Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.906.origin
- Android.DownLoader.909.origin
- Android.DownLoader.956.origin
- Android.RemoteCode.262.origin
- Android.RemoteCode.264.origin
- Android.Triada.4567
- Android.Triada.482.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.909.origin
- Android.DownLoader.956.origin
- Android.RemoteCode.262.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) ln####.jqshe####.com:80
- TCP(HTTP/1.1) api.m2g.adoc####.com:80
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) ff.s####.com:8080
- TCP(HTTP/1.1) jx####.em####.com:10519
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) d1.clou####.xyz:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) r.ist####.com:8071
- TCP(HTTP/1.1) s.yf####.com:8088
- TCP(HTTP/1.1) ott.h####.com:8071
- TCP(HTTP/1.1) cdn.clou####.xyz:80
- TCP(HTTP/1.1) 47.95.1####.130:80
- TCP(HTTP/1.1) 1142864####.cn-hang####.fc.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) j####.o####.com:13967
- TCP(HTTP/1.1) tin####.c####.l####.####.com:80
- TCP(HTTP/1.1) alldo####.cqs####.com.####.com:80
- TCP(HTTP/1.1) yun.b####.com:80
- TCP(HTTP/1.1) zc####.mj####.cn:80
- TCP(HTTP/1.1) api.yunco####.com:80
- TCP(HTTP/1.1) q####.c####.l####.####.com:80
- TCP(HTTP/1.1) p####.api.adoc####.com:80
- TCP(HTTP/1.1) 2####.186.173.17:8888
- TCP(HTTP/1.1) 1713464####.cn-hang####.fc.####.com:80
- TCP(HTTP/1.1) i.ist####.com:8071
- TCP(HTTP/1.1) 1####.201.175.19:80
- TCP(HTTP/1.1) mh####.b0.a####.com:80
- TCP(HTTP/1.1) 39.1####.5.68:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) 4####.91.2.53:34656
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) s.yf####.com:8089
- TCP(HTTP/1.1) php.clou####.xyz:80
- TCP(HTTP/1.1) d####.dd7####.com:80
- TCP(HTTP/1.1) 14.17.1####.182:80
- TCP(HTTP/1.1) d1.sho####.com:80
- TCP(HTTP/1.1) d####.f####.top:8080
- TCP(HTTP/1.1) ss.ist####.com:8071
- TCP(HTTP/1.1) g1.ta####.cn:80
- TCP(HTTP/1.1) 47.1####.59.53:900
- TCP(HTTP/1.1) a####.ta####.cn:80
- TCP(HTTP/1.1) v.sho####.com:80
- TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
- TCP(HTTP/1.1) luna-im####.qq.com.####.com:80
- TCP(HTTP/1.1) p####.sho####.com:80
- TCP(HTTP/1.1) s.yf####.com:8090
- TCP(HTTP/1.1) cvvf####.my####.com:80
- TCP(HTTP/1.1) tt####.vni####.com:20147
- TCP(HTTP/1.1) sn####.kv####.com:34656
- TCP(HTTP/1.1) p####.ugd####.com.####.com:80
- TCP(HTTP/1.1) q####.0####.com:13967
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) e4####.0r####.com:10293
- TCP(HTTP/1.1) 6z####.njt####.com:10091
- TCP(TLS/1.0) dig.b####.net:443
- TCP(TLS/1.0) gr####.58.com:443
- TCP(TLS/1.0) we####.58.com:443
- TCP(TLS/1.0) sf3-ttc####.ps####.com:443
- TCP(TLS/1.0) s####.e.qq.com:443
- TCP(TLS/1.0) res.wx.qq.####.com:443
- TCP(TLS/1.0) analy####.map.qq.com:443
- TCP(TLS/1.0) sf6-ttc####.ps####.com.####.com:443
- TCP(TLS/1.0) 1####.217.20.74:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) 2####.58.211.106:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) 1####.217.17.106:443
- TCP(TLS/1.0) bds.sn####.com:443
- TCP(TLS/1.0) to####.ctobsn####.com:443
- TCP(TLS/1.0) api.g####.vip:443
- TCP(TLS/1.0) j1.5####.com.####.com:443
- TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) 1####.217.168.238:443
- TCP(TLS/1.0) api.jiankan####.com:443
- TCP(TLS/1.0) f####.58.com:443
- TCP(TLS/1.0) mi.g####.qq.com:443
- TCP(TLS/1.0) 1####.217.168.234:443
- TCP(TLS/1.0) d####.58.com:443
- TCP(TLS/1.0) t####.m.qq.com:443
- TCP(TLS/1.0) trac####.58.com:443
- TCP(TLS/1.0) alldo####.cqs####.com.####.com:443
- TCP(TLS/1.0) ad1.azh####.com:9190
- TCP(TLS/1.2) 2####.58.211.106:443
- TCP(TLS/1.2) 1####.217.168.238:443
- TCP(TLS/1.2) 1####.217.20.67:443
- TCP(TLS/1.2) 1####.217.168.234:443
- TCP(TLS/1.2) 1####.217.19.195:443
- TCP(TLS/1.2) 1####.217.17.106:443
- TCP(TLS/1.2) 1####.217.17.74:443
- TCP(TLS/1.2) 1####.217.168.193:443
- TCP(TLS/1.2) 1####.217.20.74:443
- TCP(TLS/1.2) 1####.217.19.202:443
- TCP sdk.o####.t####.####.com:5224
- TCP cm-1####.ig####.com:5225
Запросы DNS:
- 6z####.njt####.com
- a####.ta####.cn
- ad.yf####.com
- ad1.azh####.com
- analy####.map.qq.com
- and####.b####.qq.com
- and####.cli####.go####.com
- and####.google####.com
- api.adoc####.com
- api.g####.vip
- api.jiankan####.com
- api.m2g.adoc####.com
- api.yunco####.com
- bds.sn####.com
- c-h####.g####.com
- c.5####.com.cn
- c.yf####.com
- cdn####.f####.top
- cdn-sdk####.g####.com
- cdn.clou####.xyz
- cm-1####.ig####.com
- co####.ssp.adoc####.com
- cvvf####.my####.com
- d####.58.com
- d####.dd7####.com
- d####.f####.top
- d.clou####.xyz
- d1.clou####.xyz
- d1.sho####.com
- dig.b####.net
- dwf.cqs####.com
- e4####.0r####.com
- f####.58.com
- fc.b####.com
- ff.s####.com
- g1.ta####.cn
- googl####.g.doublec####.net
- gr####.58.com
- h####.c####.com
- h5.jiankan####.com
- i.ist####.com
- img.5####.com.cn
- imgc####.qq.com
- is.sn####.com
- j####.o####.com
- j1.5####.com.cn
- jx####.em####.com
- lg.ca####.com
- lh3.googleu####.com
- ln####.jqshe####.com
- m####.go####.com
- mi.g####.qq.com
- oi####.kenanta####.com
- ott.h####.com
- p####.api.adoc####.com
- p####.bugse####.com
- p####.sho####.com
- p####.ugd####.com
- p.ist####.com
- php.clou####.xyz
- php.sho####.com
- plb####.u####.com
- pv.s####.com
- q####.0####.com
- r####.wx.qq.com
- r.ist####.com
- r1.baiyuns####.com
- s####.e.qq.com
- s####.sn####.com
- s.yf####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sf3-ttc####.ps####.com
- sf6-ttc####.ps####.com
- sn####.kv####.com
- ss.ist####.com
- t####.m.qq.com
- t.clou####.xyz
- to####.ctobsn####.com
- trac####.58.com
- tt####.vni####.com
- u####.u####.com
- v.h####.com
- v.sho####.com
- we####.58.com
- we####.58.com
- ym####.89####.com
- yun.b####.com
- z12.c####.com
- z3.c####.com
- z6.c####.com
- zc####.mj####.cn
Запросы HTTP GET:
- 1142864####.cn-hang####.fc.####.com/qs/?pa=####
- 1713464####.cn-hang####.fc.####.com/lg/?lg="0E"55wl"55"4F"55dhj)obfkso~)...
- alldo####.cqs####.com.####.com/rhsdk/NJXS101/xdt.jar
- alldo####.cqs####.com.####.com/tdata_SrK505
- alldo####.cqs####.com.####.com/tdata_fKw278
- alldo####.cqs####.com.####.com/tdata_gZF154
- alldo####.cqs####.com.####.com/tdata_yGc309
- api.m2g.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=####
- api.m2g.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
- api.m2g.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&versi...
- api.m2g.adoc####.com/ssp/mgm/task?taskId=####&ip=####
- cdn.clou####.xyz/jar/cf0218.jar
- cdn.clou####.xyz/jar/luodi0226.jar
- cdn.clou####.xyz/jar/one0306.jar
- cdn.clou####.xyz/jar/oupeng0226.jar
- cdn.clou####.xyz/jar/santi0316.jar
- cdn.clou####.xyz/jar/so0117.jar
- cvvf####.my####.com/c/ieuwndlsn0219.zip
- cvvf####.my####.com/jz/kdyyeeq.zip
- d####.dd7####.com/upload/sdk/zawdex20200320.jar
- d####.dd7####.com/upload/sdk2/hhq01dex20200218.jar
- d####.dd7####.com/upload/sdk2/rq02dex20190829.jar
- d####.dd7####.com/upload/sdk3/kzddex20191224.jar
- d####.f####.top:8080/ttad/api/getAd/HOoKYok4gMkH1gXDnyW1FQ==
- ff.s####.com:8080/ttad/api/jv5/HOoKYok4gMkH1gXDnyW1FQ==/87647e901323c0eb...
- gd.a.s####.com/cityjson
- ln####.jqshe####.com/u/eoncudfs.zip
- ln####.jqshe####.com/u/smqnsdjqje
- luna-im####.qq.com.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/pr...
- mh####.b0.a####.com/sdk/wk_207.html
- mh####.b0.a####.com/sm/tx001.js
- mh####.b0.a####.com/sm/tx002.js
- p####.api.adoc####.com/ip
- p####.ugd####.com.####.com/gdt/0/transformer_16083265646692838921_158473...
- q####.c####.l####.####.com/config/hz-hzv6.conf
- sdk.o####.p####.####.com/api/addr.htm
- sf6-ttc####.ps####.com.####.com/img/mosaic-legacy/2f451000498131d6ac22f~...
- tin####.c####.l####.####.com/TTT052_0018.y
- yun.b####.com/pw/70777777.jpg
- yun.b####.com/pw/765f73646b.jpg
- yun.b####.com/tz/6173.jpg
- yun.b####.com/xtz/741535829.ico
- z.c####.com/stat.htm?id=####&cnzz_eid=####
- zc####.mj####.cn/c/ishyqwddf.zip
- zc####.mj####.cn/two/bmrlewoc
Запросы HTTP POST:
- 4####.91.2.53:34656/aowbg/
- 6z####.njt####.com:10091/wisdom/marking
- a####.ta####.cn/ad-behavior/v1/p2n4n7osvqsgttuw
- and####.b####.qq.com/rqd/async?aid=####
- api.m2g.adoc####.com/ssp/monitor/collect/error
- api.m2g.adoc####.com/titan/monitor/device_info
- api.yunco####.com/service/rest
- c-h####.g####.com/api.php?format=####&t=####
- d1.clou####.xyz/index.php?r=####&sdk=####&ad_type=####&versionCode=####&...
- d1.sho####.com/index.php?r=####
- d1.sho####.com/index.php?r=####&
- e4####.0r####.com:10293/widlth/
- e4####.0r####.com:10293/xkeila/
- g1.ta####.cn/v2/ad
- i.ist####.com:8071/6.0.1/1510864978/1
- j####.o####.com:13967/d0oer/
- jx####.em####.com:10519/qazggd/
- jx####.em####.com:10519/xoslvm/
- ott.h####.com:8071/api/10
- p####.sho####.com/index.php?r=####
- php.clou####.xyz/index.php?r=####
- q####.0####.com:13967/d0oer/
- q####.0####.com:13967/nheae/
- q####.0####.com:13967/x5qn0/
- r.ist####.com:8071/6.0.1/163832107/2
- s####.e.qq.com/activate
- s####.e.qq.com/msg
- s.yf####.com:8088/ad/tk?aid=####&time=####
- s.yf####.com:8089/ad/status
- s.yf####.com:8090/ad/crash
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
- sn####.kv####.com:34656/ixowf/
- sn####.kv####.com:34656/rqiea/
- ss.ist####.com:8071/1
- ss.ist####.com:8071/8
- tt####.vni####.com:20147/dijc1v/
- v.sho####.com/index.php?r=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.turing.dat
- /data/data/####/1004
- /data/data/####/1b9537a0c72b1508_0
- /data/data/####/1c05c83d9696f56a_0
- /data/data/####/1s.dex
- /data/data/####/1s.dex.flock (deleted)
- /data/data/####/1s.jar
- /data/data/####/3121ad2a8e6f8227ea533489e87115c65ff2b8c0784c0ff....0.tmp
- /data/data/####/3202c335e3e8ebc6_0
- /data/data/####/34270f2753ef01a1_0
- /data/data/####/34270f2753ef01a1_1
- /data/data/####/36db4990af6ed145_0
- /data/data/####/3780.yaqcookie
- /data/data/####/40b71c7cf984e836_0
- /data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
- /data/data/####/445848EA3A6DD64B64C949838BE0AB84.dex
- /data/data/####/445848EA3A6DD64B64C949838BE0AB84.dex.flock (deleted)
- /data/data/####/46103b2e7974fdb4_0
- /data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
- /data/data/####/4bda877b6b4f5603_0
- /data/data/####/4f3ace6dac5b7a4b_0
- /data/data/####/59be09ab882d4835_0
- /data/data/####/5cbd27995f497349_0
- /data/data/####/63e51de3fa325051_0
- /data/data/####/661258616528ece0_0
- /data/data/####/661258616528ece0_1
- /data/data/####/6BC299763317EBFA67BE0BBCE7C92C34.dex
- /data/data/####/6BC299763317EBFA67BE0BBCE7C92C34.dex.flock (deleted)
- /data/data/####/6bc899a6db15e662_0
- /data/data/####/72528c46a0759c4a_0
- /data/data/####/744ef7c084f30fac_0
- /data/data/####/771907d13274dee6_0
- /data/data/####/77561935eaa1fff8_0
- /data/data/####/7a843e347ddb1fcb_0
- /data/data/####/82a0362b8711bd40_0
- /data/data/####/82a29d61be10655c_0
- /data/data/####/88c739fbb35c4fc9_0
- /data/data/####/8EAD111D030291821E19A80E344C340A.xml
- /data/data/####/8b2e927714fb40ce_0
- /data/data/####/908d2c85e8521ca9_0
- /data/data/####/90cd51b6d4e5c302_0
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/Cookies-journal
- /data/data/####/DownloadTaskStore.db-journal
- /data/data/####/F1C43ED4C97298FF8B386312B3CF7C72.dex
- /data/data/####/F1C43ED4C97298FF8B386312B3CF7C72.dex.flock (deleted)
- /data/data/####/NJXS101.dex
- /data/data/####/NJXS101.dex.flock (deleted)
- /data/data/####/NJXS101.jar
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/_p.xml
- /data/data/####/_sh.xml
- /data/data/####/a30f3f6deea80ea0_0
- /data/data/####/a4f3c4ec7988052c_0
- /data/data/####/a6a3a44f9427568b_0
- /data/data/####/a9816608831e26a9_0
- /data/data/####/aa357a6bf9a8ee21_0
- /data/data/####/aa428423ba29f523_0
- /data/data/####/adcfg.xml
- /data/data/####/adcfg.xml (deleted)
- /data/data/####/adcfg.xml.bak
- /data/data/####/adcfg.xml.bak (deleted)
- /data/data/####/appuserid.xml
- /data/data/####/b0db65eec4e5705e_0
- /data/data/####/b3b941ecd1fb56e6_0
- /data/data/####/b73724247326c460_0
- /data/data/####/bbb34fc39fd37e62_0
- /data/data/####/bugly_db_-journal
- /data/data/####/c2c53e41d34e6025_0
- /data/data/####/c7925c1db927a1bf_0
- /data/data/####/caac6fd5d00fb94f_0
- /data/data/####/cbed757bc43e36ea_0
- /data/data/####/ccd4c6e0632ee022_0
- /data/data/####/com.healthy.run_preferences.xml
- /data/data/####/com.qq.e.sdkconfig.xml
- /data/data/####/comxcxid.xml
- /data/data/####/config
- /data/data/####/crashrecord.xml
- /data/data/####/d02699af31e6962f_0
- /data/data/####/d110bdc9d01f09de_0
- /data/data/####/d13ad606e90744a5_0
- /data/data/####/d2ffb1a69faa8727_0
- /data/data/####/d47455e0b123a06d_0
- /data/data/####/d47455e0b123a06d_1
- /data/data/####/d6ca3b6cad934f67_0
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTg0Nzc4MTcyNzMz;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTg0Nzc4MTgwNzIz;
- /data/data/####/de88861cdaa166ea_0
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/donewAD_SDK4.6.3.dex
- /data/data/####/donewAD_SDK4.6.3.dex.flock (deleted)
- /data/data/####/donewAD_SDK4.6.3.jar
- /data/data/####/donews_cache.xml
- /data/data/####/donews_cache.xml.bak
- /data/data/####/donews_cache.xml.bak (deleted)
- /data/data/####/e0dc0543d87295da_0
- /data/data/####/e2bc5eda93fc0b54_0
- /data/data/####/e551437dd7d20028_0
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f02a63aded7b505097bb242ae4f520c82a35a67b2469199....0.tmp
- /data/data/####/f33a688728cdb5bd_0
- /data/data/####/f3a2244375f5f267_0
- /data/data/####/f7a2035284e185ab_0
- /data/data/####/f7d2ddcd8ace4a72_0
- /data/data/####/f8a55cef98a837f4_0
- /data/data/####/fb215af10a375f99_0
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/gdt_config.cfg
- /data/data/####/gdt_plugin.dex
- /data/data/####/gdt_plugin.dex.flock (deleted)
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.next.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_stat.db
- /data/data/####/gdt_stat.db-journal
- /data/data/####/gdt_suid
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/https_h5.jiankangzhuan.com_0.localstorage-journal
- /data/data/####/hxdata.xml
- /data/data/####/i==1.2.0&&1.3.1_1584778180724_envelope.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libMMANDKSignature.11c77241.so
- /data/data/####/libbasdso.so
- /data/data/####/libbasdso.so-32
- /data/data/####/libbasdso.so-64
- /data/data/####/libturingau.11c77241.so
- /data/data/####/libyaqbasic.11c77241.so
- /data/data/####/libyaqpro.11c77241.so
- /data/data/####/local_crash_lock
- /data/data/####/local_crash_lock (deleted)
- /data/data/####/metrics_guid
- /data/data/####/mpdc1
- /data/data/####/mqee.xml
- /data/data/####/mqee.xml.bak
- /data/data/####/native_record_lock
- /data/data/####/oxxtbjob.dex (deleted)
- /data/data/####/oxxtbjob.dex.flock (deleted)
- /data/data/####/oxxtbjob.jar
- /data/data/####/proc_auxv
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qig.xml
- /data/data/####/qig.xml.bak
- /data/data/####/qig.xml.bak (deleted)
- /data/data/####/run.pid
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/security_info
- /data/data/####/share_data.xml
- /data/data/####/share_data.xml.bak
- /data/data/####/tdata_SrK505
- /data/data/####/tdata_SrK505.dex
- /data/data/####/tdata_SrK505.dex.flock (deleted)
- /data/data/####/tdata_SrK505.jar
- /data/data/####/tdata_fKw278
- /data/data/####/tdata_fKw278.dex
- /data/data/####/tdata_fKw278.dex.flock (deleted)
- /data/data/####/tdata_fKw278.jar
- /data/data/####/tdata_gZF154
- /data/data/####/tdata_gZF154.dex
- /data/data/####/tdata_gZF154.dex.flock (deleted)
- /data/data/####/tdata_gZF154.jar
- /data/data/####/tdata_yGc309
- /data/data/####/tdata_yGc309.dex
- /data/data/####/tdata_yGc309.dex.flock (deleted)
- /data/data/####/tdata_yGc309.jar
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/turingfd_conf_105498_auMini.xml
- /data/data/####/turingfd_conf_105498_auMini.xml.bak
- /data/data/####/turingfd_protect_105498_39_auMini.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/ufksbe.png
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_location.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_lc
- /data/data/####/xdtversion.xml
- /data/data/####/yaq.11c77241.sec
- /data/data/####/yaq2.11c77241.sec
- /data/data/####/yaq3_0.11c77241.sec
- /data/data/####/yaqsdkcookie
- /data/data/####/yd_config_c.xml
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.fger
- /data/media/####/.qbcr
- /data/media/####/.turing.dat
- /data/media/####/.umm.dat
- /data/media/####/.usdis
- /data/media/####/445848EA3A6DD64B64C949838BE0AB84 (deleted)
- /data/media/####/445848EA3A6DD64B64C949838BE0AB84.jar
- /data/media/####/445848EA3A6DD64B64C949838BE0AB84.temp
- /data/media/####/6BC299763317EBFA67BE0BBCE7C92C34 (deleted)
- /data/media/####/6BC299763317EBFA67BE0BBCE7C92C34.jar
- /data/media/####/6BC299763317EBFA67BE0BBCE7C92C34.temp
- /data/media/####/98155984E260287E0035FD7DEB9DA9C1.temp
- /data/media/####/98155984E260287E0035FD7DEB9DA9C1.zip
- /data/media/####/BED6C83D93510DB2969B45861857DACC
- /data/media/####/C22BD536CB9A2B0A73BC918874FD96B3
- /data/media/####/F01138D00D81ABA625D6972D3F77636B
- /data/media/####/F1C43ED4C97298FF8B386312B3CF7C72
- /data/media/####/F1C43ED4C97298FF8B386312B3CF7C72.temp
- /data/media/####/F1C43ED4C97298FF8B386312B3CF7C72.zip
- /data/media/####/_pn
- /data/media/####/_shn
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.healthy.run.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/test.log
- /data/media/####/ykv
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.mpasi/oxxtbjob.jar --oat-fd=114 --oat-location=/data/user/0/<Package>/.mpasi/oxxtbjob.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_e_qq_com_plugin_50b4b23653d8e4bd91617fad8cbae670/gdt_plugin.jar --oat-fd=138 --oat-location=/data/user/0/<Package>/app_e_qq_com_dex/gdt_plugin.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/1s.jar --oat-fd=57 --oat-location=/data/user/0/<Package>/app_dex/1s.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/donewAD_SDK4.6.3.jar --oat-fd=36 --oat-location=/data/user/0/<Package>/files/donewAD_SDK4.6.3.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tda/NJXS101.jar --oat-fd=50 --oat-location=/data/user/0/<Package>/files/tda/NJXS101.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_SrK505.jar --oat-fd=61 --oat-location=/data/user/0/<Package>/files/tdata_SrK505.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_fKw278.jar --oat-fd=47 --oat-location=/data/user/0/<Package>/files/tdata_fKw278.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_gZF154.jar --oat-fd=50 --oat-location=/data/user/0/<Package>/files/tdata_gZF154.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_yGc309.jar --oat-fd=58 --oat-location=/data/user/0/<Package>/files/tdata_yGc309.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/rr/<Package>/vlp/445848EA3A6DD64B64C949838BE0AB84.jar --oat-fd=106 --oat-location=/data/user/0/<Package>/files/445848EA3A6DD64B64C949838BE0AB84.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/rr/<Package>/vlp/6BC299763317EBFA67BE0BBCE7C92C34.jar --oat-fd=65 --oat-location=/data/user/0/<Package>/files/6BC299763317EBFA67BE0BBCE7C92C34.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/yax/<Package>/gn/98155984E260287E0035FD7DEB9DA9C1.zip --oat-fd=137 --oat-location=/data/user/0/<Package>/files/98155984E260287E0035FD7DEB9DA9C1.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/yax/<Package>/gn/F1C43ED4C97298FF8B386312B3CF7C72.zip --oat-fd=120 --oat-location=/data/user/0/<Package>/files/F1C43ED4C97298FF8B386312B3CF7C72.dex --compiler-filter=speed
- /system/bin/df
- /system/bin/getprop
- cat /proc/version
- cat /sys/class/net/wlan0/address
- getprop
- getprop ro.board.platform
- getprop ro.product.cpu.abi
- getprop sys.usb.state
- ls /
- ls /sys/class/thermal
- sh
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES
- Des-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES
- Des-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-None-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
