Android.DownLoader.3495

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Mobikok.1.origin
Android.DownLoader.660.origin
Android.RemoteCode.110.origin
Android.RemoteCode.88.origin
Android.Xiny.1.origin
Android.Xiny.164.origin
Android.Xiny.197
Android.Xiny.202.origin
Android.Xiny.73.origin

Downloads the following detected threats from the Web:

Android.RemoteCode.110.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) t####.bruce####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) cl####.qh####.com:80
TCP(HTTP/1.1) img.adti####.com:80
TCP(HTTP/1.1) of.okyes####.com:80
TCP(HTTP/1.1) api.ap####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) ilv####.com:80
TCP(HTTP/1.1) i####.cn.com:80
TCP(HTTP/1.1) di####.pubna####.net:80
TCP(HTTP/1.1) t####.upbn####.com:80
TCP(HTTP/1.1) rd.gl####.com:80
TCP(HTTP/1.1) claim-p####.com:80
TCP(HTTP/1.1) www.ap####.com:80
TCP(HTTP/1.1) ap####.mobisen####.com:80
TCP(HTTP/1.1) clinkad####.com:80
TCP(HTTP/1.1) 45.33.1####.75:80
TCP(HTTP/1.1) sdk.adti####.com:80
TCP(HTTP/1.1) www.jp####.com:80
TCP(HTTP/1.1) play####.forward####.loan:80
TCP(HTTP/1.1) appco####.fusetra####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) ap####.mobi:80
TCP(HTTP/1.1) a####.bat####.net:80
TCP(HTTP/1.1) a####.win####.com:80
TCP(HTTP/1.1) pg.x####.com:80
TCP(HTTP/1.1) e####.grip####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) 45.79.2####.163:80
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(HTTP/1.1) got.pubna####.net:80
TCP(HTTP/1.1) t####.admob####.com:80
TCP(HTTP/1.1) www.okyes####.com:8080
TCP(HTTP/1.1) sdk.prom####.com:80
TCP(HTTP/1.1) ssl.m####.me:80
TCP(HTTP/1.1) ads.digg####.com:80
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) trk.gl####.com:80
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) 45.79.1####.230:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) a####.app####.com:80
TCP(HTTP/1.1) c####.com:80
TCP(HTTP/1.1) c####.af####.xyz:80
TCP(HTTP/1.1) 5####.77.99.53:80
TCP(HTTP/1.1) clk.apxadtr####.net:80
TCP(HTTP/1.1) 45.79.1####.48:80
TCP(HTTP/1.1) imreall####.com:80
TCP(HTTP/1.1) 4####.33.37.240:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) 47.52.1####.86:80
TCP(HTTP/1.1) p####.admobc####.com:80
TCP(HTTP/1.1) akw.e####.space:80
TCP(HTTP/1.1) sdk-112####.us-we####.elb.####.com:80
TCP(HTTP/1.1) duc####.b####.com:80
TCP(HTTP/1.1) c####.cpiu####.com:80
TCP(HTTP/1.1) werti####.com:80
TCP(HTTP/1.1) mb-se####.com:80
TCP(HTTP/1.1) a####.pubna####.net:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) dsa.startap####.edg####.net:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) clk.tap####.com:80
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) tdsj####.com:80
TCP(SSL/3.0) freecal####.com:443
TCP(SSL/3.0) questio####.com:443
TCP(TLS/1.0) roadmap####.go2af####.com:443
TCP(TLS/1.0) 1####.177.126.105:443
TCP(TLS/1.0) freecal####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) cl####.dis####.io:443
TCP(TLS/1.0) c.n####.com:443
TCP(TLS/1.0) questio####.com:443
TCP(TLS/1.0) ga.x####.com:443
TCP(TLS/1.0) clk.tap####.com:443
TCP(TLS/1.0) t####.cpa.tapge####.com:443
TCP(TLS/1.0) carrier####.go2af####.com:443
TCP(TLS/1.0) sdk.adti####.com:443

DNS requests:

a####.app####.com
a####.bat####.net
a####.pubna####.net
a####.win####.com
ads.digg####.com
akw.e####.space
ali.f####.cdn.####.com
ap####.mobi
ap####.mobisen####.com
api.ap####.com
api.bi####.com
api.ki####.com
api.l####.com
api.migh####.com
api.mob####.b####.com
aws.smarter####.net
bulk-c####.startap####.com
c####.af####.xyz
c####.com
c####.cpiu####.com
c.n####.com
c.s####.co
carrier####.go2af####.com
cl####.ads####.com
cl####.dis####.io
cl####.qh####.com
claim-p####.com
clinkad####.com
clk.apxadtr####.net
clk.tap####.com
di####.pubna####.net
duc####.b####.com
e####.grip####.com
ea.sno####.1####.com
en.sno####.1####.com
f####.gst####.com
fc.appco####.com
freecal####.com
ga.x####.com
got.pubna####.net
i####.cn.com
ilv####.com
im####.com
img.adti####.com
imreall####.com
k####.v####.m.####.me
mb-se####.com
mo.freeind####.com
oad.tap####.com
of.okyes####.com
p####.admobc####.com
pg.x####.com
play####.forward####.loan
questio####.com
rd.gl####.com
roadmap####.go2af####.com
s####.mob####.b####.com
sdk-112####.us-we####.elb.####.com
sdk.adti####.com
sdk.prom####.com
ssl.m####.me
t####.admob####.com
t####.bruce####.com
t####.cpa.tapge####.com
t####.upbn####.com
tdsj####.com
tra####.bruce####.com
trk.gl####.com
werti####.com
www.admobim####.com
www.ap####.com
www.cu####.com
www.gst####.com
www.jp####.com
www.koapk####.com
www.mmmmmm####.com
www.okyes####.com
www.zfr####.com

HTTP GET requests:

a####.app####.com/aff_c?offer_id=####&aff_id=####&aff_unique4=####&aff_s...
a####.bat####.net/call/v2/ad/click?recommend_id=####&ads_id=####&aff_id=...
a####.pubna####.net/aff_c?aff_sub5=####&aff_sub=####&aff_sub2=####&aff_s...
a####.pubna####.net/aff_r?offer_id=57002&aff_id=25335&url=http://direct....
a####.win####.com/offers/click/271/565639/?aff_sub=####&source=####&aff_...
ads.digg####.com/acs.php?sid=####&adid=####&pb=####&subid=####&gaid=####
akw.e####.space/index.php?r=####
akw.e####.space/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pr...
ali.f####.cdn.####.com/20180106173244-snowfox_v19i154et.jar
ap####.mobi/red/72deff51-5013-11e5-9f1d-0cc47a44dbaa/?alg=####&clickid=#...
ap####.mobisen####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
api.ap####.com/link/buy/android/de.autodoc.gmbh/e1?clinkID=####&pubID=##...
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
api.ki####.com/redirect?s=####&at=####&rt=####&s1=####&s5=####
appco####.fusetra####.com/tl?a=####&o=####&s1=####&sc=####&s2=####&s3=##...
aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
c####.af####.xyz/aff_c?offer_id=####&aff_id=####&aff_sub=####&sub_channe...
c####.com/?a=####&c=####&s1=####&s2=####
c####.cpiu####.com/v2/click/?offerid=####&gaid=####&aff_sub=####&sub_id=...
c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
cl####.qh####.com/index.php?m=####&p=####&app_id=####&offer_id=####&clic...
claim-p####.com/?u=####&o=####&t=####&cid=####
clinkad####.com/tracking?camp=####&pubid=####&aid=####&gaid=####&idfa=##...
clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid=s5a####&...
clk.apxadtr####.net/iclk/redirect.php?id=####&trafficsourceid=####&dv1=#...
clk.apxadtr####.net/iclk/redirect.php?id=####&trafficsourceid=####&dv1=C...
clk.tap####.com/engine/a.aspx?id=####
di####.pubna####.net/html5/apps/d2369a0ac4ed4fbfaa1439e01c7dda4f/direct_...
dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFUVdXW...
dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFUVhfX...
duc####.b####.com/click/affClick?aff_sub=####&aff_sub19=####&aff_sub2=##...
duc####.b####.com/click/affClick?offer_id=####&aff_id=####&google_aid=##...
e####.grip####.com/gpsLib317_n.jar
got.pubna####.net/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&af...
got.pubna####.net/click/native?aid=####&t=####&sub_id=####
i####.cn.com/a/3cff577985556567209c8fa8131303f63
ilv####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpES1sd...
img.adti####.com/upload/sdk/hotfix/nonename-97.jar
imreall####.com//red/b66376be-def2-11e5-8d29-0cc47a44dbaa/?alg=####&clic...
imreall####.com/c/164706/0r161r83-qr5p-66r9-38q3-55704503n7s1/60561q7p-2...
mb-se####.com/?a=####&c=####&s1=####&s2=####&ckmguid=####
of.okyes####.com/redirect?uid=####&sourceid=####&clickid=####
p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
play####.forward####.loan/default.aspx?u=####&o=####&t=####&cid=####&f=#...
play####.forward####.loan/media/mainstream/backbutton_mainstream.js
play####.forward####.loan/media/mainstream/exit_ms.js
play####.forward####.loan/media/mainstream/jquery.js
play####.forward####.loan/media/mainstream/js.cookie6_pure.js
play####.forward####.loan/media/mainstream/js1.js
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/bootstrap.mi...
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/font-awesome...
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img1.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img10.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img11.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img2.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img3.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img4.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img5.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img6.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img7.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img8.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img9.jpg
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/jquery-ui.mi...
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/lidl.png
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/logo_f01.png
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/main.css
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/main.js
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/modernizr-2....
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/returnDate.n...
play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/safari.png
play####.forward####.loan/util/utils-ms.js
rd.gl####.com/?r=####&l=####&p=####&c=####
sdk.adti####.com/hotfix?version=####&app_id=####&shellv=####
sdk.prom####.com/promoadxClick.php?offer_id=####&aff_id=####&android_id=...
ssl.m####.me/?utm_medium=####&utm_campaign=####&1=####&2=####
ssl.m####.me/?utm_term=####&clickverify=####&utm_content=####
ssl.m####.me/proc.php?54290ee####
t####.admob####.com/adTrack/track/click?oid=####&affid=####&aff_click_id...
t####.bruce####.com/ck.php?line_item_id=####&subid_spx=####&click_id=####
t####.bruce####.com/ck_jump?id=cz00####&__if=####&__type=####
t####.upbn####.com//click?id=####&aff=####&ost=####&click=####
tdsj####.com/ExtService.svc/getextparams
trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAFxbAPvFAtKY?placement=####
trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAGJh2XE6oIoo/CF?placement=####&subi...
trk.gl####.com/sw/1224292/CD2/&placement=
werti####.com/clnr/index.html?ur=aHR0####
www.ap####.com/error.html
www.cu####.com/20180125141223.gen521_BdJarDex_adtiming_0125.zip
www.jp####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=####&...

HTTP POST requests:

api.bi####.com/un
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/checklib
ea.sno####.1####.com:18088/sdk/api/regclient
en.sno####.1####.com:8088/sdk/api/ad/hull_v2
en.sno####.1####.com:8088/sdk/api/log/record
mo.freeind####.com/detail/getOfferListNew?enc=####
pg.x####.com/api/q/a/3cff577985556567209c8fa8131303f63
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
sdk-112####.us-we####.elb.####.com/sdk/sdkClient/request
www.admobim####.com/surl/api2_reg.action
www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/sp/py
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.okyes####.com:8080/sdk/cb.action
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.zfr####.com/up.do

Modified file system:

Creates the following files:

/data/.xbin/api
/data/.xbin/bkoatdump_pooj_radish
/data/.xbin/cid
/data/.xbin/disp
/data/.xbin/mid
/data/.xbin/release
/data/.xbin/uid
/data/local/####/api
/data/local/####/cid
/data/local/####/disp
/data/local/####/mid
/data/local/####/release
/data/local/####/uid
/system/bin/####/api
/system/bin/####/bkload_jpoo_hd
/system/bin/####/cid
/system/bin/####/disp
/system/bin/####/mid
/system/bin/####/release
/system/bin/####/uid
/system/bin/.install-recovery.luno.sh
/system/bin/debuggerd
/system/bin/debuggerd_hulu
/system/bin/debuggerd_server
/system/bin/install-recovery.sh
/system/bin/kcol_ysy
/system/bin/oatdump_pooj_radish
/system/etc/install-cm-recovery.sh
/system/etc/install-recovery-2.sh
/system/etc/install-recovery.sh
/system/etc/install_recovery.sh
/system/xbin/.kugua
/system/xbin/load_jpoo_hd
/system/xbin/supolicy
<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_DEX_OPT/21230046.dex
<Package Folder>/app_DEX_OPT/29932627.dex
<Package Folder>/app_DEX_OPT/41650639.dex
<Package Folder>/app_DEX_OPT/49646780.dex
<Package Folder>/app_DEX_OPT/66544302.dex
<Package Folder>/app_DEX_OPT/68049424.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/index
<Package Folder>/cache/bb.jar
<Package Folder>/com.init.env/####/AD_ID_SPINFO.xml
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1510835131669.zip
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/load_jpoo_hd
<Package Folder>/com.init.env/####/oatdump_pooj_radish
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1510835133881.zip
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/mpush_game.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/-188828598
<Package Folder>/files/####/-188828598.data
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/21230046.apk
<Package Folder>/files/####/29932627.apk
<Package Folder>/files/####/41650639.apk
<Package Folder>/files/####/49646780.apk
<Package Folder>/files/####/66544302.apk
<Package Folder>/files/####/68049424.apk
<Package Folder>/files/####/dk360.data
<Package Folder>/files/####/dk363.data
<Package Folder>/files/####/dk910.data
<Package Folder>/files/####/dk947.data
<Package Folder>/files/####/fiwmw
<Package Folder>/files/####/ja201801152050.data
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/####/pgbwaa
<Package Folder>/files/####/ym43.data
<Package Folder>/files/201711071150.apk
<Package Folder>/files/c201711071150.apk
<Package Folder>/files/cache_v1.jar
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/google.db
<Package Folder>/files/lib.dat
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/new_v1.jar
<Package Folder>/files/ob1.zip
<Package Folder>/files/snowfox_v19i.jar
<Package Folder>/files/uvso.jar
<Package Folder>/p.dk360/####/forever.sh
<Package Folder>/p.dk360/####/krcfg.txt
<Package Folder>/p.dk360/####/krmain
<Package Folder>/p.dk360/####/krmain1510835177740.zip
<Package Folder>/p.dk360/####/krsdk.cert
<Package Folder>/p.dk363/####/forever.sh
<Package Folder>/p.dk363/####/krcfg.txt
<Package Folder>/p.dk363/####/krmain
<Package Folder>/p.dk363/####/krmain1510835188265.zip
<Package Folder>/p.dk363/####/krsdk.cert
<Package Folder>/p.dk910/####/forever.sh
<Package Folder>/p.dk910/####/krcfg.txt
<Package Folder>/p.dk910/####/krmain
<Package Folder>/p.dk910/####/krmain1510835134830.zip
<Package Folder>/p.dk910/####/krsdk.cert
<Package Folder>/p.dk947/####/forever.sh
<Package Folder>/p.dk947/####/krcfg.txt
<Package Folder>/p.dk947/####/krmain
<Package Folder>/p.dk947/####/krmain1510835166677.zip
<Package Folder>/p.dk947/####/krsdk.cert
<Package Folder>/p.ym43/####/forever.sh
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/3cff577985556567209c8fa8131303f63...le.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml.bak
<Package Folder>/shared_prefs/MobikokCache_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/adtiminginfo.xml
<Package Folder>/shared_prefs/af.xml
<Package Folder>/shared_prefs/all_info_data.xml
<Package Folder>/shared_prefs/appKey.xml
<Package Folder>/shared_prefs/appshell.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/crash_log_sp.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/isupdate.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/s_sdk_pro_pref.xml
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml (deleted)
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/t_ini.xml.bak (deleted)
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/upgrade_config.xml
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/.tcookieid
<SD-Card>/Android/####/dev_f53bc04.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/ua.dat
<SD-Card>/LogG/####/sp
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh <Package Folder>/p.dk910/files/forever.sh
c201711071150.apk -p <Package> -c <Package>:crane
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 0755 <Package Folder>/com.init.env
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk360/files/forever.sh
chmod 0777 <Package Folder>/p.dk360/files/krmain
chmod 0777 <Package Folder>/p.dk363/files/forever.sh
chmod 0777 <Package Folder>/p.dk363/files/krmain
chmod 0777 <Package Folder>/p.dk910/files/forever.sh
chmod 0777 <Package Folder>/p.dk910/files/krmain
chmod 0777 <Package Folder>/p.dk910/files/krsdk.cert
chmod 0777 <Package Folder>/p.dk947/files/forever.sh
chmod 0777 <Package Folder>/p.dk947/files/krmain
chmod 0777 <Package Folder>/p.ym43/files/forever.sh
chmod 6777 <Package Folder>/files/c201711071150.apk
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 <Package Folder>/p.dk360/files/krcfg.txt
chmod 777 <Package Folder>/p.dk363/files/krcfg.txt
chmod 777 <Package Folder>/p.dk910/files/krcfg.txt
chmod 777 <Package Folder>/p.dk947/files/krcfg.txt
load_jpoo_hd
load_jpoo_hd -c id
logcat -d -v time
ls -l /system/bin/su
ps
sh
sh /system/bin/load_jpoo_hd
sh /system/bin/load_jpoo_hd -c id
su
su -c id

Loads the following dynamic libraries:

dan.yufeng
fiwmw
libjiagu

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
desede-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding

Uses elevated priveleges.

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial