Android.Triada.4806

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Click.345.origin
Android.DownLoader.1007.origin
Android.DownLoader.363.origin
Android.Triada.4567
Android.Triada.482.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) t####.a####.top:80
TCP(HTTP/1.1) c####.jumen####.com:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) res####.a####.top:80
TCP(HTTP/1.1) cn.f####.top:8080
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) www.pc####.com.####.cn:80
TCP(HTTP/1.1) xvg####.pes####.com:18001
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) p####.pc####.com.cn:80
TCP(HTTP/1.1) ad2.pearv####.com:80
TCP(HTTP/1.1) lo####.sp####.mig.####.net:80
TCP(HTTP/1.1) c####.zhito####.com:807
TCP(HTTP/1.1) ec####.b####.com:80
TCP(HTTP/1.1) cw####.mintl####.cn:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) m.yue####.com:80
TCP(HTTP/1.1) a####.d####.com:80
TCP(HTTP/1.1) u####.a####.top:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) rq####.sp####.mig.####.net:80
TCP(HTTP/1.1) q####.com.a.####.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) m.xiaoshu####.cn:80
TCP(HTTP/1.1) www.78####.cc:80
TCP(HTTP/1.1) m.lsxue####.cn:80
TCP(HTTP/1.1) 1####.76.103.4:28018
TCP(HTTP/1.1) ip####.com:80
TCP(HTTP/1.1) f####.ttb####.cn:80
TCP(HTTP/1.1) 4####.83.77.145:80
TCP(HTTP/1.1) i.iqt####.com:651
TCP(HTTP/1.1) zz.android####.website:80
TCP(HTTP/1.1) c####.zhito####.com:99
TCP(HTTP/1.1) ne####.x####.com.cn:80
TCP(HTTP/1.1) r1.baiyuns####.com:80
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) acti####.t####.cn:80
TCP(HTTP/1.1) 4####.98.31.107:901
TCP(HTTP/1.1) 47.1####.122.27:99
TCP(HTTP/1.1) 23.1####.13.121:80
TCP(HTTP/1.1) ivy.pcon####.com.cn:80
TCP(HTTP/1.1) m.gs####.cn:80
TCP(HTTP/1.1) 1####.201.175.19:80
TCP(HTTP/1.1) xvg####.pes####.com:17001
TCP(HTTP/1.1) 1####.57.161.133:8000
TCP(HTTP/1.1) c####.zhito####.com:8881
TCP(HTTP/1.1) www.f####.com:80
TCP(HTTP/1.1) zhit####.com:99
TCP(HTTP/1.1) tys####.wwe####.com:17001
TCP(HTTP/1.1) zhit####.com:808
TCP(HTTP/1.1) c####.zhito####.com:808
TCP(HTTP/1.1) p####.163.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) api.z####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) 14.17.1####.182:80
TCP(HTTP/1.1) down####.baiyuns####.com:80
TCP(HTTP/1.1) g.cn.miao####.com:80
TCP(HTTP/1.1) now####.pes####.com:18001
TCP(HTTP/1.1) 1####.27.70.235:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) 1####.77.67.185:28018
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) 52.1####.28.42:80
TCP(HTTP/1.1) u####.dspliul####.com:99
TCP(HTTP/1.1) ad.toads####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) 47.1####.211.73:80
TCP(HTTP/1.1) app.a####.top:80
TCP(HTTP/1.1) 6z####.njt####.com:10091
TCP(TLS/1.0) alldo####.linx####.com.####.com:443
TCP(TLS/1.0) lbs.net####.im:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) c.gridsum####.com:443
TCP(TLS/1.0) www.pcon####.com.cn:443
TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) ti####.c####.l####.####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) i####.pcon####.com.cn:443
TCP(TLS/1.0) res.wx.qq.####.com:443
TCP(TLS/1.0) c####.pc####.com.cn:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) wtc.d####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) d0.x####.com.cn:443
TCP(TLS/1.0) qy-swa####.qi####.com:443
TCP(TLS/1.0) img.pcon####.com.####.cn:443
TCP(TLS/1.0) ip.ws.1####.net:443
TCP(TLS/1.0) nim.qi####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) g.1####.com:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) to####.ctobsn####.com:443
TCP(TLS/1.0) i####.d####.com:443
TCP(TLS/1.0) pang####.sn####.com:443
TCP(TLS/1.0) sw4.d####.com:443
TCP(TLS/1.0) dxp.b####.com:443
TCP(TLS/1.0) api.g####.vip:443
TCP(TLS/1.0) w.i####.com:443
TCP(TLS/1.0) img.pc####.com.cn:443
TCP(TLS/1.0) f####.ttb####.cn:443
TCP(TLS/1.0) mg####.pcon####.com.cn:443
TCP(TLS/1.0) sy.cl####.com:443
TCP(TLS/1.0) a####.evergr####.com:443
TCP(TLS/1.0) po####.pc####.com.cn:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) i####.jd.com:443
TCP(TLS/1.0) i####.xca####.com.####.cn:443
TCP(TLS/1.0) www.pc####.com.####.cn:443
TCP(TLS/1.0) bigdata####.evergr####.com:443
TCP(TLS/1.0) s####.x####.com.cn:443
TCP(TLS/1.0) mp.we####.qq.com:443
TCP(TLS/1.0) p####.pc####.com.cn:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) ivy.pcon####.com.cn:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) g.cn.miao####.com:443
TCP(TLS/1.0) ue.3con####.com:443
TCP(TLS/1.0) dm.ps####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) js.3con####.com.####.cn:443
TCP(TLS/1.0) api.zp####.com:443
TCP(TLS/1.0) mr####.pc####.com.cn:443
TCP(TLS/1.0) counter####.pc####.com.cn:443
TCP(TLS/1.0) api16-a####.pa####.io.####.net:443
TCP(TLS/1.0) u####.v.bs####.cn:443
TCP(TLS/1.0) ne####.x####.com.cn:443
TCP(TLS/1.0) dm.tou####.com:443
TCP(TLS/1.0) andro####.oss-cn-####.aliy####.com:443
TCP l####.net####.im:8080
TCP zb-cent####.m.ta####.com:443
TCP 1####.0.13.254:37947

Запросы DNS:

602.a####.top
6z####.njt####.com
a####.d####.com
a####.evergr####.com
a####.man.aliy####.com
acti####.t####.cn
ad.toads####.com
ad2.pearv####.com
adm.android####.website
ag####.m.ta####.com
amdc####.m.ta####.com
and####.b####.qq.com
andro####.oss-cn-####.aliy####.com
api.g####.vip
api.yunco####.com
api.z####.com
api.zp####.com
api16-a####.pa####.io
app.a####.top
ass####.xca####.com
bbt####.wwe####.com
bigdata####.evergr####.com
c####.jumen####.com
c####.mm####.com
c####.pc####.com.cn
c####.x####.com.cn
c####.zhito####.com
c.c####.com
c.gridsum####.com
cn.f####.top
counter####.pc####.com.cn
cr.3con####.com
cw####.mintl####.cn
d0.x####.com.cn
dig.b####.net
dm.byted####.com
dm.ps####.com
dm.tou####.com
down####.baiyuns####.com
dup.baidust####.com
dwf.linx####.com
dxp.b####.com
ec####.b####.com
f####.evergr####.com
f####.ttb####.cn
filt####.a####.top
g.1####.com
g.cn.miao####.com
hm.b####.com
i####.d####.com
i####.jd.com
i####.pc####.com.cn
i####.x####.com.cn
i####.xca####.com
i####.xca####.com
i.iqt####.com
img.pc####.com.cn
img.pcon####.com.cn
ip####.com
ip.remo####.com
ip.ws.1####.net
ivy.pcon####.com.cn
j####.g####.vip
js.3con####.com
js.x####.com.cn
jwz.3con####.com
kyy####.wwe####.com
l####.net####.im
l####.tbs.qq.com
lbs.net####.im
lhyysdk####.oss-cn-####.aliy####.com
m####.pc####.com.cn
m.funny####.cn
m.gs####.cn
m.lsxue####.cn
m.xiaoshu####.cn
m.yue####.com
mg####.pcon####.com.cn
mp.we####.qq.com
mr####.pc####.com.cn
ne####.x####.com.cn
nim.qi####.com
now####.pes####.com
p####.163.com
p####.pc####.com.cn
pang####.sn####.com
pco####.c####.com
plb####.u####.com
po####.pc####.com.cn
pos.b####.com
pv.s####.com
q####.com
qy-swa####.qi####.com
r####.wx.qq.com
r1.baiyuns####.com
res####.a####.com
res####.a####.top
s####.e.qq.com
s####.x####.com.cn
s4.c####.com
s5.c####.com
s9.c####.com
s96.c####.com
sf3-fe####.pglstat####.com
sf3-ttc####.ps####.com
sw4.d####.com
sy.cl####.com
t####.a####.top
to####.ctobsn####.com
tys####.wwe####.com
u####.a####.top
u####.dspliul####.com
u####.u####.com
ue.3con####.com
umen####.m.ta####.com
umengj####.m.ta####.com
v1.c####.com
w####.pc####.com.cn
w####.pcon####.com.cn
w.c####.com
w.i####.com
wtc.d####.com
www.78####.cc
www.f####.com
www.pc####.com.cn
www.pcon####.com.cn
xvg####.pes####.com
z1.c####.com
z12.c####.com
z2.c####.com
z3.c####.com
z6.c####.com
z9.c####.com
zhit####.com
zz.android####.website

Запросы HTTP GET:

a####.d####.com/rewrite?fromid=####
ad.toads####.com/image/5ecb146466134600ba62ad7661553425.jar
ad2.pearv####.com/track?track_id=####&idfa=####&app_key=####&time_stamp=...
api.z####.com/v1/advert/config?product=####&timestamp=####&platform=####...
app.a####.top/anshuaControl.json
c####.jumen####.com/init.php
c####.jumen####.com/init_wap.php
c####.zhito####.com:807/528/bu/1/1000.html
c####.zhito####.com:807/528/bu/1/1250a.html
c####.zhito####.com:807/528/bu/8/lin300.html?8:00-1####
c####.zhito####.com:807/528/bu/lsanzhuo/index.html
c####.zhito####.com:807/528/jd.html?1####
c####.zhito####.com:808/pctja.html
c####.zhito####.com:8881/wap/index.html
c####.zhito####.com:99/newcar/index.html
c####.zhito####.com:99/wts/index.html?1####
c####.zhito####.com:99/wtsnews/index.html
c.c####.com/core.php?web_id=####&t=####
c.c####.com/stat.php?id=####
c.c####.com/z_stat.php?id=####&web_id=####
cw####.mintl####.cn/u/qwertyuask.zip
down####.baiyuns####.com/cy.js
down####.baiyuns####.com/jquery.min.js
down####.baiyuns####.com/static/default.css
down####.baiyuns####.com/static/index.js
down####.baiyuns####.com/static/logo.png
dup.baidust####.com/js/os.js
ec####.b####.com/se.jpg?type=####&ver=####&rdm=####
f####.ttb####.cn/zt4PU3Kr?siwt=####
g.cn.miao####.com/x/k=2200630&p=7hAcg&dx=__IPDX__&rt=2&pro=s&ns=__IP__&n...
gd.a.s####.com/cityjson?ie=####
gm.mm####.com/9.gif?abc=####&rnd=####
hm.b####.com/hm.js?6058df4####
ip####.com/json/?lang=####
ivy.pcon####.com.cn/click?id=####&adid=####&watch=####
m.gs####.cn/fun.tv/channels/
m.gs####.cn/scholar.sogou_SID=6/
m.lsxue####.cn/iqiyi_pcw_s6/
m.lsxue####.cn/iqiyi_pcw_s6/s.js
m.xiaoshu####.cn/mbxs240/2187/426_1.html
m.yue####.com/mbook_9648/465.html
ne####.x####.com.cn/push/adv.php?pid=####&id=####&oid=####&m=####&pv=###...
p####.163.com/link/tt4_0904_1299.html
p####.pc####.com.cn/sg4564/price.html?ad=####
pco####.ta####.com/app.gif?&cna=####
q####.com.a.####.com/N7WGC21F5LSO.jar
res####.a####.top/LHYY.png
res####.a####.top/filter_control_602.json
res####.a####.top/sdk13_2.png
res####.a####.top/sdk18_5.png
res####.a####.top/sdk19.png
res####.a####.top/sdk21.png
res####.a####.top/sdk22_2.png
res####.a####.top/sdk24_3.png
res####.a####.top/sdk3.png
res####.a####.top/sdk6.png
res####.a####.top/sdk7.png
t####.a####.top/anshua.json
u####.a####.top/602.html
u####.dspliul####.com:99/ip/index.html
www.78####.cc/index/publics/get_ip
www.f####.com/
www.pc####.com.####.cn/autox/6a976e56b61b2febd215f6cbe5186f5f.htm
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
zhit####.com:808/1020/index.html
zhit####.com:808/1020/yrc_001pc.js
zhit####.com:808/1020yd/index.html
zhit####.com:99/wap/index.html
zz.android####.website/DownUrl?channel=####
zz.android####.website/iphand?uid=####&channel=####&pkg=####
zz.android####.website/shield?channel=####&model=####&uid=####
zz.android####.website/u?q=####&u=####&p=####&c=####&a=####&os=####&pkg=...

Запросы HTTP POST:

6z####.njt####.com:10091/wisdom/marking
acti####.t####.cn/native/sdk/event/log
ad.toads####.com/api/angent
ad.toads####.com/api/callback
ad.toads####.com/api/feedback
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
api.yunco####.com/service/rest
api.z####.com/app/version/android-upgrade
api.z####.com/pc/news/get-article-category
api.z####.com/pc/news/get-category-list-by-pinyin-abbr
api.z####.com/push-tag/list
api.z####.com/tab-conf/app-column-conf
api.z####.com/tab-conf/app-sys-conf
api.z####.com/tab-conf/uuid
api.z####.com/tips/index
api.z####.com/v1/advert/list
cn.f####.top:8080/qsad/api/c/c
i.iqt####.com:651/slsdk/getdata.aspx
i.iqt####.com:651/slsdk/lykdrli.aspx
i.iqt####.com:651/slsdk/lykdrlistat.aspx
i.iqt####.com:651/slsdk/settings.aspx
lo####.sp####.mig.####.net/ajax?c=####&k=####
now####.pes####.com:18001/begzf1/
r1.baiyuns####.com/service/rest
res####.a####.com/v3/weather/weatherInfo
rq####.sp####.mig.####.net/rqd/async?aid=####
s####.e.qq.com/activate
tys####.wwe####.com:17001/cbcvu9/
tys####.wwe####.com:17001/karawc/
w####.pcon####.com.cn/ip.jsp
www.78####.cc/index/backend/pro_data
xvg####.pes####.com:17001/an2y3z/
xvg####.pes####.com:18001/w0619s/

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1135038580-754662270
/data/data/####/.cl
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/1002
/data/data/####/1004
/data/data/####/13_2.dex (deleted)
/data/data/####/13_2.jar
/data/data/####/18_5.dex (deleted)
/data/data/####/18_5.jar
/data/data/####/19.dex (deleted)
/data/data/####/19.jar
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/21.dex (deleted)
/data/data/####/21.jar
/data/data/####/24c110e1f76093b35c3c2df1927aab79.0
/data/data/####/2EC68123E317AA1FD3F2E11EBECF4D88.xml
/data/data/####/3.dex (deleted)
/data/data/####/3.jar
/data/data/####/3A0BC3C0D4BC531841993226451CFE45.xml
/data/data/####/5753481096270.0
/data/data/####/5ecb146466134600ba62ad7661553425.jar
/data/data/####/6.dex (deleted)
/data/data/####/6.jar
/data/data/####/65a89b0d5130222f89f71ed812ac122f.db
/data/data/####/6f438e3a5e423d994905385358359cb3.db
/data/data/####/7.dex (deleted)
/data/data/####/7.jar
/data/data/####/7652153000234.0
/data/data/####/78f0f284b3d3d13ee497b2e4baa58650.db
/data/data/####/847df06fbd73d3525d74fcb84fc2ac9e.db (deleted)
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/9791062b2062bd5e2b2f75caad8fa155.db
/data/data/####/9cebb789925a5961ada229aa58c49f90.db
/data/data/####/ACCS_BINDumeng;58107fdec8957663fb003c19.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db
/data/data/####/ApplicationCache.db-journal
/data/data/####/ApplicationCache.db-journal (deleted)
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/ContextData.xml
/data/data/####/CprPt.jar
/data/data/####/DaemonServer
/data/data/####/Ix132mMskey1.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596_...9f.xml
/data/data/####/StrategyConfig
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Unicorn.f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/WebViewBasePrefs.xml
/data/data/####/XAiOiJKV1QiLCJhbGciOiJIUzI1Ni
/data/data/####/XAiOiJKV1QiLCJhbGciOiJIUzI1Ni64
/data/data/####/XkdjsIx132mM356507059351895comm.xml
/data/data/####/XkdjsIx132mMskey1.xml
/data/data/####/ZH503.dex
/data/data/####/ZH503.jar
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__cid__v1__.dat
/data/data/####/__rbpr_up18__
/data/data/####/__send_data_1603525122681
/data/data/####/_p.xml
/data/data/####/_sh.xml
/data/data/####/ab15c454b8f64f4491d6264b9bbb179a
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/adinitdex.xml
/data/data/####/agoo.pid
/data/data/####/appuserid.xml
/data/data/####/area.xml
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bugly_db_-journal
/data/data/####/c1043658b041986e0521eea2237c83fa.db
/data/data/####/c2dcfa8494a24de299da6300625230dd
/data/data/####/channel_umeng_common_config.xml
/data/data/####/chuanglan_report_2.2.1.db
/data/data/####/chuanglan_report_2.2.1.db-journal
/data/data/####/com.qiyukf.analytics.xml
/data/data/####/com.wswy.wzcx.BETA_VALUES.xml
/data/data/####/comxcxid.xml
/data/data/####/core_info
/data/data/####/core_umeng_common_config.xml
/data/data/####/crashrecord.xml
/data/data/####/d672381358f612db8e022b7aee24fe53.db
/data/data/####/dW1weF9pbnRlcm5hbF8xNjAzNTI1MDU3Mjcw;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNjAzNTI1MDc2ODc5;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/data_3 (deleted)
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e5ecb146466134600ba62ad7661553425.jar
/data/data/####/eHhkX3Nw.xml
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/error.xml
/data/data/####/errorTime.xml
/data/data/####/eudemon
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/hxdata.xml
/data/data/####/i==1.2.0&&3.8.0_1603525057498_envelope.log
/data/data/####/icelcuda.jar
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/kitty1.xml
/data/data/####/kk_datas_info.xml
/data/data/####/kk_datas_info.xml.bak (deleted)
/data/data/####/libaxbk
/data/data/####/libcuid.so
/data/data/####/libjiagu-285061115.so
/data/data/####/libnnc.so
/data/data/####/libnsde
/data/data/####/libnthjvo.so
/data/data/####/libnthjvo.so-32
/data/data/####/libnthjvo.so-64
/data/data/####/libtxsj
/data/data/####/libxim
/data/data/####/local_crash_lock
/data/data/####/localspnamestj.xml
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mok.xml
/data/data/####/msg.db-journal
/data/data/####/mtaois.png
/data/data/####/mtj_auto.config
/data/data/####/mtj_autoTracker.js
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/peafr4138214.apk
/data/data/####/pull93181748.apk
/data/data/####/qbjlocalspnamestj.xml
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/qiyu_save_f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/security_info
/data/data/####/shanyan_share_data.xml
/data/data/####/smsslocalspnamestj.xml
/data/data/####/snssdk_openudid.xml
/data/data/####/spUtils.xml
/data/data/####/sp_push_time.xml
/data/data/####/spu_yj.xml
/data/data/####/ssoconfigs.xml
/data/data/####/t==8.1.2&&3.8.0_1603525064592_envelope.log
/data/data/####/tb754639.apk
/data/data/####/tb754639_o (deleted)
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/time_config_name_lt.xml
/data/data/####/tt_ad_sdk_sp.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak (deleted)
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umengDB.db
/data/data/####/umengDB.dex (deleted)
/data/data/####/umengDB.jar
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umengc.db
/data/data/####/umengc.db (deleted)
/data/data/####/unicorn#cheese#
/data/data/####/update_lc
/data/data/####/upz_5
/data/data/####/vj.jar
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/xdtversion.xml
/data/data/####/yd_config_c.xml
/data/data/####/zprbjlocalspnamestj.xml
/data/data/####/zpthblocalspnamestj.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.kkid
/data/media/####/.nid
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/.umm.dat
/data/media/####/.usdis
/data/media/####/1603525053802.db
/data/media/####/385E7FA9A763AF89E661BD99B4A389AC.jar
/data/media/####/385E7FA9A763AF89E661BD99B4A389AC.temp
/data/media/####/62c9a9cb46d03c9a05efdeb5fb904753.tmp
/data/media/####/Alvin2.xml
/data/media/####/C2BCE207F8DC95728EE62069E6A30887
/data/media/####/ContextData.xml
/data/media/####/_pn
/data/media/####/_shn
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/clientudid.dat
/data/media/####/config.txt
/data/media/####/deviceToken
/data/media/####/ihf.jar

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:58107fdec8957663fb003c19","utdid":"X5PZwLbwnX4DAGdzx1EqUVsG","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
getprop
getprop ro.board.platform
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.letv.release.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
getprop ro.yunos.build.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
mount
sh

Загружает динамические библиотеки:

XAiOiJKV1QiLCJhbGciOiJIUzI1Ni
XAiOiJKV1QiLCJhbGciOiJIUzI1Ni64
crash_analysis
libaxbk
libimagepipeline
libjiagu-285061115
libnnc
libnsde
libnthjvo
libtxsj
libxim
nms
tnet-3.1
tobEmbedEncrypt
yaqcore_gdtadv

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-None-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней