Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.906.origin
- Android.Triada.4567
- Android.Triada.482.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 1####.114.114.114:53
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) wap.78####.cc:80
- TCP(HTTP/1.1) 1713464####.cn-hang####.fc.####.com:80
- TCP(HTTP/1.1) api.m2g.adoc####.com:80
- TCP(HTTP/1.1) co####.ssp.adoc####.com:80
- TCP(HTTP/1.1) t####.sogo####.com.####.com:80
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) ad.l####.com:3001
- TCP(HTTP/1.1) sd.bu####.vip:80
- TCP(HTTP/1.1) res####.a####.top:80
- TCP(HTTP/1.1) i####.t####.s####.com:80
- TCP(HTTP/1.1) r####.bu####.vip:80
- TCP(HTTP/1.1) tt####.vni####.com:20147
- TCP(HTTP/1.1) www.78####.cc:80
- TCP(HTTP/1.1) n5dqwjz####.b0.a####.com:80
- TCP(HTTP/1.1) b####.bugse####.com:3002
- TCP(HTTP/1.1) p####.api.adoc####.com:80
- TCP(HTTP/1.1) st####.tin####.com:80
- TCP(HTTP/1.1) pg####.d2####.com:10273
- TCP(HTTP/1.1) mh####.b0.a####.com:80
- TCP(HTTP/1.1) log-re####.com:80
- TCP(HTTP/1.1) 1####.29.29.29:80
- TCP(HTTP/1.1) 1####.196.131.99:3001
- TCP(HTTP/1.1) b####.bugse####.com:3000
- TCP(HTTP/1.1) a.78####.cc:80
- TCP(HTTP/1.1) b####.bugse####.com:3001
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
- TCP(HTTP/1.1) ad.l####.com:3000
- TCP(HTTP/1.1) 39.1####.5.68:80
- TCP(HTTP/1.1) 1142864####.cn-hang####.fc.####.com:80
- TCP(HTTP/1.1) tinychi####.q####.com.####.com:80
- TCP(HTTP/1.1) yq####.jn####.ltd:80
- TCP(HTTP/1.1) m.jufe####.com:80
- TCP(HTTP/1.1) t####.a####.top:80
- TCP(HTTP/1.1) chec####.cc:80
- TCP(HTTP/1.1) bb####.net:80
- TCP(HTTP/1.1) app.a####.top:80
- TCP(HTTP/1.1) filt####.a####.top:80
- TCP(HTTP/1.1) lo.bu####.vip:80
- TCP(HTTP/1.1) yun.b####.com:80
- TCP(HTTP/1.1) b####.bugse####.com:80
- TCP(HTTP/1.1) 78####.cc:80
- TCP(HTTP/1.1) s####.al####.com:80
- TCP(HTTP/1.1) e4####.0r####.com:10293
- TCP(HTTP/1.1) gn####.f####.top:8080
- TCP(HTTP/1.1) r1.baiyuns####.com:80
- TCP(HTTP/1.1) api.yunco####.com:80
- TCP(HTTP/1.1) png.lu.sogo####.####.com:80
- TCP(HTTP/1.1) ap####.math####.cn:80
- TCP(HTTP/1.1) 6z####.njt####.com:10091
- TCP(HTTP/1.1) ad.l####.com:80
- TCP(HTTP/1.1) ad.l####.com:3002
- TCP(TLS/1.0) 1####.217.168.234:443
- TCP(TLS/1.0) mip-red####.s####.cn:443
- TCP(TLS/1.0) mipst####.s####.cn:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) sf3-ttc####.ps####.com:443
- TCP(TLS/1.0) ims-####.sm.cn:443
- TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) st3.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) app-ro####.leanc####.cn:443
- TCP(TLS/1.0) s####.shidux####.com:443
- TCP(TLS/1.0) dev.api.c####.####.net:443
- TCP(TLS/1.0) et2.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) api.g####.vip:443
- TCP(TLS/1.0) s####.al####.com:443
- TCP(TLS/1.0) ad1.azh####.com:9190
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) log.mm####.com:443
- TCP(TLS/1.2) 2####.58.208.106:443
- TCP(TLS/1.2) 1####.217.17.138:443
- TCP(TLS/1.2) 1####.217.19.195:443
- TCP 39.1####.38.25:9059
- TCP gw.adv####.com:8080
Запросы DNS:
- 360####.org
- 4s####.8c####.com
- 617.a####.top
- 617.a####.top.####.8
- 6z####.njt####.com
- 78####.cc
- a####.m.sm.cn
- a.78####.cc
- ad.l####.com
- ad1.azh####.com
- ad2.azh####.com
- ap####.math####.cn
- api.adoc####.com
- api.g####.vip
- api.m2g.adoc####.com
- api.meiju####.n####.####.8
- api.meiju####.net/
- api.minc####.com
- api.yunco####.com
- app-ro####.leanc####.cn
- app.a####.top
- b####.bugse####.com
- b####.bugse####.com
- bb####.net
- c####.be####.s####.com
- c####.mm####.com
- c.c####.com
- cdn####.f####.top
- chec####.cc
- co####.ssp.adoc####.com
- e4####.0r####.com
- fc.b####.com
- filt####.a####.top
- fou####.ta####.com
- g.al####.com
- gm.mm####.com
- gn####.f####.top
- gw.adv####.com
- h####.c####.com
- hm.b####.com
- i####.t####.s####.com
- i####.uc.cn
- ims-####.sm.cn
- is.sn####.com
- l####.m.sm.cn
- lg.ca####.com
- lhyysdk####.oss-cn-####.aliy####.com
- lo.bu####.vip
- log-re####.com
- log.mm####.com
- m####.go####.com
- m.jufe####.com
- mip-red####.s####.cn
- mipst####.s####.cn
- n5.dq####.com
- p####.api.adoc####.com
- p####.bugse####.com
- p####.gol####.s####.com
- pg####.d2####.com
- plb####.u####.com
- png.lu.sogo####.com
- pv.s####.com
- qqpa####.api.l####.net
- qqpa####.s####.l####.net
- r####.bu####.vip
- r####.bu####.vip
- r1.baiyuns####.com
- res####.a####.top
- rs1.minc####.com
- s####.al####.com
- s####.kt####.com
- s####.kt####.com.####.8
- s####.m.sm.cn
- s####.shidux####.com
- s2.z####.cn
- s4.c####.com
- s9.c####.com
- sd.bu####.vip
- sf3-ttc####.ps####.com
- st####.tin####.com
- t####.a####.top
- t####.sogo####.com
- tt####.vni####.com
- u####.a####.top
- u####.u####.com
- wa.bu####.vip
- wap.78####.cc
- www.78####.cc
- wz.78####.cc
- y####.m.sm.cn
- yq####.jn####.ltd
- yun.b####.com
- z12.c####.com
- z3.c####.com
Запросы HTTP GET:
- 1142864####.cn-hang####.fc.####.com/qs/?pa=####
- 1142864####.cn-hang####.fc.####.com/xqs/?pa=####
- 1713464####.cn-hang####.fc.####.com/lg/?lg="0E"55wl"55"4F"55dhj)jbnmr2>5...
- 78####.cc/index/count/count_shell?shellname=####
- a.78####.cc/index/upapp/app_datas?upapp_id=####&imei=####&channel_id=####
- ad.l####.com/sdk_ad
- ad.l####.com:3000/api?rdtime=####&secure=####&channel=####&osv=####&adid...
- ad.l####.com:3001/api?rdtime=####&secure=####&channel=####&osv=####&adid...
- ad.l####.com:3002/api?rdtime=####&secure=####&channel=####&osv=####&adid...
- ap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
- app.a####.top/anshuaControl.json
- b####.bugse####.com/sdk_ad
- b####.bugse####.com/sg001.js
- b####.bugse####.com:3000/api?rdtime=####&secure=####&channel=####&osv=##...
- b####.bugse####.com:3001/api?rdtime=####&secure=####&channel=####&osv=##...
- b####.bugse####.com:3002/api?rdtime=####&secure=####&channel=####&osv=##...
- chec####.cc/feature/config?platform=####&app_id=####&version_code=####&a...
- chec####.cc/jd?a=####&v=####&vc=####&p=####&av=####&d=####
- co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
- co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
- co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
- filt####.a####.top/filter_control_617.json
- gd.a.s####.com/cityjson?ie=####
- gn####.f####.top:8080/qsad/api/jv6/ipkYjXUqPXLbo2wJuiygGA==/DRW7357D3V1C...
- i####.t####.s####.com/ask?id=####&cb=####&ssi0=####&wsg=####&_v=####
- i####.t####.s####.com/wap_ask_service?callback=####&url=####
- i####.t####.s####.com/wapxml?id=####&h=####&w=####&fv=####&if=####&mi=##...
- lo.bu####.vip/v1/log/track?key=####&mtype=####&device_####&pkg=####&subi...
- m.jufe####.com/caihua/libnms.so
- m.jufe####.com/caihua/libnms64.so
- m.jufe####.com/ot/so/sodown.jsp
- m.jufe####.com/ot/so/sodown.jsp?type=####
- m.jufe####.com/v2/cd.jsp?ch=####&appId=####&androidId=####&v=####
- m.jufe####.com/v2/ci.jsp?ch=####&androidId=####&v=####
- mh####.b0.a####.com/api/sdk-api-ad.js
- mh####.b0.a####.com/favicon.ico
- mh####.b0.a####.com/sdk/tt_001.html
- mh####.b0.a####.com/sm/tx001.js
- mh####.b0.a####.com/sm/tx002.js
- n5dqwjz####.b0.a####.com/100199.html
- n5dqwjz####.b0.a####.com/moban5/css/base.min.css
- p####.api.adoc####.com/ip
- png.lu.sogo####.####.com/wap/js/wp.js
- r####.bu####.vip/assets/bdtj/ws12_main.html?hmsr=####&hmpl=####
- res####.a####.top/LHYY.png
- res####.a####.top/sdk10_2.png
- res####.a####.top/sdk3.png
- res####.a####.top/sdk6.png
- s####.al####.com/L1/272/6837/static/wap/img/uc-32.png
- s####.al####.com/L1/272/6837/static/wap/img/uc.png
- sf3-ttc####.ps####.com/ims?kt=####&at=####&key=aHR####&sign=yx####&tv=##...
- sf3-ttc####.ps####.com/s/uae/g/3o/client_op/resource/20200514/1589449227...
- st####.tin####.com/static/ij-cloud/cs/google_analytics_6.aar
- t####.a####.top/anshua.json
- t####.a####.top/pingpaiAD.json
- t####.sogo####.com.####.com/wap/css/common.css
- tinychi####.q####.com.####.com/TTT021_036.y
- tinychi####.q####.com.####.com/api_101_api.jar
- tinychi####.q####.com.####.com/lijian.jar
- tinychi####.q####.com.####.com/sm_test_3_sm_c.jar
- wap.78####.cc/api/cn/1
- www.78####.cc/index/backend/pro_count?event_id=####&imei=####&channel_id...
- www.78####.cc/index/project/project_status?action=####
- www.78####.cc/index/publics/get_hot_data
- yq####.jn####.ltd/sy/jpiohcw
- yq####.jn####.ltd/zz/436sdfbokwyf.zip
- yun.b####.com/pw/666f72627974.jpg
- yun.b####.com/pw/70777777.jpg
- yun.b####.com/pw/765f73646b.jpg
- yun.b####.com/tz/6173.jpg
- yun.b####.com/xtz/1579072131.ico
- z.c####.com/stat.htm?id=####&cnzz_eid=####
Запросы HTTP POST:
- 6z####.njt####.com:10091/wisdom/marking
- api.m2g.adoc####.com/ssp/monitor/collect/error
- api.yunco####.com/service/rest
- bb####.net/j1
- e4####.0r####.com:10293/widlth/
- e4####.0r####.com:10293/xkeila/
- log-re####.com/report
- pg####.d2####.com:10273/dvjnzt/
- pg####.d2####.com:10273/rnggno/
- pg####.d2####.com:10273/tzvntp/
- r1.baiyuns####.com/service/rest
- sd.bu####.vip/v1/project/sdk
- sd.bu####.vip/v1/wake/list
- tt####.vni####.com:20147/dijc1v/
- www.78####.cc/index/backend/pro_data
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.6173.apk
- /data/data/####/.6173.dex
- /data/data/####/.6173.dex.flock (deleted)
- /data/data/####/.666f72627974.apk
- /data/data/####/.666f72627974.dex
- /data/data/####/.666f72627974.dex.flock (deleted)
- /data/data/####/.70777777.apk
- /data/data/####/.70777777.dex
- /data/data/####/.70777777.dex.flock (deleted)
- /data/data/####/.765f73646b.apk
- /data/data/####/.765f73646b.dex
- /data/data/####/.765f73646b.dex.flock (deleted)
- /data/data/####/.imprint
- /data/data/####/.usdis
- /data/data/####/.wq
- /data/data/####/00509068edb8203a_0
- /data/data/####/01252e32041eefa0_0
- /data/data/####/01e7683cd2fe1f5e_0
- /data/data/####/0389ab9faa3d953a_0 (deleted)
- /data/data/####/042b705c03135639_0
- /data/data/####/09230ebd5f3fc307_0
- /data/data/####/0da42c3166426948_0
- /data/data/####/0da42c3166426948_1
- /data/data/####/0e350b766d596aff_0
- /data/data/####/0e350b766d596aff_1
- /data/data/####/1021689741840853517
- /data/data/####/10_2.dex
- /data/data/####/10_2.dex.flock (deleted)
- /data/data/####/10_2.jar
- /data/data/####/124fc0a13d820b79_0
- /data/data/####/161e8125686aafae_0
- /data/data/####/1a9cc4fcc65e5ac7_0
- /data/data/####/1a9cc4fcc65e5ac7_1
- /data/data/####/1b35351742fbe1af_0
- /data/data/####/1b8474242f8843cd_0
- /data/data/####/1f342dc146549bc6_0
- /data/data/####/214b24e970f6e9a394ac80a4af8a671e.db
- /data/data/####/21b60fb6adc59d02_0
- /data/data/####/21b60fb6adc59d02_0 (deleted)
- /data/data/####/2437898672c2a2ef_0
- /data/data/####/2e501745fad44f7433cdff62785072ef.xml
- /data/data/####/2e501745fad44f7433cdff62785072ef.xml.bak
- /data/data/####/3.dex (deleted)
- /data/data/####/3.dex.flock (deleted)
- /data/data/####/3.jar
- /data/data/####/32faa71f5d5450f9_0
- /data/data/####/35b1c3e9b2f02e66_0
- /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5
- /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.dex
- /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.dex.flock (deleted)
- /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.jar
- /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.temp
- /data/data/####/3f78443ecd98eeb6_0
- /data/data/####/41B044BC0D9AD6EFABDFCDAA837E677A.temp
- /data/data/####/437c42f44a8b804b_0
- /data/data/####/437c42f44a8b804b_1
- /data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
- /data/data/####/464fcfcb0a983918_0
- /data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
- /data/data/####/4a6640255aabfbea_0
- /data/data/####/4aa957d1d9fd0672_0
- /data/data/####/4e45bac7838d2deb_0
- /data/data/####/4e45de49dd76c599_0
- /data/data/####/4fe7bd89a01cf83a_0
- /data/data/####/508e3c9f033c9951_0
- /data/data/####/58e1ffad1eaf8445_0
- /data/data/####/58e1ffad1eaf8445_1
- /data/data/####/6.dex
- /data/data/####/6.dex.flock (deleted)
- /data/data/####/6.jar
- /data/data/####/6563f6812dcc1145_0
- /data/data/####/66c548d315b32b4e_0
- /data/data/####/6e3639be22445ca6_0
- /data/data/####/71ea3523cdcca367_0
- /data/data/####/71f001fbe4d42d5b_0
- /data/data/####/74cc40abe940518b_0
- /data/data/####/78457bf3531f964a_0
- /data/data/####/78e2ca2d3d37ec44_0 (deleted)
- /data/data/####/7a8f11619dc79ad6_0
- /data/data/####/7cbf62915c2bf508_0
- /data/data/####/7e045dff6158f7bb_0
- /data/data/####/80c90ad1b1976058_0
- /data/data/####/8261fccd7f906d43_0
- /data/data/####/85d67f99e81b7178_0
- /data/data/####/8650f41c7407a1ac_0
- /data/data/####/87236ad5fabafe74_0
- /data/data/####/87236ad5fabafe74_1
- /data/data/####/87280a863440708b_0
- /data/data/####/87fc0819166fac16_0
- /data/data/####/89713aa6b2dffebb_0
- /data/data/####/8EAD111D030291821E19A80E344C340A.xml
- /data/data/####/8c49518f87242ac7_0
- /data/data/####/8caf5eb5be93132a_0
- /data/data/####/8cb9fc596ece5fde_0
- /data/data/####/8cb9fc596ece5fde_1
- /data/data/####/8cc64d0fea5a6014_0
- /data/data/####/8d56590b19c4c3da_0
- /data/data/####/8ed443ddaabfcd0a_0
- /data/data/####/8f68b92eb8d59c6c_0
- /data/data/####/91c0612f7cba5c37_0
- /data/data/####/93992d089b2fd682_0
- /data/data/####/93a34fe8d0bdbc1425e88dd745161a17.db
- /data/data/####/95616c3b2b712ad2_0
- /data/data/####/9cd922d694fd834e_0
- /data/data/####/AC7D79D8E346210837DAD001BF9C25D0
- /data/data/####/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- /data/data/####/CBGr2.xml
- /data/data/####/Cookies-journal
- /data/data/####/HttpDNSConstantsJson.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/_p.xml
- /data/data/####/_pn
- /data/data/####/_sh.xml
- /data/data/####/_shn
- /data/data/####/a344b79e429b4aff_0
- /data/data/####/a46d2fddc5fbbaec_0 (deleted)
- /data/data/####/a70b4d6df674f93d_0
- /data/data/####/a888b2ce5d18a925_0
- /data/data/####/a888b2ce5d18a925_1
- /data/data/####/af4c477bc439eaed_0
- /data/data/####/af718ea2158bb085_0
- /data/data/####/api.dex
- /data/data/####/api.dex.flock (deleted)
- /data/data/####/api.jar
- /data/data/####/b2ce02c8ed583b3a_0
- /data/data/####/b3faf2abec0ade95_0
- /data/data/####/bt.xml
- /data/data/####/bt.xml.bak
- /data/data/####/c1a556f077c124d3_0
- /data/data/####/c2a22b733c47aacb_0
- /data/data/####/c3f3e2391731e0dc_0
- /data/data/####/c6c1bac454cfa761_0
- /data/data/####/ca4097f4fbccad32_0
- /data/data/####/ca4097f4fbccad32_0 (deleted)
- /data/data/####/cdaeb425fe344e29_0
- /data/data/####/ce818a1f2604843e_0
- /data/data/####/com.avos.avoscloud.RequestStatisticsUtil.data.xml
- /data/data/####/com.avos.avoscloud.approuter.QqPaQAtHqfTPdB183T...ml.bak
- /data/data/####/com.avos.avoscloud.approuter.QqPaQAtHqfTPdB183T...sz.xml
- /data/data/####/com.meiju592.app_preferences.xml
- /data/data/####/d044d44896450e5b_0
- /data/data/####/d9d9d845c5944e1c_0
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTg5NTMzNTQwMTM1;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTg5NTMzNTQzMTcw;
- /data/data/####/data.m
- /data/data/####/db1079d0268380b1_0
- /data/data/####/dd16cf8befde4f0d_0
- /data/data/####/dns_ip_info.db
- /data/data/####/dns_ip_info.db-journal
- /data/data/####/downUmeng.dex (deleted)
- /data/data/####/downUmeng.dex.flock (deleted)
- /data/data/####/downUmeng.jar
- /data/data/####/downloader.db-journal
- /data/data/####/e264bfb0879409ca_0
- /data/data/####/e2be2cad701429a5_0
- /data/data/####/e5863f2edaa7b33a_0
- /data/data/####/ea28bfc343c658b7_0
- /data/data/####/edaabf2cbd78b31b_0
- /data/data/####/efbf13630752065b_0
- /data/data/####/efbf13630752065b_1
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f026ef5c8fbda785bdc0f43ad98c9383.db
- /data/data/####/f06ee32aa1eda3a5_0
- /data/data/####/f2299f9aa9fcde49_0
- /data/data/####/f45d55646195c04d_0
- /data/data/####/f50fd18752b98d15_0
- /data/data/####/fd5f339fc12f3456_0
- /data/data/####/ff10faf193a15fbd_0
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/google_analytics.jar
- /data/data/####/google_analytics.jar.dex
- /data/data/####/google_analytics.jar.dex.flock (deleted)
- /data/data/####/https_yz.m.sm.cn_0.localstorage-journal
- /data/data/####/i==1.2.0&&全球VIP绝版_1589533540061_envelope.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/javasdklog.xml
- /data/data/####/joeuhu.png
- /data/data/####/libnms.so
- /data/data/####/libnms64.so
- /data/data/####/libomnwdo.so
- /data/data/####/libomnwdo.so-32
- /data/data/####/libomnwdo.so-64
- /data/data/####/lijian.dex
- /data/data/####/lijian.dex.flock (deleted)
- /data/data/####/lijian.jar
- /data/data/####/meijuniaoV2.db-journal
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/qqsz_file.xml
- /data/data/####/qqsz_file.xml.bak
- /data/data/####/qsunn.dex
- /data/data/####/qsunn.dex.flock (deleted)
- /data/data/####/qsunn.jar
- /data/data/####/qsunn.tmp (deleted)
- /data/data/####/qsunn.x
- /data/data/####/sdkinit.xml
- /data/data/####/sltxnncn.dex (deleted)
- /data/data/####/sltxnncn.dex.flock (deleted)
- /data/data/####/sltxnncn.jar
- /data/data/####/sm_test.dex
- /data/data/####/sm_test.dex.flock (deleted)
- /data/data/####/sm_test.jar
- /data/data/####/spu_ti.xml
- /data/data/####/spu_yj.xml
- /data/data/####/the-real-index
- /data/data/####/tt_sdk_settings.xml
- /data/data/####/tt_sdk_settings.xml.bak
- /data/data/####/ttopenadsdk.xml
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_location.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/yd_config_c.xml
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.pmjxg/sltxnncn.jar --oat-fd=235 --oat-location=/data/user/0/<Package>/.pmjxg/sltxnncn.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/api/api.jar --oat-fd=129 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/api/api.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/lijian/lijian.jar --oat-fd=86 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/lijian/lijian.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/sm_test/sm_test.jar --oat-fd=108 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/sm_test/sm_test.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.6173.apk --oat-fd=135 --oat-location=/data/user/0/<Package>/files/.6173.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.666f72627974.apk --oat-fd=163 --oat-location=/data/user/0/<Package>/files/.666f72627974.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.70777777.apk --oat-fd=70 --oat-location=/data/user/0/<Package>/files/.70777777.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.765f73646b.apk --oat-fd=166 --oat-location=/data/user/0/<Package>/files/.765f73646b.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_qqsz_file/qsunn.jar --oat-fd=184 --oat-location=/data/user/0/<Package>/app_qqsz_file/qsunn.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng.jar --oat-fd=56 --oat-location=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng/downUmeng.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/google_analytics.jar.dex --oat-fd=83 --oat-location=/data/user/0/<Package>/files/out/google_analytics.jar.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/rqz/<Package>/ljd/37CF6BD4BA0A29794B0857B09C00DCE5.jar --oat-fd=227 --oat-location=/data/user/0/<Package>/files/37CF6BD4BA0A29794B0857B09C00DCE5.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.jar --oat-fd=137 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/3.jar --oat-fd=86 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/3.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/6.jar --oat-fd=99 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/6.dex --compiler-filter=speed
- cat /proc/version
- cat /sys/class/net/wlan0/address
- getprop
- getprop ro.board.platform
- getprop ro.build.version.emui
- getprop ro.product.cpu.abi
- ls /
- ls /sys/class/thermal
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES
- DESede-CBC-PKCS5Padding
- Des-ECB-NoPadding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
- DESede-CBC-PKCS5Padding
- Des-ECB-NoPadding
- RSA-None-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
