.adma####.com.cn
v1.c####.com
w####.pc####.com.cn
w####.pc####.com.cn
w####.pc####.com.cn
w####.pch####.com.cn
w####.pcon####.com.cn
w####.pcon####.com.cn
www.i####.com
www.iqiy####.com
www.pc####.com.cn
www.pcon####.com.cn
xt####.g8####.com
ym####.89####.com
z####.heyc####.net
z12.c####.com
z3.c####.com
z6.c####.com
z9.c####.com

Запросы HTTP GET:

2####.187.227.204:99/wap/index.php?0####
cdn.i.arie####.com/e/i.js
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?status_os=####&stat...
dup.baidust####.com/js/os.js
f####.a####.com:8000/DongFengSys/miaozhen.jsp?url=https://v.admaster.com...
filt####.a####.top/filter_control_617.json
i####.com.edg####.net/v_19rv6f41cw.html
i####.pcon####.com.cn/blank.gif
ip.j####.com:99/Public/Access/js/main.js
ip.j####.com:99/Public/Access/js/modules/common.js
ip.j####.com:99/Public/Access/js/modules/creifr.js
ip.j####.com:99/ip/index.html
ivy.pcon####.com.cn/click?id=####&adid=####&watch=####
kou####.a####.top/kouling.json
le####.gl####.cn/c/slgeusoir872ksjk78828fs.zip
le####.gl####.cn/one/qwertyuiot.zip
le####.gl####.cn/tp/xzxhbtzl.png
le####.gl####.cn/u/qwertyuioc.jar
pos.b####.com/actm?psi=189c8c7b28fda457cac2a67eb81ab061&di=6688728&dri=0...
pos.b####.com/fcam?psi=1121ce5ea3bfd60cfb086195c8a49d7e&di=6611856&dri=0...
res####.a####.top/LHYY.png
res####.a####.top/sdk1.png
res####.a####.top/sdk13_2.png
res####.a####.top/sdk17.png
res####.a####.top/sdk18.png
res####.a####.top/sdk5_2.png
res####.a####.top/sdk8.png
s.zhito####.com:807/528/jf0622.html
s.zhito####.com:807/528/wang/1/jd.html?9####
s.zhito####.com:807/528/wang/1/jd900.html
s.zhito####.com:808/0622/index.html
s.zhito####.com:808/0622/style="display:
s.zhito####.com:808/0622/yrc_001mobile.js
s.zhito####.com:88/wap.html
u####.a####.top/617.html
v.adma####.com.cn/i/a136990,b3871321,c2,i0,m202,8a2,8b3,h,uhttps://im-x....

Запросы HTTP POST:

api.lubang####.com/domain.php
api.lubang####.com/srp.php
api.yunco####.com/service/rest
e4####.0r####.com:10293/widlth/
e4####.0r####.com:10293/xkeila/
j####.o####.com:13967/d0oer/
j####.o####.com:13967/nheae/
jp####.njt####.com:10091/wisdom/marking
q####.0####.com:13967/d0oer/
q####.0####.com:13967/nheae/
q####.0####.com:13967/x5qn0/
xt####.g8####.com:20149/kysd7h/
ym####.89####.com:34656/aowbg/
ym####.89####.com:34656/ntmjv/
ym####.89####.com:34656/qdkle/
z####.heyc####.net/getlist
z####.heyc####.net/xlogin

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.__mob_ad_data.xml
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.usdis
/data/data/####/.zx
/data/data/####/0023197902e72edf_0
/data/data/####/005bb92749461c36_0
/data/data/####/012b6e8e224fb051_0
/data/data/####/0130d4dd9e38193d_0
/data/data/####/02eeb739472e38cc_0
/data/data/####/0325798c3add3389_0
/data/data/####/0325798c3add3389_1
/data/data/####/032ae719ffba63f8_0
/data/data/####/032ae719ffba63f8_1
/data/data/####/0389ab9faa3d953a_0
/data/data/####/03e2e792d0a4d3e2_0
/data/data/####/048e0d08c77b65b6_0
/data/data/####/066b31a0a02da63f_0
/data/data/####/06f723a54a89a4a7_0
/data/data/####/09f101986ddfd8c6_0
/data/data/####/0a8686811095fc2b_0
/data/data/####/0a8686811095fc2b_1
/data/data/####/0bf38852b10a02a4_0
/data/data/####/0cf4763d17a02981_0
/data/data/####/0ee250fa98a906b9_0
/data/data/####/0f5dddabf545f1e2_0
/data/data/####/0fe9feee9097d5d7_0
/data/data/####/1.dex (deleted)
/data/data/####/1.dex.flock (deleted)
/data/data/####/1.jar
/data/data/####/110
/data/data/####/1160aeee05f475a3_0
/data/data/####/11924cc0d1d64446_0
/data/data/####/123
/data/data/####/128fb2f9eee26bf2_0 (deleted)
/data/data/####/133
/data/data/####/13657f7b663829c0_0 (deleted)
/data/data/####/13_2.dex (deleted)
/data/data/####/13_2.dex.flock (deleted)
/data/data/####/13_2.jar
/data/data/####/141
/data/data/####/142
/data/data/####/144
/data/data/####/147abbd855e01845_0 (deleted)
/data/data/####/14f5ad10d99b247d_0
/data/data/####/153
/data/data/####/153eb0a94007a712_0
/data/data/####/155
/data/data/####/162
/data/data/####/169
/data/data/####/17.dex
/data/data/####/17.dex.flock (deleted)
/data/data/####/17.jar
/data/data/####/176
/data/data/####/177
/data/data/####/18.dex
/data/data/####/18.dex.flock (deleted)
/data/data/####/18.jar
/data/data/####/181
/data/data/####/183
/data/data/####/190
/data/data/####/192
/data/data/####/193
/data/data/####/195
/data/data/####/197
/data/data/####/199
/data/data/####/19d26efc21a5f17f_0
/data/data/####/1CC348654F9CF9BAD5D972EB721574B9.xml
/data/data/####/1a9a0d3b2be4a912_0
/data/data/####/1b15a8aec6124c17_0
/data/data/####/1c222ec45fc25b0e_0
/data/data/####/1cecf1f2200df732_0
/data/data/####/1d56cd7c9e884992_0
/data/data/####/1e9b0c914ca1ad8e_0
/data/data/####/1f3de19465a842e1_0 (deleted)
/data/data/####/212d45adb22733f1_0
/data/data/####/212d45adb22733f1_1
/data/data/####/218d629dc392c3e7_0
/data/data/####/218d629dc392c3e7_1
/data/data/####/22928daea859ca9a_0
/data/data/####/239d4872029db01c_0
/data/data/####/23f55bce25ca399f_0
/data/data/####/24651B7827BEE1FF264AF705B0C5ACCB
/data/data/####/24e5fbd19230714d_0
/data/data/####/24e5fbd19230714d_1
/data/data/####/24f6c26285ea2e4c_0
/data/data/####/269855efb55f0314_0
/data/data/####/269855efb55f0314_1
/data/data/####/27221e5fcea6f2c0_0
/data/data/####/279e4b56f5441f14_0 (deleted)
/data/data/####/27a0dd89f44bc3d3_0
/data/data/####/27b7cb7c36862b18_0 (deleted)
/data/data/####/27dac8705e581c47_0
/data/data/####/27dac8705e581c47_1
/data/data/####/280449a6c9ea1e96_0
/data/data/####/284b1d33d9d559ef_0
/data/data/####/293f299637196ed5_0
/data/data/####/2E46116119D6369FFDF3FC0F21D690C3
/data/data/####/2b4747cb54246395_0
/data/data/####/2eaf7fad13d8bcc7_0 (deleted)
/data/data/####/2f6277df271007a6_0
/data/data/####/304c7ecb35dbe1b8_0
/data/data/####/30525fca3a7eb04d_0
/data/data/####/329b3867870e7b17_0
/data/data/####/32d9ca18842e1d21_0
/data/data/####/333655dbca852426_0
/data/data/####/3483c8b52ecc6d9e_0
/data/data/####/3695f14ab58e3f76_0
/data/data/####/372673d7246711b1_0
/data/data/####/374c9dbf2b25d4a6_0
/data/data/####/37c8f94937439757_0
/data/data/####/3ba6bfe1b6979c0f_0
/data/data/####/3d4ec5116bab8fa5_0
/data/data/####/3da7a87f11231559_0
/data/data/####/3f5dea6aef19852e_0
/data/data/####/3f5dea6aef19852e_0 (deleted)
/data/data/####/40d7e7a59310f377_0
/data/data/####/4180700b0b7c59b7_0
/data/data/####/4180700b0b7c59b7_1
/data/data/####/436D56847771BA680E24B7AEE75B16A2
/data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
/data/data/####/44ded89f884d07f5_0
/data/data/####/45a420471c8dd6f2_0
/data/data/####/46a972fc3e7493ee_0
/data/data/####/485b221cdbf7aa92_0
/data/data/####/485b221cdbf7aa92_1
/data/data/####/488efb01bed1e936_0 (deleted)
/data/data/####/491e4b7afab2f8c0_0
/data/data/####/49fc355e9fea0c55_0
/data/data/####/49fc355e9fea0c55_1
/data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
/data/data/####/4ad7989c88e36102_0
/data/data/####/4beace83b205621c_0
/data/data/####/4c34fc98b0a72adc_0
/data/data/####/4ea0836981d33ab0_0
/data/data/####/4ee53ae9cefbebf3_0
/data/data/####/4fca17f2c98b6506_0
/data/data/####/51738d8614ded5d3_0
/data/data/####/52332115bea2e5702d7659cb48fa5c3a.db
/data/data/####/55160b561b657db4_0
/data/data/####/567801cf23cceefa_0 (deleted)
/data/data/####/57a3eb5bbb5c5df5_0
/data/data/####/5813aa5b12553a4f_0
/data/data/####/5912f8083746d986_0
/data/data/####/5_2.dex (deleted)
/data/data/####/5_2.dex.flock (deleted)
/data/data/####/5_2.jar
/data/data/####/5a3c8359543e969e_0
/data/data/####/5db323f23569a27d_0
/data/data/####/5f37b19ea8d17548_0 (deleted)
/data/data/####/61ae29c787853928_0
/data/data/####/61c490d6d27b31f6_0
/data/data/####/61c490d6d27b31f6_1
/data/data/####/62ca8521f5c551e4_0
/data/data/####/6925faf87931d205_0
/data/data/####/6925faf87931d205_1
/data/data/####/6a97283703a165e8_0
/data/data/####/6bdb5d0c90742b13_0 (deleted)
/data/data/####/6bf7e577b96aa2e9_0
/data/data/####/6bf7e577b96aa2e9_0 (deleted)
/data/data/####/6c5194f42d8e5d71_0
/data/data/####/6d0ebcc2ae290998_0
/data/data/####/6d0ebcc2ae290998_1
/data/data/####/6d37625f77e7bf3e_0 (deleted)
/data/data/####/6fb81d3ad3ab7b09_0
/data/data/####/70043ef8a8b403eb_0
/data/data/####/70043ef8a8b403eb_1
/data/data/####/70772331cf89b0de_0
/data/data/####/71
/data/data/####/713fd7a9b3f68fef_0
/data/data/####/716fe48458d8db67_0
/data/data/####/71a02f029cc6759e_0
/data/data/####/72591add0009ce23_0 (deleted)
/data/data/####/727babb02abf3feb_0
/data/data/####/7295ece1696c2c3e0ee9a8b27f4b49a3.db
/data/data/####/735e0911ab158d7f_0
/data/data/####/735e0911ab158d7f_1
/data/data/####/73e3c51f9e1b291e_0
/data/data/####/73eb713c32ceb2b8_0
/data/data/####/76451315b4428c44_0
/data/data/####/76924073b8c910199fef670575272677.db
/data/data/####/772ced1b59af8218_0
/data/data/####/7811bd50e1816814_0
/data/data/####/786c2308289855c6_0
/data/data/####/7958388b2794a276_0
/data/data/####/798a76691d1e09ff_0 (deleted)
/data/data/####/7b97556a3e973cda_0
/data/data/####/7e76dc5f8ccff585_0
/data/data/####/8.dex
/data/data/####/8.dex.flock (deleted)
/data/data/####/8.jar
/data/data/####/8021cf2fa696f8db_0
/data/data/####/808ae25b8aeba0a0_0
/data/data/####/81b27f5bbd36b240_0
/data/data/####/847ae2e14078274d_0
/data/data/####/84a4a0077c7d06a6_0
/data/data/####/84b89be5e70dbfb9_0
/data/data/####/84b89be5e70dbfb9_1
/data/data/####/84c27f47112d09ae_0
/data/data/####/866937e0029710d9_0
/data/data/####/88a2e8bb77d8ee4b_0
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/8a6a4fdd901c39cc_0 (deleted)
/data/data/####/8aa950fad0745cec_0
/data/data/####/8b2d40ab190347f9_0
/data/data/####/8b2d40ab190347f9_0 (deleted)
/data/data/####/8b9e0704bcd0f753_0
/data/data/####/8c1d92d638d32645_0
/data/data/####/8d015198ed883207_0
/data/data/####/8d999de25cda553b_0
/data/data/####/8d999de25cda553b_1
/data/data/####/8df51f94dad0d9d9_0
/data/data/####/8e46a276d80d9992_0
/data/data/####/8fd202430b8f7da6_0 (deleted)
/data/data/####/914D1DA6187D0B324FCDA22FC3668D79
/data/data/####/914D1DA6187D0B324FCDA22FC3668D79.dex
/data/data/####/914D1DA6187D0B324FCDA22FC3668D79.dex.flock (deleted)
/data/data/####/914D1DA6187D0B324FCDA22FC3668D79.jar
/data/data/####/914D1DA6187D0B324FCDA22FC3668D79.temp
/data/data/####/926bb91540f4c23a_0 (deleted)
/data/data/####/93
/data/data/####/93553ca6a80167d7_0
/data/data/####/93c1e879cb573796_0 (deleted)
/data/data/####/93de0e33269f205f_0
/data/data/####/9546fb402a7ec230_0
/data/data/####/95be0bd2975e4eef_0
/data/data/####/963f86617ab7ddf7_0
/data/data/####/96d4e227db77ea92_0
/data/data/####/9730d1b1b0ff9219_0
/data/data/####/97c9f7eabe3fdfa6_0
/data/data/####/97dc9ef16730ce9d_0
/data/data/####/985958d976619751_0
/data/data/####/985958d976619751_1
/data/data/####/99764e8fa5cf44cc_0 (deleted)
/data/data/####/99dc802f74bf8dfc_0 (deleted)
/data/data/####/9a51ae6b891c1205_0
/data/data/####/9a51ae6b891c1205_1
/data/data/####/9afd2ae41eb75a37_0
/data/data/####/9c3115d9a4165a3e_0
/data/data/####/9c3115d9a4165a3e_1
/data/data/####/9c5071ce6e8b0d46_0
/data/data/####/9e9e25f67bb20304_0
/data/data/####/9f0067b9f894a364_0
/data/data/####/AC6E3274059BAE8EB9EE9421F4C7ADAB
/data/data/####/AC6E3274059BAE8EB9EE9421F4C7ADAB.dex
/data/data/####/AC6E3274059BAE8EB9EE9421F4C7ADAB.dex.flock (deleted)
/data/data/####/AC6E3274059BAE8EB9EE9421F4C7ADAB.jar
/data/data/####/AC6E3274059BAE8EB9EE9421F4C7ADAB.temp
/data/data/####/CD65E4F6A62BAEF745553C02FF5D0EF4
/data/data/####/CD65E4F6A62BAEF745553C02FF5D0EF4.dex
/data/data/####/CD65E4F6A62BAEF745553C02FF5D0EF4.dex.flock (deleted)
/data/data/####/CD65E4F6A62BAEF745553C02FF5D0EF4.jar
/data/data/####/CD65E4F6A62BAEF745553C02FF5D0EF4.temp
/data/data/####/Cookies-journal
/data/data/####/HttpDNSConstantsJson.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/XkdjsIx132mM356507059351895comm.xml
/data/data/####/XkdjsIx132mM356507059351895tasks.xml
/data/data/####/XkdjsIx132mM356507059351895tasks.xml.bak
/data/data/####/XkdjsIx132mMskey1.xml
/data/data/####/_p.xml
/data/data/####/_pn
/data/data/####/_sh.xml
/data/data/####/_shn
/data/data/####/a02acb6bf0aab84f_0
/data/data/####/a18c4e17e2c2abdd_0
/data/data/####/a1ba1c9a11de5aac_0
/data/data/####/a23b40723f9dd7f2_0 (deleted)
/data/data/####/a267986998f49b18_0
/data/data/####/a2da15c1eee45e87_0
/data/data/####/a400477b4a240046_0
/data/data/####/a400477b4a240046_1
/data/data/####/a422f36b30c3cd99_0
/data/data/####/a48e7d50f367da77_0
/data/data/####/a6607e6b4cf5e959_0
/data/data/####/a6bc889525189299_0
/data/data/####/a6c0cfa42bb03fe7_0
/data/data/####/a761b4ab3e100ead_0
/data/data/####/a965dc73833e9f39_0
/data/data/####/abefac6758f1bb3c_0
/data/data/####/ac4d598cedccdc79_0
/data/data/####/accb641e487648a8_0
/data/data/####/ad8186c8a0bb927d_0
/data/data/####/ad8eed76ca0c159b_0
/data/data/####/af5df28cdaa6326d_0
/data/data/####/af5fbdb9381fd7d3_0
/data/data/####/ahq_spu_ti.xml
/data/data/####/b2010cb3a084eb14_0
/data/data/####/b4b087dcbcac375c_0
/data/data/####/b4b087dcbcac375c_1
/data/data/####/b57a1c5d5b92ec18_0
/data/data/####/b6ac2174f3dcfb76_0
/data/data/####/b6ed0337afc5d475_0
/data/data/####/b8f297c1f442d05a_0
/data/data/####/bde23971146deb40_0
/data/data/####/bde23971146deb40_1
/data/data/####/be3b12f4e35d7e37_0
/data/data/####/c2aa9bb5c6b97e29_0
/data/data/####/c49398a6a9ebf812_0
/data/data/####/c49398a6a9ebf812_1
/data/data/####/c50a79036089e2f7_0
/data/data/####/c5bd188d101c5e18_0
/data/data/####/c7ce1868366f1643_0
/data/data/####/c9028e543527140f_0
/data/data/####/c965590a6a67919b_0
/data/data/####/cb207d285fd4105b_0
/data/data/####/cbe229e03b5977b6_0
/data/data/####/cd5df220b541161c_0
/data/data/####/cd76a202682142db_0
/data/data/####/cedb12b5a43197bc_0
/data/data/####/ceeecf7666ff75e9_0
/data/data/####/cf3ff1efbc6b3770_0
/data/data/####/cf4cf4444e75fcfe_0
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.oat
/data/data/####/classes.oat.flock (deleted)
/data/data/####/com.appshell.proxysdk.SetupInfoActivity.xml
/data/data/####/com.meiju592.app.xml
/data/data/####/com.meiju592.app.xml.bak
/data/data/####/com.meiju592.app_preferences.xml
/data/data/####/com.tencent.open.config.json.1106779540
/data/data/####/ctthnvcf.dex (deleted)
/data/data/####/ctthnvcf.dex.flock (deleted)
/data/data/####/ctthnvcf.jar
/data/data/####/d07444cce2869831_0
/data/data/####/d07444cce2869831_1
/data/data/####/d242a02e3b9100f0_0
/data/data/####/d35c7a172a0ff050_0 (deleted)
/data/data/####/d4219fff9a178666_0
/data/data/####/d4219fff9a178666_1
/data/data/####/d4220647eb62fbe1_0
/data/data/####/d5ddc695a31aa53e_0
/data/data/####/d610f1c85c12d6d3_0
/data/data/####/d7c683cf15bddb5f_0
/data/data/####/d7d918848a64f8c0_0
/data/data/####/d855220268c2032c_0
/data/data/####/d855220268c2032c_1
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc1MzQ1MjkwNjAx;
/data/data/####/daa6099ed2b291c3_0
/data/data/####/db05e832ae94f527_0
/data/data/####/dd8d6ed6ba4ddee1bd53a4222dd60c3e.db
/data/data/####/deb0bfa7fe5af649_0
/data/data/####/deeb263f45008a8c_0
/data/data/####/deeb263f45008a8c_1
/data/data/####/device_id.xml.xml
/data/data/####/dfe2880bdf05056a_0 (deleted)
/data/data/####/dns_ip_info.db
/data/data/####/dns_ip_info.db-journal
/data/data/####/downUmeng.dex (deleted)
/data/data/####/downUmeng.dex.flock (deleted)
/data/data/####/downUmeng.jar
/data/data/####/dpi
/data/data/####/e09c9bbaf2ef8602_0
/data/data/####/e0c9287bc20a1942_0
/data/data/####/e1a9318422b5c714_0
/data/data/####/e2455cbde0cae867_0
/data/data/####/e2c580035141031c_0
/data/data/####/e2c580035141031c_1
/data/data/####/e41653f03c521a54_0
/data/data/####/e41653f03c521a54_1
/data/data/####/e5e1820f54952f2b_0
/data/data/####/e6740be65e62f6b4_0
/data/data/####/e6a798e962552d68_0
/data/data/####/e6da3e6d8d6359eb_0
/data/data/####/e717a310ceb0c850_0
/data/data/####/e717a310ceb0c850_1
/data/data/####/e753b0dba4a74be0_0 (deleted)
/data/data/####/e7717e35d4650909_0 (deleted)
/data/data/####/e7b7757407075848_0
/data/data/####/e7b7757407075848_1
/data/data/####/e7f557e6af126835_0 (deleted)
/data/data/####/e839c51606c421c9_0
/data/data/####/e8b3cc25e631350c_0
/data/data/####/edd21f355173cd10_0
/data/data/####/ee6802e5fa51650a_0
/data/data/####/ee805dc6543f3202_0
/data/data/####/ee805dc6543f3202_1
/data/data/####/ef6e5f97a82102a3_0
/data/data/####/ef6e5f97a82102a3_1
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f0006f6ad5d0dc30_0
/data/data/####/f04479f10ab9d876_0
/data/data/####/f0effe8a4e17b351_0 (deleted)
/data/data/####/f1d166c11956f530_0
/data/data/####/f1d166c11956f530_1
/data/data/####/f1e2c96e4e54ae3c_0
/data/data/####/f2c96187b8b42075_0 (deleted)
/data/data/####/f5f5902b036a5a6b_0
/data/data/####/f67f8f6095922e88_0
/data/data/####/f688e039f2213524_0
/data/data/####/f6eee862aeb38a63_0
/data/data/####/f72410a394cf4d9e_0
/data/data/####/f84a8c3f01b824fa_0
/data/data/####/f8c1e9882433764d_0
/data/data/####/f8e6d61549ad1b28_0
/data/data/####/f91631659e3fc49c_0
/data/data/####/f91cea19b8be2a8f_0
/data/data/####/fa110976f09f37ed_0
/data/data/####/fa8e8d1c1ec4cb31_0
/data/data/####/faa23c386c186727_0 (deleted)
/data/data/####/fb11036de8cecb2a_0
/data/data/####/fb39f4eafca3bc20_0
/data/data/####/fb7138146f4281e9_0
/data/data/####/fe10c8b47640b375_0
/data/data/####/fe17a3067d3ace52_0
/data/data/####/fe17a3067d3ace52_1
/data/data/####/fe9921b87d9953fe_0
/data/data/####/ff77bb07798c91e3_0
/data/data/####/ff77bb07798c91e3_1
/data/data/####/ff92fa8ee764d768_0
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/hhq_spu_ti.xml
/data/data/####/hid.db
/data/data/####/http_s.zhitoudsp.com_808.localstorage-journal
/data/data/####/https_www.iqiyi.com_0.localstorage-journal
/data/data/####/i==1.2.0&&5.4.3_1575345290740_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/libbqptos.so
/data/data/####/libbqptos.so-32
/data/data/####/libbqptos.so-64
/data/data/####/libjiagu.so
/data/data/####/meijuniaoV2.db-journal
/data/data/####/metrics_guid
/data/data/####/msy.xml
/data/data/####/okrulp.png
/data/data/####/proc_auxv
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_down_18.db
/data/data/####/umeng_down_5_2.db
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ycb.xml
/data/data/####/ycb.xml.bak (deleted)
/data/data/####/yd_config_c.xml
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.yqzqa/ctthnvcf.jar --oat-fd=71 --oat-location=/data/user/0/<Package>/.yqzqa/ctthnvcf.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng.jar --oat-fd=51 --oat-location=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng/downUmeng.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/pxj/<Package>/rj/914D1DA6187D0B324FCDA22FC3668D79.jar --oat-fd=60 --oat-location=/data/user/0/<Package>/files/914D1DA6187D0B324FCDA22FC3668D79.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/pxj/<Package>/rj/AC6E3274059BAE8EB9EE9421F4C7ADAB.jar --oat-fd=99 --oat-location=/data/user/0/<Package>/files/AC6E3274059BAE8EB9EE9421F4C7ADAB.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/pxj/<Package>/rj/CD65E4F6A62BAEF745553C02FF5D0EF4.jar --oat-fd=87 --oat-location=/data/user/0/<Package>/files/CD65E4F6A62BAEF745553C02FF5D0EF4.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/1.jar --oat-fd=132 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/1.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/13_2.jar --oat-fd=125 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/13_2.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/17.jar --oat-fd=125 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/17.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/18.jar --oat-fd=138 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/18.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/5_2.jar --oat-fd=154 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/5_2.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/8.jar --oat-fd=125 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/8.dex --compiler-filter=speed
/system/bin/sh
cat /proc/cpuinfo
cat /proc/version
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
cat /sys/class/net/wlan0/address
getprop
getprop ro.board.platform
getprop ro.product.cpu.abi
ls -l /dev
ls -l /dev/__properties__
ls -l /dev/block
ls -l /dev/block/pci
ls -l /dev/block/pci/pci0000:00
ls -l /dev/block/pci/pci0000:00/0000:00:01.1
ls -l /dev/block/pci/pci0000:00/0000:00:01.1/by-num
ls -l /dev/block/vold
ls -l /dev/bus
ls -l /dev/bus/usb
ls -l /dev/bus/usb/001
ls -l /dev/com.android.settings
ls -l /dev/com.android.settings.daemon
ls -l /dev/cpuctl
ls -l /dev/cpuset
ls -l /dev/cpuset/background
ls -l /dev/cpuset/foreground
ls -l /dev/cpuset/foreground/boost
ls -l /dev/cpuset/system-background
ls -l /dev/cpuset/top-app
ls -l /dev/fscklogs
ls -l /dev/graphics
ls -l /dev/input
ls -l /dev/memcg
ls -l /dev/memcg/apps
ls -l /dev/pts
ls -l /dev/snd
ls -l /dev/socket
ls -l /dev/stune
ls -l /dev/stune/background
ls -l /dev/stune/foreground
ls -l /dev/stune/top-app
ls /
ls /sys/class/thermal
ps

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней