Android.DownLoader.4843

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.906.origin
Android.RemoteCode.262.origin
Android.RemoteCode.268.origin
Android.Triada.477.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.RemoteCode.268.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) en.hatch####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) s.yf####.com:8088
TCP(HTTP/1.1) t####.3g.qq.com:80
TCP(HTTP/1.1) dy.cn.simpl####.me:80
TCP(HTTP/1.1) log.qazws####.xyz:80
TCP(HTTP/1.1) en.hatch####.com:80
TCP(HTTP/1.1) tm.adsc####.com:8001
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) sdk.wildpet####.com:80
TCP(HTTP/1.1) www.imhel####.net:81
TCP(HTTP/1.1) lic####.v####.myqc####.####.com:80
TCP(HTTP/1.1) 1####.27.70.235:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) www.sb####.net.cn:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) st####.mob####.com:80
TCP(HTTP/1.1) u1.a####.cn:8080
TCP(HTTP/1.1) c####.hatch####.com:80
TCP(HTTP/1.1) www.i####.com:80
TCP(HTTP/1.1) zgx.powerle####.com:80
TCP(HTTP/1.1) res.simpl####.me:80
TCP(HTTP/1.1) ip.adi####.net:80
TCP(HTTP/1.1) dl.u####.cn:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) cn-hang####.oss####.aliyun####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) b####.soui####.com:80
TCP(HTTP/1.1) d1.sho####.com:80
TCP(HTTP/1.1) api.se####.taol####.cn:80
TCP(HTTP/1.1) ny.bul####.cn:666
TCP(HTTP/1.1) v.sho####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) api.i####.cn:80
TCP(HTTP/1.1) p.rqco####.com:8806
TCP(HTTP/1.1) ad.midong####.com:80
TCP(HTTP/1.1) ad.yf####.com:8088
TCP(HTTP/1.1) php.sho####.com:80
TCP(HTTP/1.1) 4####.96.95.62:9527
TCP(HTTP/1.1) cdn.abcdse####.com:8080
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(HTTP/1.1) s.yf####.com:8089
TCP(SSL/3.0) sf6-ttc####.ps####.com.####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) ip.adi####.net:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) h####.quk####.com:443
TCP(TLS/1.0) sf1-ttc####.ps####.com:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) s.qianche####.com:7777
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) to####.ctobsn####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) p####.ou####.com:4433
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) sf6-ttc####.ps####.com.####.com:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) a####.quk####.com:443
TCP(TLS/1.0) vid####.c####.l####.####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) ad1.azh####.com:9190
TCP(TLS/1.0) c.fw####.com:8888
TCP 1####.27.113.225:32900
TCP 3####.33.32.129:4017
TCP 1####.36.108.244:20166
TCP zb-cent####.m.ta####.com:80
TCP zb-cent####.m.ta####.com:443
TCP m####.3g.qq.com:443

Запросы DNS:

a####.man.aliy####.com
a####.quk####.com
a####.u####.com
ad.midong####.com
ad.yf####.com
ad1.azh####.com
ag####.m.ta####.com
amdc####.m.ta####.com
api.i####.cn
api.se####.taol####.cn
b####.soui####.com
c####.b####.com
c####.hatch####.com
c####.mm####.com
c.c####.com
c.fw####.com
cdn.abcdse####.com
cdn.ipad####.com
cn-hang####.oss####.aliyun####.com
d1.sho####.com
dig.b####.net
dl.u####.cn
dup.baidust####.com
dy.cn.simpl####.me
dy.cn.wildpet####.xyz
ec####.b####.com
en.hatch####.com
f####.fengkon####.com
fp.fraudme####.cn
h####.quk####.com
hm.b####.com
im####.qukanti####.com
ip.adi####.net
ip.ta####.com
is.sn####.com
lic####.v####.myqc####.com
log.qazws####.xyz
log.u####.com
m####.3g.qq.com
mo####.b####.com
np.bul####.cn
ny.bul####.cn
openins####.io
p####.ou####.com
p.cli####.net
p.rqco####.com
php.sho####.com
plb####.u####.com
pos.b####.com
pro.wildpet####.com
pv.s####.com
res####.a####.com
res.simpl####.me
s####.adi####.net
s####.taol####.cn
s####.wildpet####.com
s.qianche####.com
s.yf####.com
s9.c####.com
sdk.ipad####.com
sdk.wildpet####.com
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
st####.mob####.com
t####.3g.qq.com
t.jie####.com
thi####.q####.cn
tm.adsc####.com
to####.ctobsn####.com
u####.u####.com
u.y####.com
u1.a####.cn
umen####.m.ta####.com
umengj####.m.ta####.com
v.sho####.com
w####.pcon####.com.cn
www.i####.com
www.imhel####.net
www.sb####.net.cn
xp.a####.com
z12.c####.com
z3.c####.com
zgx.powerle####.com

Запросы HTTP GET:

api.se####.taol####.cn/?idfv=####&ra_net=####&userid=####&type=####&cm_o...
api.se####.taol####.cn/v3/base/?idfv=####&ra_net=####&userid=####&cm_o=#...
api.se####.taol####.cn/v3/init/?idfv=####&ra_net=####&userid=####&cm_o=#...
b####.soui####.com/app/trans/705766?bookStore=####&channel=####&t=####&t...
c####.hatch####.com/img/pic91951.png
c####.hatch####.com/img/yw_hn_wk_acv.png
cdn.abcdse####.com:8080/group1/M01/00/15/ChtYq14kCMeAVcM3AAFagHb7ffM9248...
cn-hang####.oss####.aliyun####.com/amap-api/comm/upload/CoordinateSoEnhe...
dl.u####.cn/201908/2QI9R1566987709.jar?ver=####&md5=####
dl.u####.cn/201911/KASFC1572930508.jar?ver=####&md5=####
dl.u####.cn/201911/lf3Vu1573370364.jar?ver=####&md5=####
dl.u####.cn/201912/HkitK1576674495.jar?ver=####&md5=####
dl.u####.cn/201912/rTk1Y1575445104.jar?ver=####&md5=####
dl.u####.cn/202001/1Pmt61578816066.jar?ver=####&md5=####
dl.u####.cn/202001/BQCUV1578363799.jar?ver=####&md5=####
dl.u####.cn/202001/YXK821578300459.jar?ver=####&md5=####
dl.u####.cn/202001/aXGDv1579442582.jar?ver=####&md5=####
dl.u####.cn/202002/kuzAM1580705319.jar?ver=####&md5=####
en.hatch####.com/s.php?v=####&d=####&t=####&ver=####&c=####
ip.adi####.net/api/ad/ad/sendDeviceInfo
ip.adi####.net/extra/information/getInformation?positionId=####&acc=####
ip.adi####.net/extra/information/list?acc=####
ip.adi####.net/extra/rp/cu?a=####&at=####&d=####&h=####&i=####&p=####&s=...
ip.adi####.net/extra/rp/su?a=####&at=####&d=####&h=####&i=####&p=####&s=...
ip.ta####.com/service/getIpInfo.php?ip=####
ip.ta####.com/service/getIpInfo2.php?ip=####
lic####.v####.myqc####.####.com/license/v1/3e708b89165cbad90f8ffb205159a...
p.rqco####.com:8806/c/1582822731716
res.simpl####.me/cnmodules/QQ_CN.zip
res.simpl####.me/cnmodules/cnzz.zip
res.simpl####.me/cnmodules/proxy-cn.zip
res.simpl####.me/cnmodules/sm.zip
st####.mob####.com/1912/301013_patch3.7.jar
t####.3g.qq.com/cw.html
thi####.q####.cn/mmopen/vi_32/S51uVm0cO7GNqZKur9EQQepYRQ7nds6Y47xLoiaCVs...
thi####.q####.cn/mmopen/vi_32/ag7nfjFEdqfdo2IA82IiaZEBJS4MeQ9ZAZwibicUKf...
thi####.q####.cn/mmopen/vi_32/w5NYxo0AININlNoiaO6q99WX1nFvGRkeWVJSrwhW1a...
ti####.c####.l####.####.com/bs/images/chasing_dots.png?ver=####
ti####.c####.l####.####.com/bs/static/css/app.cb02843f.css
ti####.c####.l####.####.com/bs/static/css/chunk-vendors.ae7b036e.css
ti####.c####.l####.####.com/bs/static/js/app.5085a479.js
ti####.c####.l####.####.com/bs/static/js/chunk-vendors.bb3c64b6.js
www.i####.com/json.do?view=####
www.imhel####.net:81/index_cnzz.html?from=####&appid=####&channel=####&r...
www.sb####.net.cn/index_cnzz.html?from=####&appid=####&channel=####&r=####
z.c####.com/stat.htm?id=####&cnzz_eid=####
zgx.powerle####.com/dnfile/cmm/PWrap299227P2.jar

Запросы HTTP POST:

a####.u####.com/app_logs
ad.midong####.com/api/ads/appinit
ad.midong####.com/api/ads/appinstalllist
ad.midong####.com/api/ads/mdic
ad.yf####.com:8088/ad/idy
ad.yf####.com:8088/ad/tk?aid=####&time=####
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
api.i####.cn/ad/v4/
d1.sho####.com/index.php?r=####
dy.cn.simpl####.me/dycn/sync
dy.cn.simpl####.me/dycn/update
dy.cn.simpl####.me/proxy/get?e=####
dy.cn.simpl####.me/site/get
en.hatch####.com/acv.php
en.hatch####.com/sck/28031/?m=R1QtS####&s=####
en.hatch####.com/tj.php
f####.fengkon####.com/v3/cloudconf
f####.fengkon####.com/v3/profile/android
gd.a.s####.com/cityjson
log.qazws####.xyz/log/save
ny.bul####.cn:666/slsdk/getdata.aspx
p.rqco####.com:8806/p/1582822735084
php.sho####.com/index.php?r=####
s.yf####.com:8088/ad/idy
s.yf####.com:8088/ad/tk?aid=####&time=####
s.yf####.com:8088/ad/uc
s.yf####.com:8089/ad/status
sdk.wildpet####.com/sm/get
tm.adsc####.com:8001/tm/log
u1.a####.cn:8080/p
u1.a####.cn:8080/p/log
v.sho####.com/index.php?r=####
w####.pcon####.com.cn/ip.jsp

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/..dx_191_3.dx.apk
/data/data/####/.atmp_8.log
/data/data/####/.dx_191_3.dx
/data/data/####/.hqcfg
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.oxo.jar
/data/data/####/.td-3
/data/data/####/045ecc8bc64611944c7a0d5ff1cba241221690c0c4b297a....0.tmp
/data/data/####/0657d3789d028c436c1ae31e45ac86b91bc64bc69231875....0.tmp
/data/data/####/13d175c5d611f720d5b1215d4a108aa5f06404e6131c352....0.tmp
/data/data/####/1643a76b03f161411b82e6c76b9ee2ee160e8e78c9b18dc....0.tmp
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/1ecb89e392b35ef45296d78629d3775762cf05efc2513eb....0.tmp
/data/data/####/280525579.jar
/data/data/####/2d4d1f0b.jar
/data/data/####/2ec20cff2dbd097f0ef26365416fc34961211271ae91eac....0.tmp
/data/data/####/3608112eaf3b6cb02b62e692ae4ae936e937aecee32c0da....0.tmp
/data/data/####/3d94c47506aecb914f67c0da43b3381b933d96b346bfafa....0.tmp
/data/data/####/40805.dat
/data/data/####/448cb9bb2589cf4dcbd1d7d12ab5fa066c908271b3e63d3....0.tmp
/data/data/####/4d409985
/data/data/####/4fb10984030aebfd93671f938ed360a3de16861ef9c3372....0.tmp
/data/data/####/5e9383635751323f46ca2c4f8fdd1d5536bac06482d513f....0.tmp
/data/data/####/6ceba9a9d7654189fc434ccde2ce74aab03728e9017ec41....0.tmp
/data/data/####/826b8e1496384bb56530216642408c1605d0c5c89e09572....0.tmp
/data/data/####/8285687079f726e81979764e271ed349
/data/data/####/82d7cf8016d6373c7d438be41bba774b85f4d472475278f....0.tmp
/data/data/####/87799775da6e69e23eb4806d9353108676b069414e33344....0.tmp
/data/data/####/98a0b88aed128df10ad9f12faed6a68586557b07d7e71b7....0.tmp
/data/data/####/9c67ceeec401fd33965adb13c02db83f71f9c9099acd89c....0.tmp
/data/data/####/A3AEECD8.dex
/data/data/####/ACCS_BINDumeng;59a50d09c895763cc10007e6.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/FM_config.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/PROXYDATA.xml
/data/data/####/QQ_CN.zip
/data/data/####/SP_TEMP_NAME.xml
/data/data/####/TbSngs.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewBasePrefs.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/a3cfd6453813fd3dd6a6794c7f135f4138b814422ede064....0.tmp
/data/data/####/accs.db-journal
/data/data/####/ad_8002
/data/data/####/ad_8002.tmp
/data/data/####/ad_8002.zip
/data/data/####/ad_b612_cfg.xml
/data/data/####/ad_q18
/data/data/####/ad_q18.tmp
/data/data/####/ad_q18.zip
/data/data/####/ad_q2
/data/data/####/ad_q2.tmp
/data/data/####/ad_q2.zip
/data/data/####/ad_q27
/data/data/####/ad_q27.tmp
/data/data/####/ad_q27.zip
/data/data/####/ad_q32
/data/data/####/ad_q32.tmp
/data/data/####/ad_q32.zip
/data/data/####/ad_q35
/data/data/####/ad_q35.tmp
/data/data/####/ad_q35.zip
/data/data/####/ad_speed
/data/data/####/ad_speed.tmp
/data/data/####/ad_speed.zip
/data/data/####/adcfg.xml
/data/data/####/agoo.pid
/data/data/####/b00a5802ce43161b2b8c254bd4ab77f3862bb7b6a4fa21c....0.tmp
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bg_sp.xml
/data/data/####/bytedance_downloader.db-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/channel_umeng_common_config.xml
/data/data/####/classes.dex
/data/data/####/cnzz.zip
/data/data/####/com.tencent.liteav.dev_uuid.xml
/data/data/####/com.yanhui.qktx_infoc_config_pref.xml
/data/data/####/crash
/data/data/####/crash.tmp
/data/data/####/crash.zip
/data/data/####/d2wqrf.xml
/data/data/####/d4dd051859045aabd4aede98ec173ddc9c65f46d952fed1....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTgyODIyNjc3MTg5;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTgyODIyNzA1ODEx;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1ODI4MjI2ODYzNjA=;
/data/data/####/dW1weF9zaGFyZV8xNTgyODIyNjgwODY2;
/data/data/####/dW1weF9zaGFyZV8xNTgyODIyNjgwOTA2;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db61e876.xml
/data/data/####/db92028c66e8e05873ad0a8be7b9b723ec4099542ec1316....0.tmp
/data/data/####/dk_search.db-journal
/data/data/####/dy_live.xml
/data/data/####/e2d09b31253d466124dad6881e6bebe9.xml
/data/data/####/ed5bfe4bdbec3416c956d017ae73c00a
/data/data/####/efc8e87c0216abc4b7f070143e7838944538e87966e5277....0.tmp
/data/data/####/efju65tx.xml
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/fc_times.xml
/data/data/####/fju78g.data-journal
/data/data/####/fm_shared.xml
/data/data/####/gpSettings.xml
/data/data/####/gwu8op08ds.data-journal
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&3.1.15.1_1582822677300_envelope.log
/data/data/####/ibkad_config.xml
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/libjiagu-1529152297.so
/data/data/####/libwgs2gcj.so
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/md_ad_config.xml
/data/data/####/md_ad_config.xml.bak (deleted)
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mobads_aplist_status.xml
/data/data/####/multidex.version.xml
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/p_sp_com.yanhui.qktx.xml
/data/data/####/package_caches.xml
/data/data/####/prdopt.xml
/data/data/####/pref.xml
/data/data/####/proxy-cn.dex
/data/data/####/proxy-cn.zip
/data/data/####/qktx.xml
/data/data/####/rexxteak.jar
/data/data/####/sbysc.xml
/data/data/####/sdk_share_file.xml
/data/data/####/search_sdk.xml
/data/data/####/seq.xml
/data/data/####/settingsLog.xml
/data/data/####/share.db-journal
/data/data/####/simple-main-msg.dat
/data/data/####/simple-main-req.dat
/data/data/####/sk.xml
/data/data/####/sm.zip
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_global_info.xml
/data/data/####/sp_push_time.xml
/data/data/####/sp_template_delete.xml
/data/data/####/temp_web_sp.xml
/data/data/####/tmp7.xml
/data/data/####/tms_base.xml
/data/data/####/tracker.db-journal
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/uc_ad
/data/data/####/uc_ad.tmp
/data/data/####/uc_ad.zip
/data/data/####/uc_data.xml
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/update.xml
/data/data/####/url_ad
/data/data/####/url_ad.tmp
/data/data/####/url_ad.zip
/data/data/####/v71.xml
/data/data/####/wdde4f.data-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/woki8ws.xml
/data/data/####/xian_wan_sp_config_table.xml
/data/data/####/xyesout.jar
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.log__
/data/media/####/.nomedia
/data/media/####/.td-3
/data/media/####/.tdck
/data/media/####/.thumbcache_idx_001
/data/media/####/.umm.dat
/data/media/####/01e576bf6a28d535e3443b1d6c527a44.xml
/data/media/####/0f7380a0e2d649898ce7b463ad2b4b59
/data/media/####/1582822705751.db
/data/media/####/3ffb90c0156c7c065414c1c803b9225b.tmp
/data/media/####/534e5fc9dd544533ac02b721d27d3720
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/LiteAV_C.mmap2
/data/media/####/LiteAV_C_20200227.xlog
/data/media/####/adv
/data/media/####/af6ebb905bdf4e9380e67c5d90f2e604
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/b9856bab3add981eccc7a9b9ce2b83cd.tmp
/data/media/####/c23b86282220415f83306bfe53e60fdd
/data/media/####/clientudid.dat
/data/media/####/config
/data/media/####/deviceId
/data/media/####/deviceToken
/data/media/####/engc.jar
/data/media/####/master
/data/media/####/master.lock
/data/media/####/mdtecfzb.txt
/data/media/####/openInstall_0.csv
/data/media/####/spuid
/data/media/####/temp_pkg_info.json
/data/media/####/tmp.licence
/data/media/####/tmpbl.jar
/data/media/####/v26vu3

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:59a50d09c895763cc10007e6","utdid":"Xlf1Fd7FO+EDAGdzx1G4/xg6","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
busybox ifconfig
cat /proc/self/cgroup
cat /sys/class/net/wlan0/address
getprop
getprop net.dns1
getprop ro.build.version.emui
ls /
ls /sys/class/thermal
ps
sh
sh -c cat /proc/sys/kernel/random/boot_id
su

Загружает динамические библиотеки:

A3AEECD8
Tcc-1.0
libjiagu-1529152297
liteavsdk
nms
saturn
smsdk
stlport_shared
tnet-3.1
tobEmbedEncrypt
tongdun
txffmpeg
ut_c_api

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
DESede
Des-ECB-NoPadding
RSA-ECB-OAEPWITHSHA-256ANDMGF1PADDING
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-NoPadding
DESede
Des-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует повышенные привилегии.

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней