Android.DownLoader.3496

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Mobikok.1.origin
Android.DownLoader.660.origin
Android.RemoteCode.110.origin
Android.RemoteCode.88.origin
Android.Xiny.1.origin
Android.Xiny.164.origin
Android.Xiny.197
Android.Xiny.202.origin
Android.Xiny.73.origin

Downloads the following detected threats from the Web:

Android.RemoteCode.110.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) cd####.com:80
TCP(HTTP/1.1) t####.admob####.com:80
TCP(HTTP/1.1) pg.x####.com:80
TCP(HTTP/1.1) wants-t####.com:80
TCP(HTTP/1.1) go####.nl:80
TCP(HTTP/1.1) mobile####.forward####.loan:80
TCP(HTTP/1.1) p####.admobc####.com:80
TCP(HTTP/1.1) ssl.gst####.com:80
TCP(HTTP/1.1) i####.cn.com:80
TCP(HTTP/1.1) di####.pubna####.net:80
TCP(HTTP/1.1) t####.upbn####.com:80
TCP(HTTP/1.1) duc####.b####.com:80
TCP(HTTP/1.1) rd.gl####.com:80
TCP(HTTP/1.1) 4####.33.0.176:80
TCP(HTTP/1.1) clinkad####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) www.f####.com:80
TCP(HTTP/1.1) cdn.k####.com:80
TCP(HTTP/1.1) www.jp####.com:80
TCP(HTTP/1.1) appco####.fusetra####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) centers####.com:80
TCP(HTTP/1.1) 45.79.1####.142:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) img.adti####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) claim-p####.com:80
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) of.okyes####.com:80
TCP(HTTP/1.1) www.okyes####.com:8080
TCP(HTTP/1.1) sdk.prom####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) ads.digg####.com:80
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) trk.gl####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) got.pubna####.net:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) a####.app####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) dsa.startap####.edg####.net:80
TCP(HTTP/1.1) 5####.77.99.53:80
TCP(HTTP/1.1) trac####.pubt####.com:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) akw.e####.space:80
TCP(HTTP/1.1) sdk-112####.us-we####.elb.####.com:80
TCP(HTTP/1.1) sdk.adti####.com:80
TCP(HTTP/1.1) c####.cpiu####.com:80
TCP(HTTP/1.1) cl####.r####.io:80
TCP(HTTP/1.1) a####.pubna####.net:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) e####.grip####.com:80
TCP(HTTP/1.1) b####.onlined####.info:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) y####.to:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) tdsj####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) roadmap####.go2af####.com:443
TCP(TLS/1.0) freecal####.com:443
TCP(TLS/1.0) ga.x####.com:443
TCP(TLS/1.0) trac####.artofc####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) clk.tap####.com:443
TCP(TLS/1.0) carrier####.go2af####.com:443
TCP(TLS/1.0) sdk.adti####.com:443

DNS requests:

a####.app####.com
a####.pubna####.net
ads.digg####.com
aexcep####.b####.qq.com
akw.e####.space
ali.f####.cdn.####.com
and####.b####.qq.com
api.bi####.com
api.ki####.com
api.l####.com
api.migh####.com
api.mob####.b####.com
aws.smarter####.net
b####.onlined####.info
bulk-c####.startap####.com
c####.cpiu####.com
c.s####.co
carrier####.go2af####.com
cd####.com
cdn.k####.com
centers####.com
cl####.ads####.com
cl####.r####.io
claim-p####.com
clinkad####.com
clk.tap####.com
di####.pubna####.net
duc####.b####.com
e####.grip####.com
ea.sno####.1####.com
en.sno####.1####.com
f####.google####.com
fc.appco####.com
freecal####.com
ga.x####.com
go####.nl
got.pubna####.net
i####.cn.com
ilv####.com
img.adti####.com
k####.v####.m.####.me
mo.freeind####.com
mobile####.forward####.loan
of.okyes####.com
p####.admobc####.com
pg.x####.com
rd.gl####.com
roadmap####.go2af####.com
s####.mob####.b####.com
sdk-112####.us-we####.elb.####.com
sdk.adti####.com
sdk.prom####.com
ssl.gst####.com
sta####.com
t####.admob####.com
t####.upbn####.com
tdsj####.com
trac####.artofc####.com
trac####.pubt####.com
trk.gl####.com
wants-t####.com
www.admobim####.com
www.cu####.com
www.f####.com
www.go####.nl
www.gst####.com
www.jp####.com
www.koapk####.com
www.mmmmmm####.com
www.okyes####.com
www.zfr####.com
y####.to

HTTP GET requests:

a####.app####.com/aff_c?offer_id=####&aff_id=####&aff_unique4=####&aff_s...
a####.app####.com/aff_c?offer_id=####&aff_id=####&idfa=####&aff_unique5=...
a####.pubna####.net/aff_c?aff_sub5=####&aff_sub=####&aff_sub2=####&aff_s...
a####.pubna####.net/aff_r?offer_id=57002&aff_id=25335&url=http://direct....
ads.digg####.com/acs.php?sid=####&adid=####&pb=####&subid=####&gaid=####
akw.e####.space/index.php?r=####
akw.e####.space/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pr...
ali.f####.cdn.####.com/20180106173244-snowfox_v19i154et.jar
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
api.ki####.com/redirect?s=####&at=####&rt=####&o=####&s1=####&s2=####&s3...
appco####.fusetra####.com/tl?a=####&o=####&s1=####&sc=####&s2=####&s3=##...
aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
b####.onlined####.info/?utm_medium=####&utm_campaign=####&cid=####
c####.cpiu####.com/v2/click/?offerid=####&gaid=####&aff_sub=####&sub_id=...
c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
cd####.com/?a=####&c=####&s1=####&s2=####
cd####.com/?a=####&c=####&s1=####&s2=####&ckmguid=####
cdn.k####.com/upload/games/htmlgames/1459537623_ninja-boy-test/146014253...
centers####.com/?url=ba5####
centers####.com/away.php
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
cl####.r####.io/tracking/click?clickid=####&trafficsource=####&offerid=#...
claim-p####.com/?u=####&o=####&t=####&cid=####
clinkad####.com/tracking?camp=####&pubid=####&aid=####&gaid=####&idfa=##...
clinkad####.com/tracking?camp=####&pubid=####&sid=####&aid=####&gaid=###...
clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid1=####&si...
clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid=s5a####&...
di####.pubna####.net/html5/apps/d2369a0ac4ed4fbfaa1439e01c7dda4f/direct_...
dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFUVdbU...
duc####.b####.com/click/affClick?offer_id=####&aff_id=####&google_aid=##...
e####.grip####.com/gpsLib317_n.jar
go####.nl/
go####.nl/gen_204?s=####&atyp=####&ei=####&rt=####
go####.nl/images/hpp/gsa_super_g-64.gif
go####.nl/images/nav_logo242.png
go####.nl/images/nav_logo242_hr.webp
go####.nl/logos/doodles/2018/doodle-snow-games-day-10-5902906795491328-l...
go####.nl/xjs/_/js/k=xjs.qs.nl.-JabgnpgCIc.O/m=sx,sb_mob,bct,cdos,elog,h...
got.pubna####.net/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&af...
got.pubna####.net/click/native?aid=####&t=####&sub_id=####
i####.cn.com/a/3cff577985556567209c8fa8131303f63
img.adti####.com/upload/sdk/hotfix/nonename-97.jar
mobile####.forward####.loan/default.aspx?u=####&o=####&t=####&cid=####&f...
mobile####.forward####.loan/media/mainstream/backbutton_mainstream.js
mobile####.forward####.loan/media/mainstream/exit_ms.js
mobile####.forward####.loan/media/mainstream/jquery.js
mobile####.forward####.loan/media/mainstream/js.cookie6_pure.js
mobile####.forward####.loan/media/mainstream/js1.js
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/bootstrap....
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/font-aweso...
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img1.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img10.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img11.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img2.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img3.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img4.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img5.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img6.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img7.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img8.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img9.jpg
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/jquery-ui....
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/lidl.png
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/logo_f01.png
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/main.css
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/main.js
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/modernizr-...
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/returnDate...
mobile####.forward####.loan/media/mainstream/nl/wap/mobsurvey/safari.png
mobile####.forward####.loan/util/utils-ms.js
mobile####.forward####.loan/web/
of.okyes####.com/redirect?uid=####&sourceid=####&clickid=####
p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
rd.gl####.com/?r=####&l=####&p=####&c=####
sdk.adti####.com/hotfix?version=####&app_id=####&shellv=####
sdk.prom####.com/promoadxClick.php?offer_id=####&aff_id=####&android_id=...
ssl.gst####.com/gb/images/qi1_36e7b564.png
t####.admob####.com/adTrack/track/click?oid=####&affid=####&aff_click_id...
t####.upbn####.com//click?id=####&aff=####&ost=####&click=####
tdsj####.com/ExtService.svc/getextparams
trac####.pubt####.com/click?offer_id=####&sub_id=####&click_id=####&gaid...
tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAGJh2XE6oIoo/CF?placement=####&subi...
trk.gl####.com/sw/1224292/CD2/&placement=
wants-t####.com/
wants-t####.com/css/style.css
wants-t####.com/images/invalid.png
wants-t####.com/images/iphonex.png
wants-t####.com/js/jquery.countdown.min.js
wants-t####.com/js/jquery.min.js
wants-t####.com/js/scripts.js
wants-t####.com/js/trls.js
www.cu####.com/20180125141223.gen521_BdJarDex_adtiming_0125.zip
www.f####.com/red.php
www.f####.com/red.php?utm_source=####&app_id=####&country=####&package=#...
www.jp####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=####&...
y####.to/s/9Yj?pubref=####&affpubid=####

HTTP POST requests:

aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
api.bi####.com/un
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/checklib
ea.sno####.1####.com:18088/sdk/api/regclient
en.sno####.1####.com:8088/sdk/api/ad/hull_v2
en.sno####.1####.com:8088/sdk/api/log/record
mo.freeind####.com/detail/getOfferListNew?enc=####
pg.x####.com/api/q/a/3cff577985556567209c8fa8131303f63
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
sdk-112####.us-we####.elb.####.com/sdk/sdkClient/request
www.admobim####.com/surl/api2_reg.action
www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/sp/py
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.okyes####.com:8080/sdk/cb.action
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.zfr####.com/up.do

Modified file system:

Creates the following files:

/system/bin/####/api
/system/bin/####/cid
/system/bin/####/mid
/system/bin/####/release
/system/bin/####/uid
/system/bin/debuggerd_hulu
/system/bin/kcol_ysy
/system/bin/oatdump_pooj_radish
/system/xbin/load_jpoo_hd
/system/xbin/supolicy
<Package Folder>/app_DEX_OPT/09912330.dex
<Package Folder>/app_DEX_OPT/14653124.dex
<Package Folder>/app_DEX_OPT/82785181.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/index
<Package Folder>/cache/bb.jar
<Package Folder>/com.init.env/####/AD_ID_SPINFO.xml
<Package Folder>/com.init.env/####/data_0
<Package Folder>/com.init.env/####/data_1
<Package Folder>/com.init.env/####/data_2
<Package Folder>/com.init.env/####/data_3
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1510835142773.zip
<Package Folder>/com.init.env/####/f_000001
<Package Folder>/com.init.env/####/f_000002
<Package Folder>/com.init.env/####/f_000003
<Package Folder>/com.init.env/####/f_000004
<Package Folder>/com.init.env/####/f_000005
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/index
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/load_jpoo_hd
<Package Folder>/com.init.env/####/oatdump_pooj_radish
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1510835148985.zip
<Package Folder>/com.init.env/####/webview.db-journal
<Package Folder>/com.init.env/####/webviewCookiesChromium.db-journal
<Package Folder>/databases/####/http_mobile4833.forward-f-serve...ournal
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/mpush_game.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/-188828598
<Package Folder>/files/####/-188828598.data
<Package Folder>/files/####/09912330.apk
<Package Folder>/files/####/14653124.apk
<Package Folder>/files/####/82785181.apk
<Package Folder>/files/####/dk938.data
<Package Folder>/files/####/fiwmw
<Package Folder>/files/####/ja201801152050.data
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/####/pgbwaa
<Package Folder>/files/####/ym43.data
<Package Folder>/files/201709211650.apk
<Package Folder>/files/c201709211650.apk
<Package Folder>/files/cache_v1.jar
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/google.db
<Package Folder>/files/lib.dat
<Package Folder>/files/local_crash_lock
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/native_record_lock
<Package Folder>/files/new_v1.jar
<Package Folder>/files/ob1.zip
<Package Folder>/files/security_info
<Package Folder>/files/snowfox_v19i.jar
<Package Folder>/files/uvso.jar
<Package Folder>/mix.dex
<Package Folder>/p.dk938/####/forever.sh
<Package Folder>/p.dk938/####/krcfg.txt
<Package Folder>/p.dk938/####/krmain
<Package Folder>/p.dk938/####/krmain1510835178500.zip
<Package Folder>/p.dk938/####/krsdk.cert
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh5
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh51510835153428.zip
<Package Folder>/p.ym43/####/forever.sh
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160121.xml.bak
<Package Folder>/shared_prefs/3cff577985556567209c8fa8131303f63...le.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml.bak
<Package Folder>/shared_prefs/LoginPreUtil.xml.bak (deleted)
<Package Folder>/shared_prefs/MobikokCache_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/adtiminginfo.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/all_info_data.xml
<Package Folder>/shared_prefs/appKey.xml
<Package Folder>/shared_prefs/appshell.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/crash_log_sp.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/isupdate.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/m_cfg.xml.bak (deleted)
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/s_sdk_pro_pref.xml
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/upgrade_config.xml
<Package Folder>/tx_shell/libnfix.so
<Package Folder>/tx_shell/libshella-2.10.6.0.so
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/.tcookieid
<SD-Card>/Android/####/dev_f53bc04.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/ua.dat
<SD-Card>/LogG/####/sp
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
/system/bin/sh <Package Folder>/p.dk938/files/forever.sh
c201709211650.apk -p <Package> -c <Package>:yieldformula
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 0755 <Package Folder>/com.init.env
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk938/files/forever.sh
chmod 0777 <Package Folder>/p.dk938/files/krmain
chmod 0777 <Package Folder>/p.dk938/files/krsdk.cert
chmod 0777 <Package Folder>/p.ym43/files/Wlhod1gzbDFiVjh5
chmod 0777 <Package Folder>/p.ym43/files/forever.sh
chmod 6777 <Package Folder>/files/c201709211650.apk
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.6.0.so
chmod 700 <Package Folder>/tx_shell/libufix.so
chmod 777 <Package Folder>/p.dk938/files/krcfg.txt
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
logcat -d -v time
ls -l /system/bin/su
ps
sh
su
su -c id

Loads the following dynamic libraries:

Bugly
com.beginning
fiwmw
libnfix
libshella-2.10.6.0
libufix
nfix
ufix

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
desede-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES
DES-CBC-PKCS5Padding

Uses elevated priveleges.

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial