Android.DownLoader.4844

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.906.origin
Android.RemoteCode.262.origin
Android.RemoteCode.268.origin
Android.Triada.4567
Android.Triada.477.origin
Android.Triada.482.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.RemoteCode.268.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) en.hatch####.com:80
TCP(HTTP/1.1) api.m2g.adoc####.com:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) lic####.v####.myqc####.####.com:80
TCP(HTTP/1.1) 4####.91.3.20:20147
TCP(HTTP/1.1) v.h####.com:8071
TCP(HTTP/1.1) st####.guantou####.com:80
TCP(HTTP/1.1) ping####.qq.com:80
TCP(HTTP/1.1) r.ist####.com:8071
TCP(HTTP/1.1) ip.adi####.net:80
TCP(HTTP/1.1) 1####.62.170.158:8080
TCP(HTTP/1.1) sj.i36####.com:9000
TCP(HTTP/1.1) ad.yf####.com:8088
TCP(HTTP/1.1) 4####.96.95.62:9527
TCP(HTTP/1.1) ap####.math####.cn:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(HTTP/1.1) f.qia####.com:80
TCP(HTTP/1.1) dy.cn.simpl####.me:80
TCP(HTTP/1.1) sdk.wildpet####.com:80
TCP(HTTP/1.1) en.hatch####.com:80
TCP(HTTP/1.1) np.bul####.cn:6087
TCP(HTTP/1.1) 2####.98.33.230:8888
TCP(HTTP/1.1) www.i####.com:80
TCP(HTTP/1.1) xks.ym####.com:80
TCP(HTTP/1.1) res.simpl####.me:80
TCP(HTTP/1.1) cdn.i.arie####.com:80
TCP(HTTP/1.1) jp####.njt####.com:10091
TCP(HTTP/1.1) cn-hang####.oss####.aliyun####.com:80
TCP(HTTP/1.1) yq####.jn####.ltd:80
TCP(HTTP/1.1) i.ist####.com:8071
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) sdk.w####.com:80
TCP(HTTP/1.1) php.sho####.com:80
TCP(HTTP/1.1) pg####.d2####.com:10273
TCP(HTTP/1.1) cdn.abcdse####.com:8080
TCP(HTTP/1.1) 47.1####.222.149:996
TCP(HTTP/1.1) tm.adsc####.com:8001
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) vid####.c####.l####.####.com:80
TCP(HTTP/1.1) ott.h####.com:8071
TCP(HTTP/1.1) st####.mob####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) a####.qia####.com:80
TCP(HTTP/1.1) dl.u####.cn:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) api.se####.taol####.cn:80
TCP(HTTP/1.1) ny.bul####.cn:666
TCP(HTTP/1.1) d####.buywe####.com:80
TCP(HTTP/1.1) ad.midong####.com:80
TCP(HTTP/1.1) s.yf####.com:8089
TCP(HTTP/1.1) nb.i36####.com:9000
TCP(HTTP/1.1) api.i####.cn:80
TCP(HTTP/1.1) 1####.27.70.235:80
TCP(HTTP/1.1) ad.api.clou####.xyz:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) www.sb####.net.cn:80
TCP(HTTP/1.1) np.bul####.cn:81
TCP(HTTP/1.1) 47.1####.137.108:80
TCP(HTTP/1.1) t####.3g.qq.com:80
TCP(HTTP/1.1) zgx.powerle####.com:80
TCP(HTTP/1.1) j.i36####.com:9000
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) c####.hatch####.com:80
TCP(HTTP/1.1) np.bul####.cn:666
TCP(HTTP/1.1) e4####.0r####.com:10293
TCP(HTTP/1.1) h.w####.com:80
TCP(HTTP/1.1) u1.a####.cn:8080
TCP(HTTP/1.1) 47.94.1####.81:80
TCP(SSL/3.0) sf6-ttc####.ps####.com.####.com:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) a####.d####.com:443
TCP(TLS/1.0) a####.quk####.com:443
TCP(TLS/1.0) openins####.io:443
TCP(TLS/1.0) sf6-ttc####.ps####.com.####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) ad####.cp####.cn:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) ip.adi####.net:443
TCP(TLS/1.0) sf1-ttc####.ps####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) to####.ctobsn####.com:443
TCP(TLS/1.0) p####.ou####.com:4433
TCP(TLS/1.0) c.fw####.com:8888
TCP(TLS/1.0) h####.quk####.com:443
TCP(TLS/1.0) p####.it####.a####.####.net:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) it####.a####.com.####.net:443
TCP(TLS/1.0) s####.d####.com:443
TCP(TLS/1.0) s.qianche####.com:7777
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) vid####.c####.l####.####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) ad1.azh####.com:9190
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) xp.a####.com.####.net:443
TCP(TLS/1.0) i####.d####.com:443
TCP(TLS/1.0) 1####.202.114.81:443
TCP 1####.31.211.238:32900
TCP 2####.104.71.212:6005
TCP zb-cent####.m.ta####.com:443
TCP 1####.36.108.244:20166
TCP m####.3g.qq.com:443

Запросы DNS:

4s####.8c####.com
a####.d####.com
a####.man.aliy####.com
a####.mzst####.com
a####.qia####.com
a####.quk####.com
a####.u####.com
ad####.cp####.cn
ad.api.clou####.xyz
ad.midong####.com
ad.yf####.com
ad1.azh####.com
ad4.azh####.com
adv.google####.com.cn
adv.patrick####.com.cn
ag####.m.ta####.com
amdc####.m.ta####.com
ap####.math####.cn
api.adoc####.com
api.i####.cn
api.m2g.adoc####.com
api.se####.taol####.cn
bag.it####.a####.com
c####.b####.com
c####.hatch####.com
c####.mm####.com
c.c####.com
c.fw####.com
cdn.abcdse####.com
cdn.i.arie####.com
cn-hang####.oss####.aliyun####.com
co####.ssp.adoc####.com
d####.buywe####.com
dig.b####.net
dl.u####.cn
dup.baidust####.com
dy.cn.simpl####.me
dy.cn.wildpet####.xyz
e4####.0r####.com
en.hatch####.com
f####.fengkon####.com
f.qia####.com
fp.fraudme####.cn
h####.quk####.com
h.w####.com
hm.b####.com
i####.d####.com
i####.it####.a####.com
i.ist####.com
im####.qukanti####.com
ip.adi####.net
ip.ta####.com
is.sn####.com
j.i36####.com
jp####.njt####.com
lic####.v####.myqc####.com
log.u####.com
m####.3g.qq.com
mo####.b####.com
nb.i36####.com
np.bul####.cn
ny.bul####.cn
openins####.io
ott.h####.com
p####.api.adoc####.com
p####.it####.a####.com
p####.ou####.com
p.cli####.net
pg####.d2####.com
php.sho####.com
pi####.qq.com
ping####.qq.com
plb####.u####.com
pos.b####.com
pro.wildpet####.com
pv.s####.com
r.ist####.com
res####.a####.com
res.simpl####.me
s####.adi####.net
s####.d####.com
s####.d####.com
s####.guantou####.com
s####.taol####.cn
s####.wildpet####.com
s.qianche####.com
s.yf####.com
s5.c####.com
s96.c####.com
sdk.ipad####.com
sdk.w####.com
sdk.wildpet####.com
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
sj.i36####.com
st####.guantou####.com
st####.guantou####.com
st####.mob####.com
t####.3g.qq.com
t.jie####.com
tm.adsc####.com
to####.ctobsn####.com
tt####.vni####.com
u####.u####.com
u.y####.com
u1.a####.cn
umen####.m.ta####.com
umengj####.m.ta####.com
v.h####.com
w####.pcon####.com.cn
www.google-####.com
www.i####.com
www.imhel####.net
www.sb####.net.cn
xks.ym####.com
xp.a####.com
yq####.jn####.ltd
z12.c####.com
z2.c####.com
z3.c####.com
z9.c####.com
zgx.powerle####.com

Запросы HTTP GET:

47.1####.137.108/cnmodules/proxy-cn.zip
47.94.1####.81/api/v2/SDKCommonConfig?channelCode=####&version=####
47.94.1####.81/api/v2/fwConfig?channelCode=####&version=####
47.94.1####.81/api/v2/fwWebviewRatioConfig?channelCode=####&version=####
47.94.1####.81/ip
ap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
api.m2g.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=####
api.m2g.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
api.m2g.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&versi...
api.m2g.adoc####.com/fw/task?task_id=####&ip=####
api.se####.taol####.cn/?idfv=####&ra_net=####&userid=####&type=####&cm_o...
api.se####.taol####.cn/v3/base/?idfv=####&ra_net=####&userid=####&cm_o=#...
api.se####.taol####.cn/v3/init/?idfv=####&ra_net=####&userid=####&cm_o=#...
c####.hatch####.com/img/pic91951.png
c####.hatch####.com/img/yw_hn_wk_acv.png
cdn.abcdse####.com:8080/group1/M01/00/15/ChtYq14kCMeAVcM3AAFagHb7ffM9248...
cdn.i.arie####.com/c/_ii_?_=####
cdn.i.arie####.com/e/i.html
cdn.i.arie####.com/e/i.js
cn-hang####.oss####.aliyun####.com/amap-api/comm/upload/CoordinateSoEnhe...
d####.buywe####.com/Dock/getDYToken
dl.u####.cn/201908/2QI9R1566987709.jar?ver=####&md5=####
dl.u####.cn/201911/lf3Vu1573370364.jar?ver=####&md5=####
dl.u####.cn/201912/HkitK1576674495.jar?ver=####&md5=####
dl.u####.cn/202001/1Pmt61578816066.jar?ver=####&md5=####
dl.u####.cn/202001/BQCUV1578363799.jar?ver=####&md5=####
dl.u####.cn/202001/YXK821578300459.jar?ver=####&md5=####
dl.u####.cn/202001/aXGDv1579442582.jar?ver=####&md5=####
dl.u####.cn/202002/kuzAM1580705319.jar?ver=####&md5=####
en.hatch####.com/s.php?v=####&d=####&t=####&ver=####&c=####
f.qia####.com/e/20200106161147b_600008_v78.enc
ip.adi####.net/api/ad/ad/sendDeviceInfo
ip.adi####.net/extra/information/list?acc=####
ip.ta####.com/service/getIpInfo.php?ip=####
ip.ta####.com/service/getIpInfo2.php?ip=####
j.i36####.com:9000/jsonServer/LanMei01vp
lic####.v####.myqc####.####.com/license/v1/3e708b89165cbad90f8ffb205159a...
ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=####...
res.simpl####.me/cnmodules/cnzz.zip
res.simpl####.me/cnmodules/sm.zip
s####.tc.qq.com/h5/stats.js?v2####
st####.guantou####.com/stat26.html
st####.guantou####.com/stat30.html
st####.guantou####.com/stat7.html
st####.mob####.com/1912/301013_patch3.7.jar
t####.3g.qq.com/cw.html
vid####.c####.l####.####.com/158263661508710a4a-55a3-41f1-a0af-7f95e5822...
www.i####.com/json.do?view=####
www.sb####.net.cn/index_cnzz.html?from=####&appid=####&channel=####&r=####
xks.ym####.com/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ4NjQiOmZhbHNlLCJ0...
yq####.jn####.ltd/sy/hjwuzj
yq####.jn####.ltd/zz/445gjrjrtwyf.zip
z.c####.com/stat.htm?id=####&cnzz_eid=####
zgx.powerle####.com/dnfile/cmm/PWrap299227P2.jar

Запросы HTTP POST:

a####.qia####.com//api/2io82K
a####.qia####.com//api/8VbeIo
a####.qia####.com//api/Ddgv3VE
a####.qia####.com//api/QTnLukEdO1
a####.qia####.com//api/SJoGF44Q
a####.qia####.com//api/SVFUp6
a####.qia####.com//api/voEYG7
a####.u####.com/app_logs
ad.api.clou####.xyz/ads
ad.midong####.com/api/ads/appinit
ad.midong####.com/api/ads/appinstalllist
ad.midong####.com/api/ads/mdic
ad.yf####.com:8088/ad/idy
ad.yf####.com:8088/ad/tk?aid=####&time=####
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
api.i####.cn/ad/v4/
api.m2g.adoc####.com/titan/monitor/device_info
dy.cn.simpl####.me/dycn/sync
dy.cn.simpl####.me/dycn/update
dy.cn.simpl####.me/proxy/get?e=####
dy.cn.simpl####.me/site/get
e4####.0r####.com:10293/widlth/
e4####.0r####.com:10293/xkeila/
en.hatch####.com/acv.php
en.hatch####.com/sck/28031/?m=R1QtS####&s=####
en.hatch####.com/tj.php
f####.fengkon####.com/v3/cloudconf
f####.fengkon####.com/v3/profile/android
gd.a.s####.com/cityjson
h.w####.com/api/Gu5wT0Z
i.ist####.com:8071/6.1.0/1510864978/1
j.i36####.com:9000/api/jadReport.do
j.i36####.com:9000/ip
jp####.njt####.com:10091/wisdom/marking
nb.i36####.com:9000/api/getAdInfoByDevice.do
nb.i36####.com:9000/api/getAdInfoById.do
nb.i36####.com:9000/api/vsp/getVspCore.do
np.bul####.cn:6087/Sdk/patchPlayReport
np.bul####.cn:6087/Sdk/reportTask
np.bul####.cn:6087/Sdk/task
np.bul####.cn:6087/Sdk/tsReport
np.bul####.cn:666/slsdk/api_report.aspx
np.bul####.cn:81/Dock/getRsaAdverData
ny.bul####.cn:666/slsdk/getdata.aspx
ott.h####.com:8071/api/10
pg####.d2####.com:10273/dvjnzt/
pg####.d2####.com:10273/rnggno/
pg####.d2####.com:10273/tzvntp/
php.sho####.com/index.php?r=####
r.ist####.com:8071/6.1.0/163832107/2
s.yf####.com:8089/ad/status
sdk.w####.com/rest/pt
sdk.wildpet####.com/sm/get
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
sj.i36####.com:9000/api/getAdInfoById.do
tm.adsc####.com:8001/tm/log
u1.a####.cn:8080/p
u1.a####.cn:8080/p/log
v.h####.com:8071/8
w####.pcon####.com.cn/ip.jsp

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/..dx_191_3.dx.apk
/data/data/####/.__id_
/data/data/####/._sbx.xml
/data/data/####/.atmp_8.log
/data/data/####/.denc
/data/data/####/.denc.zip
/data/data/####/.dx_191_3.dx
/data/data/####/.hqcfg
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.oxo.jar
/data/data/####/.td-3
/data/data/####/.zeg.xml
/data/data/####/045ecc8bc64611944c7a0d5ff1cba241221690c0c4b297a....0.tmp
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/280525591.jar
/data/data/####/2d4d1f0b.jar
/data/data/####/396203b31b6d96e755d325e34de9efa125afbdb5e37a458....0.tmp
/data/data/####/40805.dat
/data/data/####/41b20926dcf3428dba1791442ea1dfd57fb9cf9362526cf....0.tmp
/data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
/data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
/data/data/####/4d409985
/data/data/####/72c9458d64a97c2371968ce5fa9af4353933cff3d911835....0.tmp
/data/data/####/72c9458d64a97c2371968ce5fa9af4353933cff3d911835...6ab9.0
/data/data/####/73adbf53464be9c69d4c894daabcc0188a6c133cba6fa73....0.tmp
/data/data/####/7a9df34d1c5441d53b3fb3ef28e107d06a4776be2b95f16....0.tmp
/data/data/####/8235031bc5f8ea79e8fbc2e6e04a270b0360d5d26e53d9f....0.tmp
/data/data/####/8285687079f726e81979764e271ed349
/data/data/####/87ea0040c308691bbb98a920e4d3ce3d6f5b4e3e112e302....0.tmp
/data/data/####/88b0ec2d81e1baec3c177eb37935e092a5c533e754ad803....0.tmp
/data/data/####/89a79f2e2b69867bc7daafc01eaecea96c590a1eb8eed7d....0.tmp
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/8ba81a9f30572232a9228e5550b46e2dbb682a5c81dc362....0.tmp
/data/data/####/8d8c5a8ada151540ab1fab8c3b18ee8c14443a5ede1905e....0.tmp
/data/data/####/9618302918.xml
/data/data/####/9618302918.xml.bak (deleted)
/data/data/####/A3AEECD8.dex
/data/data/####/ACCS_BINDumeng;59a50d09c895763cc10007e6.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/FM_config.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/PROXYDATA.xml
/data/data/####/SP_TEMP_NAME.xml
/data/data/####/TbSngs.xml
/data/data/####/TbSngs.xml.bak
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewBasePrefs.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/_p.xml
/data/data/####/_sh.xml
/data/data/####/accs.db-journal
/data/data/####/ad_8002
/data/data/####/ad_8002.tmp
/data/data/####/ad_8002.zip
/data/data/####/ad_b612_cfg.xml
/data/data/####/ad_q18
/data/data/####/ad_q18.tmp
/data/data/####/ad_q18.zip
/data/data/####/ad_q27
/data/data/####/ad_q27.tmp
/data/data/####/ad_q27.zip
/data/data/####/ad_q32
/data/data/####/ad_q32.tmp
/data/data/####/ad_q32.zip
/data/data/####/ad_q35
/data/data/####/ad_q35.tmp
/data/data/####/ad_q35.zip
/data/data/####/ad_speed
/data/data/####/ad_speed.tmp
/data/data/####/ad_speed.zip
/data/data/####/adcfg.xml
/data/data/####/af8410f495503386645002616628ef73643872d09bef32e....0.tmp
/data/data/####/agoo.pid
/data/data/####/apkseparate.DoubleBackUpDB.db
/data/data/####/apkseparate.DoubleBackUpDB.db-journal
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bytedance_downloader.db-journal
/data/data/####/c62237383128c4671464957b00ff11eadca0fae6fd44dd1....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/channel_umeng_common_config.xml
/data/data/####/classes.dex
/data/data/####/clyjkk.png
/data/data/####/cnzz.zip
/data/data/####/com.tencent.liteav.dev_uuid.xml
/data/data/####/com.yanhui.qktx_infoc_config_pref.xml
/data/data/####/com.yanhui.qktx_preferences.xml
/data/data/####/crash
/data/data/####/crash.tmp
/data/data/####/crash.zip
/data/data/####/d2wqrf.xml
/data/data/####/d466ecfe609b980b7c736b5dead65256920b706a61cdd00....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTgyOTM4MDYyNzk2;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTgyOTM4MDg2NjQ1;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1ODI5MzgwNjcwMjg=;
/data/data/####/dW1weF9zaGFyZV8xNTgyOTM4MDY0ODQy;
/data/data/####/dW1weF9zaGFyZV8xNTgyOTM4MDY0OTA1;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db61e876.xml
/data/data/####/dk_search.db-journal
/data/data/####/dy_live.xml
/data/data/####/e2d09b31253d466124dad6881e6bebe9.xml
/data/data/####/ed5bfe4bdbec3416c956d017ae73c00a
/data/data/####/efju65tx.xml
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/fc.xml
/data/data/####/fc_times.xml
/data/data/####/fdd054cdab013624f92142a5265a84b2ed42d5f6441ba9d....0.tmp
/data/data/####/fju78g.data-journal
/data/data/####/fm_shared.xml
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/gpSettings.xml
/data/data/####/gwu8op08ds.data-journal
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/hxdata.xml
/data/data/####/i.html
/data/data/####/i.js
/data/data/####/i==1.2.0&&3.1.15.1_1582938062839_envelope.log
/data/data/####/ibkad_config.xml
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/kobox.0.sp.xml
/data/data/####/libjiagu-1529152297.so
/data/data/####/libmer
/data/data/####/libsvdigk.so
/data/data/####/libsvdigk.so-32
/data/data/####/libsvdigk.so-64
/data/data/####/libsvdigk.so-64 (deleted)
/data/data/####/libwgs2gcj.so
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/md_ad_config.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mobads_aplist_status.xml
/data/data/####/multidex.version.xml
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/p_sp_com.yanhui.qktx.xml
/data/data/####/package_caches.xml
/data/data/####/prdopt.xml
/data/data/####/pref.xml
/data/data/####/pref.xml.bak
/data/data/####/proxy-cn.dex
/data/data/####/proxy-cn.zip
/data/data/####/qktx.xml
/data/data/####/rexxteak.jar
/data/data/####/sbysc.xml
/data/data/####/sdk_share_file.xml
/data/data/####/search_sdk.xml
/data/data/####/seq.xml
/data/data/####/settingsLog.xml
/data/data/####/share.db-journal
/data/data/####/simple-main-msg.dat
/data/data/####/simple-main-req.dat
/data/data/####/sk.xml
/data/data/####/sm.zip
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_global_info.xml
/data/data/####/sp_push_time.xml
/data/data/####/sp_template_delete.xml
/data/data/####/tdargs.xml
/data/data/####/temp_web_sp.xml
/data/data/####/tmp7.xml
/data/data/####/tms_base.xml
/data/data/####/tools8977.xml
/data/data/####/tools8977New2.xml
/data/data/####/tracker.db-journal
/data/data/####/trhcvdgp.jar
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttff.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/update.xml
/data/data/####/url_ad
/data/data/####/url_ad.tmp
/data/data/####/url_ad.zip
/data/data/####/v71.xml
/data/data/####/wdde4f.data-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/woki8ws.xml
/data/data/####/xconfig.xml
/data/data/####/xian_wan_sp_config_table.xml
/data/data/####/xyesout.jar
/data/data/####/yd_config_c.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nid
/data/media/####/.nomedia
/data/media/####/.td-3
/data/media/####/.tdck
/data/media/####/.thumbcache_idx_001
/data/media/####/.umm.dat
/data/media/####/.usdis
/data/media/####/.zjl
/data/media/####/01e576bf6a28d535e3443b1d6c527a44.xml
/data/media/####/01e576bf6a28d535e3443b1d6c527a44.xml.bak (deleted)
/data/media/####/1582938081732.db
/data/media/####/1AF278535C486DC18070D7F86A7F22DB.temp
/data/media/####/3ffb90c0156c7c065414c1c803b9225b.tmp
/data/media/####/8c57527398674f04a67353301b766a00
/data/media/####/8f2b5c6a4f20446b99802b57e3c27a90
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/DBE6A9C2BD7AE80EDFEF46878DB0B843.jar
/data/media/####/DBE6A9C2BD7AE80EDFEF46878DB0B843.temp
/data/media/####/E7ACE756EA704D1F1FB4769319831648
/data/media/####/LiteAV_C.mmap2
/data/media/####/LiteAV_C_20200229.xlog
/data/media/####/_pn
/data/media/####/_shn
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/b9856bab3add981eccc7a9b9ce2b83cd.tmp
/data/media/####/clientudid.dat
/data/media/####/date40003000700
/data/media/####/deviceToken
/data/media/####/e4a1e8c9f1a2407eb8bce588b9a690ae
/data/media/####/eebbf243dc754332986ef05d4a6a6732
/data/media/####/engc.jar
/data/media/####/mdtecfzb.txt
/data/media/####/openInstall_0.csv
/data/media/####/pidfile.txt
/data/media/####/spuid
/data/media/####/tag4.dat813b867a-1ea0-44aa-aba8-0d84766999bd.tmp
/data/media/####/tag4.datf6ddbbad-8042-44f2-9d41-4d76cc333557.tmp
/data/media/####/temp_pkg_info.json
/data/media/####/tmp.licence
/data/media/####/tmpbl.jar
/data/media/####/v26vu3
/data/media/####/webengine.jar

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:59a50d09c895763cc10007e6","utdid":"Xlm3ztd1g3QDAGdzx1F3KDKd","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
busybox ifconfig
cat /proc/self/cgroup
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
getprop
getprop net.dns1
getprop ro.board.platform
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
ls /
ls /sys/class/thermal
ps
sh
su

Загружает динамические библиотеки:

A3AEECD8
Tcc-1.0
libjiagu-1529152297
libmer
libsvdigk
liteavsdk
nms
saturn
smsdk
stlport_shared
tnet-3.1
tobEmbedEncrypt
tongdun
txffmpeg
ut_c_api

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
DESede
Des-ECB-NoPadding
RSA-ECB-OAEPWITHSHA-256ANDMGF1PADDING
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
ARCFOUR
DES
DES-ECB-NoPadding
DESede
Des-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Использует повышенные привилегии.

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней