Android.Xiny.838

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Appsad.5.origin
Adware.Mobikok.1.origin
Android.RemoteCode.88.origin
Android.Xiny.1.origin
Android.Xiny.197
Android.Xiny.202.origin
Android.Xiny.73.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.4g####.net:80
TCP(HTTP/1.1) ads.dofun####.com:80
TCP(HTTP/1.1) of.okyes####.com:80
TCP(HTTP/1.1) cl####.mob####.net:80
TCP(HTTP/1.1) myhome####.mobi:80
TCP(HTTP/1.1) c.cliikyn####.com:80
TCP(HTTP/1.1) www.apxadtr####.net:80
TCP(HTTP/1.1) duc####.b####.com:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) t####.iches####.net:80
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) trk.gl####.com:80
TCP(HTTP/1.1) apirepo####.revmo####.com:80
TCP(HTTP/1.1) www.theadga####.com:80
TCP(HTTP/1.1) www.greatmo####.mobi:80
TCP(HTTP/1.1) lohire####.com:80
TCP(HTTP/1.1) 5####.77.99.53:80
TCP(HTTP/1.1) clk.hope####.net:80
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) wa####.go2c####.org:80
TCP(HTTP/1.1) ads.digg####.com:80
TCP(HTTP/1.1) afftrac####.com:80
TCP(HTTP/1.1) s####.rylinkw####.com:80
TCP(HTTP/1.1) us.api.adf####.cn:5000
TCP(HTTP/1.1) got.pubna####.net:80
TCP(HTTP/1.1) trac####.suma####.com:80
TCP(HTTP/1.1) c####.amazing####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) 4####.79.77.161:80
TCP(HTTP/1.1) appf####.com:80
TCP(HTTP/1.1) c####.inplay####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) offers####.adflush####.com:80
TCP(HTTP/1.1) a.n####.ren:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) pl####.mob####.b####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) dsa.startap####.edg####.net:80
TCP(HTTP/1.1) s####.adin####.com:80
TCP(HTTP/1.1) t####.m####.net:80
TCP(HTTP/1.1) smart####.google####.com:80
TCP(HTTP/1.1) api.migh####.com:80
TCP(HTTP/1.1) apptr####.com:80
TCP(HTTP/1.1) su.t####.li:80
TCP(HTTP/1.1) t####.12trac####.com:80
TCP(HTTP/1.1) www.prom####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) www.okyes####.com:8080
TCP(HTTP/1.1) www.bigt####.com:80
TCP(HTTP/1.1) gl####.ymtrac####.com:80
TCP(HTTP/1.1) 45.79.1####.230:80
TCP(HTTP/1.1) app.appsf####.com:80
TCP(HTTP/1.1) c####.howdo####.net:80
TCP(HTTP/1.1) u####.b####.com:80
TCP(HTTP/1.1) c####.sz####.com:80
TCP(HTTP/1.1) clk.ocea####.com:80
TCP(HTTP/1.1) c####.u.appco####.com:80
TCP(HTTP/1.1) c####.click####.com:80
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) go-rill####.afft####.com:80
TCP(HTTP/1.1) cp####.mobisma####.com:80
TCP(HTTP/1.1) 45.79.1####.160:80
TCP(HTTP/1.1) vi####.ddf####.com:80
TCP(HTTP/1.1) p####.admobc####.com:80
TCP(HTTP/1.1) mm.m####.info:80
TCP(HTTP/1.1) t####.upbn####.com:80
TCP(HTTP/1.1) appromo####.trac####.adnova####.com:80
TCP(HTTP/1.1) clinkad####.com:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) t####.sm4####.com:80
TCP(HTTP/1.1) atracki####.appf####.com:80
TCP(HTTP/1.1) 45.79.1####.142:80
TCP(HTTP/1.1) api.lead####.net:80
TCP(HTTP/1.1) 45.79.2####.163:80
TCP(HTTP/1.1) t.api.y####.net:80
TCP(HTTP/1.1) c.a####.com:80
TCP(HTTP/1.1) www.myhome####.mobi:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) c####.gowa####.com:80
TCP(HTTP/1.1) gl####.jc.superli####.com:80
TCP(HTTP/1.1) c####.af####.xyz:80
TCP(HTTP/1.1) amc.jiek####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) trac####.digital####.com:80
TCP(SSL/3.0) questio####.com:443
TCP(SSL/3.0) smarto####.site:443
TCP(SSL/3.0) normale####.com:443
TCP(SSL/3.0) bestper####.site:443
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) normale####.com:443
TCP(TLS/1.0) bestper####.site:443
TCP(TLS/1.0) trac####.artofc####.com:443
TCP(TLS/1.0) smarto####.site:443
TCP(TLS/1.0) c.n####.com:443
TCP(TLS/1.0) clk.tap####.com:443
TCP(TLS/1.0) app.appsf####.com:443
TCP(TLS/1.0) us.fdpl####.com:443
TCP(TLS/1.0) b.query####.com:443
TCP(TLS/1.0) questio####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) c.o5####.com:443
TCP(v2.0 HTTP/1.1) meye####.com:80

DNS requests:

a.n####.ren
activeo####.appromo####.com
ad.lead####.net
ads.digg####.com
ads.dofun####.com
afftrac####.com
amc.jiek####.com
amc.jiek####.com
api.bi####.com
api.ki####.com
api.lead####.net
api.migh####.com
api.mob####.b####.com
apirepo####.revmo####.com
app.appsf####.com
appf####.com
apptr####.com
atracki####.appf####.com
aws.smarter####.net
b.query####.com
bestper####.site
bulk-c####.startap####.com
c####.af####.xyz
c####.amazing####.com
c####.click####.com
c####.gowa####.com
c####.howdo####.net
c####.inplay####.com
c####.sz####.com
c####.u.appco####.com
c.a####.com
c.cliikyn####.com
c.n####.com
c.o5####.com
c.s####.co
cl####.ads####.com
cl####.mob####.net
clinkad####.com
clk.apxadtr####.net
clk.hope####.net
clk.ocea####.com
clk.tap####.com
cp####.mobisma####.com
duc####.b####.com
en.sno####.1####.com
gl####.jc.superli####.com
gl####.ymtrac####.com
go-rill####.afft####.com
got.pubna####.net
ilv####.com
kar####.com
lohire####.com
md.apptr####.com
meye####.com
mm.m####.info
mo.freeind####.com
myhome####.mobi
normale####.com
of.okyes####.com
offers####.adflush####.com
p####.admobc####.com
p####.lead####.com
pl####.mob####.b####.com
questio####.com
s####.adin####.com
s####.mob####.b####.com
s####.rylinkw####.com
smart####.google####.com
smarto####.site
ssp.nan####.com
su.t####.li
t####.12trac####.com
t####.iches####.net
t####.m####.net
t####.sm4####.com
t####.upbn####.com
t.api.y####.net
t.mob####.net
t.trcktra####.com
trac####.artofc####.com
trac####.digital####.com
trac####.suma####.com
transr####.com
trk.gl####.com
u####.b####.com
us.api.adf####.cn
us.fdpl####.com
vi####.ddf####.com
w####.go2c####.org
wa####.go2c####.org
www.4g####.net
www.apxadtr####.net
www.bigt####.com
www.cu####.com
www.go####.com
www.greatmo####.mobi
www.koapk####.com
www.mmmmmm####.com
www.myhome####.mobi
www.okyes####.com
www.prom####.com
www.theadga####.com
www.zfr####.com

HTTP GET requests:

a.n####.ren/sm/v1/click?rule_id=####&publisher_slot=####&pub_aid=####&pu...
ads.digg####.com/acs.php?sid=####&adid=####&pb=####&subid=####&gaid=####
ads.dofun####.com/acs.php?sid=####&adid=####&os=####&osv=####&udid=####&...
afftrac####.com/mnz/v1?placement=####&source=####
amc.jiek####.com/sdkcp/plugUpdate.php?uid=####&model=####&plugVersion=##...
amc.jiek####.com/sdkcp/push_msgcp_new.php?uid=####&model=####&plugVersio...
amc.jiek####.com/sdkcp/sale_static_newcp.php?uid=####&model=####&plugVer...
amc.jiek####.com/sdkcp/user_visit_appcp.php?uid=####&model=####&plugVers...
amc.jiek####.com/sdkcp/wappush?uid=####&model=####&imei=####&screen_size...
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
api.lead####.net/applnk/826227844?src_section_id=####
api.lead####.net/nat_clk/556385449/8492572?sid=####&devad_id=####&gid=####
api.migh####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=###...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
apirepo####.revmo####.com/apiClick?cidRev=####&ts=####&ifa=####&dm=####&...
apirepo####.revmo####.com/apiClick?ts=####&clickId=####&ifa=####&cidRev=...
app.appsf####.com/com.ticno.olymptrade?pid=####&c=####&clickid=####
appf####.com/images/xpromt/noad.html
appromo####.trac####.adnova####.com/tracking?offer_id=####&publisher_id=...
apptr####.com/dir/click?placement_id=####&campaign_id=####&affid=####&ci...
apptr####.com/dir/redirect?placement_id=####&campaign_id=####&affid=####...
atracki####.appf####.com/transaction/post_click?offer_id=####&aff_id=###...
aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
aws.smarter####.net/index.php?m=####&p=####&app_id=####&pkg=####&gaid=##...
c####.af####.xyz/aff_c?offer_id=####&aff_id=####&aff_sub=####&sub_channe...
c####.amazing####.com/?utm_medium=####&utm_campaign=####&1=####&2=####&c...
c####.amazing####.com/?utm_term=####&clickverify=####
c####.amazing####.com/proc.php?6329a75####
c####.click####.com/tracking/click?clickid=####&trafficsource=####&offer...
c####.gowa####.com/click?transaction_id=wadogo_WAdv5259API_338730_102f62...
c####.gowa####.com/click?transaction_id=wadogo_WAdv5294API_337389_10207b...
c####.gowa####.com/click?transaction_id=wadogo_WAdv5294API_337389_1027de...
c####.gowa####.com/click?transaction_id=wadogo_WAdv5322API_337460_10225b...
c####.howdo####.net/aff_c?offer_id=####&affiliate_id=####&gaid=####&devi...
c####.inplay####.com/index.php?m=####&p=####&app_id=####&offer_id=####&a...
c####.sz####.com/click.php?app_id=####&offer_id=####&clickid=####&gaid=#...
c####.u.appco####.com/v1/click?oid=####&affid=####&tid=####&sub_affid=##...
c.a####.com/ck/sl/w6kYOx3c?tfc_id=####&sc=####&pub_click_id=####
c.cliikyn####.com/click?o=####&c=####&s1=####&s2=####&idfa=####
c.s####.co/api/v4/click?_castle####
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
cl####.mob####.net/target/t.mobrand.net/tracking/aff/6kYhHb4vTF2YxTW5YR1...
cl####.mob####.net/tracking/aff/6kYhHb4vTF2YxTW5YR1u0w/-dd6LZZOT22RI7jLI...
clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gai...
clk.hope####.net/click?id=####&aff=####&ost=####&click_id=####&aff_sub=#...
clk.ocea####.com/tracking/index/5a7bb4ea3d63d?aff_sub=####&gaid=####
clk.ocea####.com/tracking/index/5a7fbc779319a?gaid=####&idfa=####&andid=...
clk.ocea####.com/tracking/index/5a7fc4a32267d?gaid=####&idfa=####&andid=...
clk.ocea####.com/tracking/index/5a80f710057f9?gaid=####&idfa=####&andid=...
cp####.mobisma####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFUVtfX...
duc####.b####.com/click/affClick?aff_id=####&offer_id=####&google_aid=##...
gl####.jc.superli####.com/trace?offer_id=####&aff_id=####&gaid=####&clic...
gl####.ymtrac####.com/trace?offer_id=####&app_id=####&type=####&aff_sub3...
gl####.ymtrac####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=...
gl####.ymtrac####.com/trace?offer_id=####&app_id=####&type=####&sub_affi...
go-rill####.afft####.com/click?aid=####&linkid=####&s1=####&s2=####
go-rill####.afft####.com/click?aid=####&linkid=####&s1=mfrj####
got.pubna####.net/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&af...
lohire####.com/cldr/index.html?ur=aHR0####
meye####.com/eric/tools/css/reset/
mm.m####.info/?1=####&c_ot=####&cid=####&utm_campaign=####&utm_medium=####
myhome####.mobi/
myhome####.mobi/fabUk/
of.okyes####.com/redirect?uid=####&sourceid=####&clickid=####
offers####.adflush####.com/click/ssp/click?channel=####&uuid=####&id=###...
p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
s####.adin####.com/aff/ssp/click?channel=####&id=####&aoid=####&uuid=###...
s####.rylinkw####.com/?uuid=####&network=####&cid=####&subchannel=####&a...
smart####.google####.com/?utm_medium=####&utm_campaign=####&1=####&cid=#...
smart####.google####.com/?utm_term=####&clickverify=####&utm_content=####
smart####.google####.com/proc.php?7832ffb####
su.t####.li/l/baqennfufb/e83b75cb304cc368/?p1=####&subid=####
su.t####.li/l/baqennfufb/e83b75cb304cc368?p1=####&subid=####
t####.12trac####.com/aff_r?offer_id=284141&aff_id=8107&url=https://c.o5o...
t####.iches####.net/click?id=####&aff=####&ost=####&click=####&gaid=####...
t####.m####.net/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub1=##...
t####.sm4####.com/click?cid=####&s1=####&s2=####
t####.upbn####.com//click?id=####&aff=####&ost=####&click=####
t.api.y####.net/v1/click/f?ad=####&app_id=####&pid=####&api_type=####&s=...
trac####.digital####.com/index.php?offer_id=####&aff_id=####&aff_sub1=##...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_click_id=####&...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub####&aff_su...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_s...
trac####.suma####.com/aff_r?offer_id=256047&aff_id=6076&url=http://activ...
trac####.suma####.com/aff_r?offer_id=362822&aff_id=1258&url=http://click...
trac####.suma####.com/aff_r?offer_id=362822&aff_id=5479&url=http://click...
trac####.suma####.com/aff_r?offer_id=362822&aff_id=6595&url=http://click...
trac####.suma####.com/aff_r?offer_id=362925&aff_id=5728&url=http://click...
trac####.suma####.com/aff_r?offer_id=364381&aff_id=6356&url=http://click...
tretras####.com/15w53/sV8D/v1sT/5xdC_TLKvA-oemeEdPmTzaWAxDjgzlKwYe9jihv-...
tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
tretras####.com/89p18/cF9V/fltF/JhcU814T7fxUWNfG16EtGqF2qZGYYod8E0cwMMmG...
trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAnJwWSbuiK4W/CF?placement=####&m.ga...
trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAnJwWibtrDyk/CF?subid1=####&placeme...
trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAnJxWbmA3mjE/CF?placement=####&m.ga...
u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...
us.api.adf####.cn:5000/static/click?adjust=####&p=####&pa=####&s=####&o=...
wa####.go2c####.org/aff_c?aff_id=####&offer_id=####&aff_sub=####&aff_sub...
wa####.go2c####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub...
wa####.go2c####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&android...
wa####.go2c####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&source=...
wa####.go2c####.org/aff_r?offer_id=3458811&aff_id=3999&url=http://tracki...
www.apxadtr####.net/iclk/redirect.php?apxcode=####&id=####&dv2=####
www.apxadtr####.net/iclk/redirect.php?id=####&trafficsourceid=####&dv1=#...
www.cu####.com/20180125141223.gen521_BdJarDex_adtiming_0125.zip
www.greatmo####.mobi/?sl=####&data1=####&data2=####&data3=####
www.greatmo####.mobi/?sl=####&data3=####&data1=####
www.myhome####.mobi/
www.prom####.com/promoadxClick.php?offer_id=####&aff_id=####&aff_sub1=##...
www.prom####.com/promoadxClick.php?offer_id=####&aff_id=####&android_id=...
www.theadga####.com/jump/next.php?r=####&sub1=####

HTTP POST requests:

api.bi####.com/un
en.sno####.1####.com:8088/sdk/api/checklib
en.sno####.1####.com:8088/sdk/api/log/record
en.sno####.1####.com:8088/sdk/api/regclient
mo.freeind####.com/detail/getOfferListNew?enc=####
pl####.mob####.b####.com/ad_dex.php
s####.adin####.com/track/ds?sdk_version=####&platform=####&app_version=#...
s####.adin####.com/track/uc?sdk_version=####&platform=####&app_version=#...
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
vi####.ddf####.com/api/ls
vi####.ddf####.com/api/o
vi####.ddf####.com/api/pc
vi####.ddf####.com/api/va
www.4g####.net/ad/adc?gffw=####&frrw=####&zfbd=####&dlkvv=####&wdazz=###...
www.bigt####.com/ad/adc?gffw=####&frrw=####&zfbd=####&dlkvv=####&wdazz=#...
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/sp/py
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.okyes####.com:8080/sdk/cb.action
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...
www.zfr####.com/up.do

Modified file system:

Creates the following files:

/data/.xbin/api
/data/.xbin/bkoatdump_pooj_radish
/data/.xbin/cid
/data/.xbin/disp
/data/.xbin/mid
/data/.xbin/release
/data/.xbin/uid
/data/local/####/api
/data/local/####/cid
/data/local/####/disp
/data/local/####/mid
/data/local/####/release
/data/local/####/uid
/system/bin/####/api
/system/bin/####/bkload_jpoo_hd
/system/bin/####/cid
/system/bin/####/disp
/system/bin/####/mid
/system/bin/####/release
/system/bin/####/uid
/system/bin/.install-recovery.luno.sh
/system/bin/debuggerd
/system/bin/debuggerd_hulu
/system/bin/debuggerd_server
/system/bin/install-recovery.sh
/system/bin/kcol_ysy
/system/bin/oatdump_pooj_radish
/system/etc/install-cm-recovery.sh
/system/etc/install-recovery-2.sh
/system/etc/install-recovery.sh
/system/etc/install_recovery.sh
/system/xbin/.kugua
/system/xbin/load_jpoo_hd
/system/xbin/supolicy
<Package Folder>/.mbj/####/classes.zip
<Package Folder>/app_DEX_OPT/17084453.dex
<Package Folder>/app_DEX_OPT/20054164.dex
<Package Folder>/app_DEX_OPT/38969917.dex
<Package Folder>/app_DEX_OPT/54357805.dex
<Package Folder>/app_DEX_OPT/98327021.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/cache/cc.jar
<Package Folder>/com.init.env/####/AD_ID_SPINFO.xml
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1510836173312.zip
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/load_jpoo_hd
<Package Folder>/com.init.env/####/oatdump_pooj_radish
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1510836175171.zip
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/easv.data-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/17084453.apk
<Package Folder>/files/####/20054164.apk
<Package Folder>/files/####/38969917.apk
<Package Folder>/files/####/54357805.apk
<Package Folder>/files/####/98327021.apk
<Package Folder>/files/####/dk812.data
<Package Folder>/files/####/dk813.data
<Package Folder>/files/####/dk916.data
<Package Folder>/files/####/dk940.data
<Package Folder>/files/####/ja201801152050.data
<Package Folder>/files/201801231550.apk
<Package Folder>/files/DMLABC9CE10FEVA11
<Package Folder>/files/SW01.jar
<Package Folder>/files/c201801231550.apk
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/google.db
<Package Folder>/files/lib.dat
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/ob3.zip
<Package Folder>/p.dk812/####/forever.sh
<Package Folder>/p.dk812/####/krcfg.txt
<Package Folder>/p.dk812/####/krmain
<Package Folder>/p.dk812/####/krmain1510836177966.zip
<Package Folder>/p.dk812/####/krsdk.cert
<Package Folder>/p.dk813/####/forever.sh
<Package Folder>/p.dk813/####/krcfg.txt
<Package Folder>/p.dk813/####/krmain
<Package Folder>/p.dk813/####/krmain1510836206629.zip
<Package Folder>/p.dk813/####/krsdk.cert
<Package Folder>/p.dk916/####/forever.sh
<Package Folder>/p.dk916/####/krcfg.txt
<Package Folder>/p.dk916/####/krmain
<Package Folder>/p.dk916/####/krmain1510836228075.zip
<Package Folder>/p.dk916/####/krsdk.cert
<Package Folder>/p.dk940/####/forever.sh
<Package Folder>/p.dk940/####/krcfg.txt
<Package Folder>/p.dk940/####/krmain
<Package Folder>/p.dk940/####/krmain1510836217887.zip
<Package Folder>/p.dk940/####/krsdk.cert
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160121.xml.bak (deleted)
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml.bak
<Package Folder>/shared_prefs/AdsBusiness-data.xml.bak (deleted)
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/MobikokCache_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml (deleted)
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak (deleted)
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/SpZvShPrefs.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/ag.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/isupdate.xml
<Package Folder>/shared_prefs/local_storage0.xml
<Package Folder>/shared_prefs/local_storage1.xml
<Package Folder>/shared_prefs/local_storage33.xml
<Package Folder>/shared_prefs/local_storage999.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/m_cfg.xml (deleted)
<Package Folder>/shared_prefs/m_cfg.xml.bak
<Package Folder>/shared_prefs/ops_data.xml
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/sp.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml (deleted)
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/t_ini.xml.bak (deleted)
<Package Folder>/shared_prefs/upgrade_config.xml
<SD-Card>/.androidsystem/####/files.db
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/.androidsystem/####/syncfiles.db
<SD-Card>/APPMarket/####/204102004.jpg.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/dev_0.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/LogG/####/sp
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid
<SD-Card>/test1510836172130

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh <Package Folder>/p.dk812/files/forever.sh
c201801231550.apk -p <Package> -c <Package>:down
cat /sys/class/net/wlan0/address
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 0755 <Package Folder>/com.init.env
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk812/files/forever.sh
chmod 0777 <Package Folder>/p.dk812/files/krmain
chmod 0777 <Package Folder>/p.dk812/files/krsdk.cert
chmod 0777 <Package Folder>/p.dk813/files/forever.sh
chmod 0777 <Package Folder>/p.dk813/files/krmain
chmod 0777 <Package Folder>/p.dk916/files/forever.sh
chmod 0777 <Package Folder>/p.dk916/files/krmain
chmod 0777 <Package Folder>/p.dk940/files/forever.sh
chmod 0777 <Package Folder>/p.dk940/files/krmain
chmod 777 <Package Folder>/p.dk812/files/krcfg.txt
chmod 777 <Package Folder>/p.dk813/files/krcfg.txt
chmod 777 <Package Folder>/p.dk916/files/krcfg.txt
chmod 777 <Package Folder>/p.dk940/files/krcfg.txt
load_jpoo_hd
load_jpoo_hd -c id
logcat -d -v time
ls -l /system/bin/su
ps
sh
sh /system/bin/load_jpoo_hd
sh /system/bin/load_jpoo_hd -c id
su
su -c id

Loads the following dynamic libraries:

com.falls

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
DESede

Uses elevated priveleges.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Gains access to information about sent/received SMS messages.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial