Android.Triada.4806

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Click.345.origin
Android.DownLoader.1007.origin
Android.DownLoader.363.origin
Android.Triada.4567
Android.Triada.482.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) t####.a####.top:80
TCP(HTTP/1.1) c####.jumen####.com:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) res####.a####.top:80
TCP(HTTP/1.1) cn.f####.top:8080
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) www.pc####.com.####.cn:80
TCP(HTTP/1.1) xvg####.pes####.com:18001
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) p####.pc####.com.cn:80
TCP(HTTP/1.1) ad2.pearv####.com:80
TCP(HTTP/1.1) lo####.sp####.mig.####.net:80
TCP(HTTP/1.1) c####.zhito####.com:807
TCP(HTTP/1.1) ec####.b####.com:80
TCP(HTTP/1.1) cw####.mintl####.cn:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) m.yue####.com:80
TCP(HTTP/1.1) a####.d####.com:80
TCP(HTTP/1.1) u####.a####.top:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) rq####.sp####.mig.####.net:80
TCP(HTTP/1.1) q####.com.a.####.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) m.xiaoshu####.cn:80
TCP(HTTP/1.1) www.78####.cc:80
TCP(HTTP/1.1) m.lsxue####.cn:80
TCP(HTTP/1.1) 1####.76.103.4:28018
TCP(HTTP/1.1) ip####.com:80
TCP(HTTP/1.1) f####.ttb####.cn:80
TCP(HTTP/1.1) 4####.83.77.145:80
TCP(HTTP/1.1) i.iqt####.com:651
TCP(HTTP/1.1) zz.android####.website:80
TCP(HTTP/1.1) c####.zhito####.com:99
TCP(HTTP/1.1) ne####.x####.com.cn:80
TCP(HTTP/1.1) r1.baiyuns####.com:80
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) acti####.t####.cn:80
TCP(HTTP/1.1) 4####.98.31.107:901
TCP(HTTP/1.1) 47.1####.122.27:99
TCP(HTTP/1.1) 23.1####.13.121:80
TCP(HTTP/1.1) ivy.pcon####.com.cn:80
TCP(HTTP/1.1) m.gs####.cn:80
TCP(HTTP/1.1) 1####.201.175.19:80
TCP(HTTP/1.1) xvg####.pes####.com:17001
TCP(HTTP/1.1) 1####.57.161.133:8000
TCP(HTTP/1.1) c####.zhito####.com:8881
TCP(HTTP/1.1) www.f####.com:80
TCP(HTTP/1.1) zhit####.com:99
TCP(HTTP/1.1) tys####.wwe####.com:17001
TCP(HTTP/1.1) zhit####.com:808
TCP(HTTP/1.1) c####.zhito####.com:808
TCP(HTTP/1.1) p####.163.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) api.z####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) 14.17.1####.182:80
TCP(HTTP/1.1) down####.baiyuns####.com:80
TCP(HTTP/1.1) g.cn.miao####.com:80
TCP(HTTP/1.1) now####.pes####.com:18001
TCP(HTTP/1.1) 1####.27.70.235:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) 1####.77.67.185:28018
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) 52.1####.28.42:80
TCP(HTTP/1.1) u####.dspliul####.com:99
TCP(HTTP/1.1) ad.toads####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) 47.1####.211.73:80
TCP(HTTP/1.1) app.a####.top:80
TCP(HTTP/1.1) 6z####.njt####.com:10091
TCP(TLS/1.0) alldo####.linx####.com.####.com:443
TCP(TLS/1.0) lbs.net####.im:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) c.gridsum####.com:443
TCP(TLS/1.0) www.pcon####.com.cn:443
TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) ti####.c####.l####.####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) i####.pcon####.com.cn:443
TCP(TLS/1.0) res.wx.qq.####.com:443
TCP(TLS/1.0) c####.pc####.com.cn:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) wtc.d####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) d0.x####.com.cn:443
TCP(TLS/1.0) qy-swa####.qi####.com:443
TCP(TLS/1.0) img.pcon####.com.####.cn:443
TCP(TLS/1.0) ip.ws.1####.net:443
TCP(TLS/1.0) nim.qi####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) g.1####.com:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) to####.ctobsn####.com:443
TCP(TLS/1.0) i####.d####.com:443
TCP(TLS/1.0) pang####.sn####.com:443
TCP(TLS/1.0) sw4.d####.com:443
TCP(TLS/1.0) dxp.b####.com:443
TCP(TLS/1.0) api.g####.vip:443
TCP(TLS/1.0) w.i####.com:443
TCP(TLS/1.0) img.pc####.com.cn:443
TCP(TLS/1.0) f####.ttb####.cn:443
TCP(TLS/1.0) mg####.pcon####.com.cn:443
TCP(TLS/1.0) sy.cl####.com:443
TCP(TLS/1.0) a####.evergr####.com:443
TCP(TLS/1.0) po####.pc####.com.cn:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) i####.jd.com:443
TCP(TLS/1.0) i####.xca####.com.####.cn:443
TCP(TLS/1.0) www.pc####.com.####.cn:443
TCP(TLS/1.0) bigdata####.evergr####.com:443
TCP(TLS/1.0) s####.x####.com.cn:443
TCP(TLS/1.0) mp.we####.qq.com:443
TCP(TLS/1.0) p####.pc####.com.cn:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) ivy.pcon####.com.cn:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) g.cn.miao####.com:443
TCP(TLS/1.0) ue.3con####.com:443
TCP(TLS/1.0) dm.ps####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) js.3con####.com.####.cn:443
TCP(TLS/1.0) api.zp####.com:443
TCP(TLS/1.0) mr####.pc####.com.cn:443
TCP(TLS/1.0) counter####.pc####.com.cn:443
TCP(TLS/1.0) api16-a####.pa####.io.####.net:443
TCP(TLS/1.0) u####.v.bs####.cn:443
TCP(TLS/1.0) ne####.x####.com.cn:443
TCP(TLS/1.0) dm.tou####.com:443
TCP(TLS/1.0) andro####.oss-cn-####.aliy####.com:443
TCP l####.net####.im:8080
TCP zb-cent####.m.ta####.com:443
TCP 1####.0.13.254:37947

DNS requests:

602.a####.top
6z####.njt####.com
a####.d####.com
a####.evergr####.com
a####.man.aliy####.com
acti####.t####.cn
ad.toads####.com
ad2.pearv####.com
adm.android####.website
ag####.m.ta####.com
amdc####.m.ta####.com
and####.b####.qq.com
andro####.oss-cn-####.aliy####.com
api.g####.vip
api.yunco####.com
api.z####.com
api.zp####.com
api16-a####.pa####.io
app.a####.top
ass####.xca####.com
bbt####.wwe####.com
bigdata####.evergr####.com
c####.jumen####.com
c####.mm####.com
c####.pc####.com.cn
c####.x####.com.cn
c####.zhito####.com
c.c####.com
c.gridsum####.com
cn.f####.top
counter####.pc####.com.cn
cr.3con####.com
cw####.mintl####.cn
d0.x####.com.cn
dig.b####.net
dm.byted####.com
dm.ps####.com
dm.tou####.com
down####.baiyuns####.com
dup.baidust####.com
dwf.linx####.com
dxp.b####.com
ec####.b####.com
f####.evergr####.com
f####.ttb####.cn
filt####.a####.top
g.1####.com
g.cn.miao####.com
hm.b####.com
i####.d####.com
i####.jd.com
i####.pc####.com.cn
i####.x####.com.cn
i####.xca####.com
i####.xca####.com
i.iqt####.com
img.pc####.com.cn
img.pcon####.com.cn
ip####.com
ip.remo####.com
ip.ws.1####.net
ivy.pcon####.com.cn
j####.g####.vip
js.3con####.com
js.x####.com.cn
jwz.3con####.com
kyy####.wwe####.com
l####.net####.im
l####.tbs.qq.com
lbs.net####.im
lhyysdk####.oss-cn-####.aliy####.com
m####.pc####.com.cn
m.funny####.cn
m.gs####.cn
m.lsxue####.cn
m.xiaoshu####.cn
m.yue####.com
mg####.pcon####.com.cn
mp.we####.qq.com
mr####.pc####.com.cn
ne####.x####.com.cn
nim.qi####.com
now####.pes####.com
p####.163.com
p####.pc####.com.cn
pang####.sn####.com
pco####.c####.com
plb####.u####.com
po####.pc####.com.cn
pos.b####.com
pv.s####.com
q####.com
qy-swa####.qi####.com
r####.wx.qq.com
r1.baiyuns####.com
res####.a####.com
res####.a####.top
s####.e.qq.com
s####.x####.com.cn
s4.c####.com
s5.c####.com
s9.c####.com
s96.c####.com
sf3-fe####.pglstat####.com
sf3-ttc####.ps####.com
sw4.d####.com
sy.cl####.com
t####.a####.top
to####.ctobsn####.com
tys####.wwe####.com
u####.a####.top
u####.dspliul####.com
u####.u####.com
ue.3con####.com
umen####.m.ta####.com
umengj####.m.ta####.com
v1.c####.com
w####.pc####.com.cn
w####.pcon####.com.cn
w.c####.com
w.i####.com
wtc.d####.com
www.78####.cc
www.f####.com
www.pc####.com.cn
www.pcon####.com.cn
xvg####.pes####.com
z1.c####.com
z12.c####.com
z2.c####.com
z3.c####.com
z6.c####.com
z9.c####.com
zhit####.com
zz.android####.website

HTTP GET requests:

a####.d####.com/rewrite?fromid=####
ad.toads####.com/image/5ecb146466134600ba62ad7661553425.jar
ad2.pearv####.com/track?track_id=####&idfa=####&app_key=####&time_stamp=...
api.z####.com/v1/advert/config?product=####&timestamp=####&platform=####...
app.a####.top/anshuaControl.json
c####.jumen####.com/init.php
c####.jumen####.com/init_wap.php
c####.zhito####.com:807/528/bu/1/1000.html
c####.zhito####.com:807/528/bu/1/1250a.html
c####.zhito####.com:807/528/bu/8/lin300.html?8:00-1####
c####.zhito####.com:807/528/bu/lsanzhuo/index.html
c####.zhito####.com:807/528/jd.html?1####
c####.zhito####.com:808/pctja.html
c####.zhito####.com:8881/wap/index.html
c####.zhito####.com:99/newcar/index.html
c####.zhito####.com:99/wts/index.html?1####
c####.zhito####.com:99/wtsnews/index.html
c.c####.com/core.php?web_id=####&t=####
c.c####.com/stat.php?id=####
c.c####.com/z_stat.php?id=####&web_id=####
cw####.mintl####.cn/u/qwertyuask.zip
down####.baiyuns####.com/cy.js
down####.baiyuns####.com/jquery.min.js
down####.baiyuns####.com/static/default.css
down####.baiyuns####.com/static/index.js
down####.baiyuns####.com/static/logo.png
dup.baidust####.com/js/os.js
ec####.b####.com/se.jpg?type=####&ver=####&rdm=####
f####.ttb####.cn/zt4PU3Kr?siwt=####
g.cn.miao####.com/x/k=2200630&p=7hAcg&dx=__IPDX__&rt=2&pro=s&ns=__IP__&n...
gd.a.s####.com/cityjson?ie=####
gm.mm####.com/9.gif?abc=####&rnd=####
hm.b####.com/hm.js?6058df4####
ip####.com/json/?lang=####
ivy.pcon####.com.cn/click?id=####&adid=####&watch=####
m.gs####.cn/fun.tv/channels/
m.gs####.cn/scholar.sogou_SID=6/
m.lsxue####.cn/iqiyi_pcw_s6/
m.lsxue####.cn/iqiyi_pcw_s6/s.js
m.xiaoshu####.cn/mbxs240/2187/426_1.html
m.yue####.com/mbook_9648/465.html
ne####.x####.com.cn/push/adv.php?pid=####&id=####&oid=####&m=####&pv=###...
p####.163.com/link/tt4_0904_1299.html
p####.pc####.com.cn/sg4564/price.html?ad=####
pco####.ta####.com/app.gif?&cna=####
q####.com.a.####.com/N7WGC21F5LSO.jar
res####.a####.top/LHYY.png
res####.a####.top/filter_control_602.json
res####.a####.top/sdk13_2.png
res####.a####.top/sdk18_5.png
res####.a####.top/sdk19.png
res####.a####.top/sdk21.png
res####.a####.top/sdk22_2.png
res####.a####.top/sdk24_3.png
res####.a####.top/sdk3.png
res####.a####.top/sdk6.png
res####.a####.top/sdk7.png
t####.a####.top/anshua.json
u####.a####.top/602.html
u####.dspliul####.com:99/ip/index.html
www.78####.cc/index/publics/get_ip
www.f####.com/
www.pc####.com.####.cn/autox/6a976e56b61b2febd215f6cbe5186f5f.htm
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
zhit####.com:808/1020/index.html
zhit####.com:808/1020/yrc_001pc.js
zhit####.com:808/1020yd/index.html
zhit####.com:99/wap/index.html
zz.android####.website/DownUrl?channel=####
zz.android####.website/iphand?uid=####&channel=####&pkg=####
zz.android####.website/shield?channel=####&model=####&uid=####
zz.android####.website/u?q=####&u=####&p=####&c=####&a=####&os=####&pkg=...

HTTP POST requests:

6z####.njt####.com:10091/wisdom/marking
acti####.t####.cn/native/sdk/event/log
ad.toads####.com/api/angent
ad.toads####.com/api/callback
ad.toads####.com/api/feedback
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
api.yunco####.com/service/rest
api.z####.com/app/version/android-upgrade
api.z####.com/pc/news/get-article-category
api.z####.com/pc/news/get-category-list-by-pinyin-abbr
api.z####.com/push-tag/list
api.z####.com/tab-conf/app-column-conf
api.z####.com/tab-conf/app-sys-conf
api.z####.com/tab-conf/uuid
api.z####.com/tips/index
api.z####.com/v1/advert/list
cn.f####.top:8080/qsad/api/c/c
i.iqt####.com:651/slsdk/getdata.aspx
i.iqt####.com:651/slsdk/lykdrli.aspx
i.iqt####.com:651/slsdk/lykdrlistat.aspx
i.iqt####.com:651/slsdk/settings.aspx
lo####.sp####.mig.####.net/ajax?c=####&k=####
now####.pes####.com:18001/begzf1/
r1.baiyuns####.com/service/rest
res####.a####.com/v3/weather/weatherInfo
rq####.sp####.mig.####.net/rqd/async?aid=####
s####.e.qq.com/activate
tys####.wwe####.com:17001/cbcvu9/
tys####.wwe####.com:17001/karawc/
w####.pcon####.com.cn/ip.jsp
www.78####.cc/index/backend/pro_data
xvg####.pes####.com:17001/an2y3z/
xvg####.pes####.com:18001/w0619s/

File system changes:

Creates the following files:

/data/data/####/-1135038580-754662270
/data/data/####/.cl
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/1002
/data/data/####/1004
/data/data/####/13_2.dex (deleted)
/data/data/####/13_2.jar
/data/data/####/18_5.dex (deleted)
/data/data/####/18_5.jar
/data/data/####/19.dex (deleted)
/data/data/####/19.jar
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/21.dex (deleted)
/data/data/####/21.jar
/data/data/####/24c110e1f76093b35c3c2df1927aab79.0
/data/data/####/2EC68123E317AA1FD3F2E11EBECF4D88.xml
/data/data/####/3.dex (deleted)
/data/data/####/3.jar
/data/data/####/3A0BC3C0D4BC531841993226451CFE45.xml
/data/data/####/5753481096270.0
/data/data/####/5ecb146466134600ba62ad7661553425.jar
/data/data/####/6.dex (deleted)
/data/data/####/6.jar
/data/data/####/65a89b0d5130222f89f71ed812ac122f.db
/data/data/####/6f438e3a5e423d994905385358359cb3.db
/data/data/####/7.dex (deleted)
/data/data/####/7.jar
/data/data/####/7652153000234.0
/data/data/####/78f0f284b3d3d13ee497b2e4baa58650.db
/data/data/####/847df06fbd73d3525d74fcb84fc2ac9e.db (deleted)
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/9791062b2062bd5e2b2f75caad8fa155.db
/data/data/####/9cebb789925a5961ada229aa58c49f90.db
/data/data/####/ACCS_BINDumeng;58107fdec8957663fb003c19.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db
/data/data/####/ApplicationCache.db-journal
/data/data/####/ApplicationCache.db-journal (deleted)
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/ContextData.xml
/data/data/####/CprPt.jar
/data/data/####/DaemonServer
/data/data/####/Ix132mMskey1.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596_...9f.xml
/data/data/####/StrategyConfig
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Unicorn.f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/WebViewBasePrefs.xml
/data/data/####/XAiOiJKV1QiLCJhbGciOiJIUzI1Ni
/data/data/####/XAiOiJKV1QiLCJhbGciOiJIUzI1Ni64
/data/data/####/XkdjsIx132mM356507059351895comm.xml
/data/data/####/XkdjsIx132mMskey1.xml
/data/data/####/ZH503.dex
/data/data/####/ZH503.jar
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__cid__v1__.dat
/data/data/####/__rbpr_up18__
/data/data/####/__send_data_1603525122681
/data/data/####/_p.xml
/data/data/####/_sh.xml
/data/data/####/ab15c454b8f64f4491d6264b9bbb179a
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/adinitdex.xml
/data/data/####/agoo.pid
/data/data/####/appuserid.xml
/data/data/####/area.xml
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bugly_db_-journal
/data/data/####/c1043658b041986e0521eea2237c83fa.db
/data/data/####/c2dcfa8494a24de299da6300625230dd
/data/data/####/channel_umeng_common_config.xml
/data/data/####/chuanglan_report_2.2.1.db
/data/data/####/chuanglan_report_2.2.1.db-journal
/data/data/####/com.qiyukf.analytics.xml
/data/data/####/com.wswy.wzcx.BETA_VALUES.xml
/data/data/####/comxcxid.xml
/data/data/####/core_info
/data/data/####/core_umeng_common_config.xml
/data/data/####/crashrecord.xml
/data/data/####/d672381358f612db8e022b7aee24fe53.db
/data/data/####/dW1weF9pbnRlcm5hbF8xNjAzNTI1MDU3Mjcw;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNjAzNTI1MDc2ODc5;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/data_3 (deleted)
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e5ecb146466134600ba62ad7661553425.jar
/data/data/####/eHhkX3Nw.xml
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/error.xml
/data/data/####/errorTime.xml
/data/data/####/eudemon
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/hxdata.xml
/data/data/####/i==1.2.0&&3.8.0_1603525057498_envelope.log
/data/data/####/icelcuda.jar
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/kitty1.xml
/data/data/####/kk_datas_info.xml
/data/data/####/kk_datas_info.xml.bak (deleted)
/data/data/####/libaxbk
/data/data/####/libcuid.so
/data/data/####/libjiagu-285061115.so
/data/data/####/libnnc.so
/data/data/####/libnsde
/data/data/####/libnthjvo.so
/data/data/####/libnthjvo.so-32
/data/data/####/libnthjvo.so-64
/data/data/####/libtxsj
/data/data/####/libxim
/data/data/####/local_crash_lock
/data/data/####/localspnamestj.xml
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mok.xml
/data/data/####/msg.db-journal
/data/data/####/mtaois.png
/data/data/####/mtj_auto.config
/data/data/####/mtj_autoTracker.js
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/peafr4138214.apk
/data/data/####/pull93181748.apk
/data/data/####/qbjlocalspnamestj.xml
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/qiyu_save_f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/security_info
/data/data/####/shanyan_share_data.xml
/data/data/####/smsslocalspnamestj.xml
/data/data/####/snssdk_openudid.xml
/data/data/####/spUtils.xml
/data/data/####/sp_push_time.xml
/data/data/####/spu_yj.xml
/data/data/####/ssoconfigs.xml
/data/data/####/t==8.1.2&&3.8.0_1603525064592_envelope.log
/data/data/####/tb754639.apk
/data/data/####/tb754639_o (deleted)
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/time_config_name_lt.xml
/data/data/####/tt_ad_sdk_sp.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak (deleted)
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umengDB.db
/data/data/####/umengDB.dex (deleted)
/data/data/####/umengDB.jar
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umengc.db
/data/data/####/umengc.db (deleted)
/data/data/####/unicorn#cheese#
/data/data/####/update_lc
/data/data/####/upz_5
/data/data/####/vj.jar
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/xdtversion.xml
/data/data/####/yd_config_c.xml
/data/data/####/zprbjlocalspnamestj.xml
/data/data/####/zpthblocalspnamestj.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.kkid
/data/media/####/.nid
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/.umm.dat
/data/media/####/.usdis
/data/media/####/1603525053802.db
/data/media/####/385E7FA9A763AF89E661BD99B4A389AC.jar
/data/media/####/385E7FA9A763AF89E661BD99B4A389AC.temp
/data/media/####/62c9a9cb46d03c9a05efdeb5fb904753.tmp
/data/media/####/Alvin2.xml
/data/media/####/C2BCE207F8DC95728EE62069E6A30887
/data/media/####/ContextData.xml
/data/media/####/_pn
/data/media/####/_shn
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/clientudid.dat
/data/media/####/config.txt
/data/media/####/deviceToken
/data/media/####/ihf.jar

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:58107fdec8957663fb003c19","utdid":"X5PZwLbwnX4DAGdzx1EqUVsG","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
getprop
getprop ro.board.platform
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.letv.release.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
getprop ro.yunos.build.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
mount
sh

Loads the following dynamic libraries:

XAiOiJKV1QiLCJhbGciOiJIUzI1Ni
XAiOiJKV1QiLCJhbGciOiJIUzI1Ni64
crash_analysis
libaxbk
libimagepipeline
libjiagu-285061115
libnnc
libnsde
libnthjvo
libtxsj
libxim
nms
tnet-3.1
tobEmbedEncrypt
yaqcore_gdtadv

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-None-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial