Android.Backdoor.1171

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.627.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) box.jom####.com:80
TCP(HTTP/1.1) g####.d.cg:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) cm.qt####.com:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) s####.jom####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) plg.abcdse####.com:7901
TCP(HTTP/1.1) www.ta####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) cm.pos.b####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) up####.mnw.cn.####.com:80
TCP(HTTP/1.1) zha####.b####.com:80
TCP(HTTP/1.1) z####.b####.com:80
TCP(HTTP/1.1) q.c####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) map####.y####.com.cn:80
TCP(HTTP/1.1) cm.g.doublec####.net:80
TCP(HTTP/1.1) m.mnw.cn.####.com:80
TCP(HTTP/1.1) nsc####.b####.com:80
TCP(HTTP/1.1) wn.pos.b####.com:80
TCP(HTTP/1.1) a####.mnw.cn:80
TCP(HTTP/1.1) j.ba####.cn:80
TCP(HTTP/1.1) s.c####.b####.com:80
TCP(HTTP/1.1) wap.n.sh####.com:80
TCP(HTTP/1.1) m.ta####.com:80
TCP(HTTP/1.1) c####.jd.com:80
TCP(TLS/1.0) ae.bdst####.com.####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) box.jom####.com:443
TCP(TLS/1.0) mbd.n.sh####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) m.ta####.com:443

DNS requests:

a####.mnw.cn
aaa.abcdse####.com
ae.bdst####.com
api.s####.b####.com
b####.s####.b####.com
bbb.abcdse####.com
c####.baidust####.com
c####.baidust####.com
c####.jd.com
c####.mm####.com
c.c####.com
cm.g.doublec####.net
cm.pos.b####.com
cm.qt####.com
dup.baidust####.com
ext.b####.com
f10.b####.com
f11.b####.com
f12.b####.com
g####.d.cg
h####.c####.com
hm.b####.com
i####.mnw.cn
i8.b####.com
int.d####.s####.####.cn
j.ba####.cn
l.m####.cn
m####.b####.com
m.b####.com
m.m####.cn
m.ta####.com
map####.y####.com.cn
nsc####.b####.com
plg.abcdse####.com
pos.b####.com
q5.c####.com
r####.wx.qq.com
s.bdst####.com
s.c####.b####.com
s11.c####.com
s4.c####.com
s59.c####.com
s9.c####.com
so.m####.cn
t10.b####.com
t11.b####.com
t12.b####.com
tp.m####.cn
up####.mnw.cn
w.c####.com
wn.pos.b####.com
www.ta####.com
z####.b####.com
z11.c####.com
z13.c####.com
z4.c####.com

HTTP GET requests:

a####.mnw.cn/share/weixin_config.php?url=####
a####.mnw.cn/stat.php?app=####&controller=####&action=####&jsoncallback=...
box.jom####.com/it/u=115328535,222380918&fm=76
box.jom####.com/it/u=1156333043,1530906062&fm=76
box.jom####.com/it/u=1167032421,2516569385&fm=85&app=2&f=JPEG?w=####&h=#...
box.jom####.com/it/u=1212882062,1690962817&fm=76
box.jom####.com/it/u=137959412,298276258&fm=76
box.jom####.com/it/u=1380474023,1558497845&fm=76
box.jom####.com/it/u=14227813,1707185245&fm=76
box.jom####.com/it/u=1425446014,3747818297&fm=76
box.jom####.com/it/u=143890403,3878975986&fm=76
box.jom####.com/it/u=1577837149,3925418978&fm=76
box.jom####.com/it/u=1592959737,2051554434&fm=76
box.jom####.com/it/u=170227848,2077667417&fm=76
box.jom####.com/it/u=1819452975,2319387143&fm=76
box.jom####.com/it/u=182460848,1538552309&fm=76
box.jom####.com/it/u=1824963568,2603420695&fm=76
box.jom####.com/it/u=1917028771,2243323210&fm=76
box.jom####.com/it/u=191817669,2966227187&fm=76
box.jom####.com/it/u=1926254011,2366719920&fm=76
box.jom####.com/it/u=2073337102,2722025573&fm=85&s=EB13458F44207EB714AC8...
box.jom####.com/it/u=208509117,3263269692&fm=76
box.jom####.com/it/u=230332792,2167023383&fm=76
box.jom####.com/it/u=2356688560,3191705092&fm=76
box.jom####.com/it/u=244008231,4176175672&fm=76
box.jom####.com/it/u=2478733111,3460707823&fm=76
box.jom####.com/it/u=2481985522,2237170415&fm=76
box.jom####.com/it/u=2577399638,3104766432&fm=76
box.jom####.com/it/u=2582690745,3125594465&fm=76
box.jom####.com/it/u=265859916,1662348378&fm=76
box.jom####.com/it/u=272968580,3065198617&fm=76
box.jom####.com/it/u=2755584431,1129246769&fm=76
box.jom####.com/it/u=2804491576,843979835&fm=76
box.jom####.com/it/u=282271226,204526767&fm=76
box.jom####.com/it/u=2868965477,3307053804&fm=76
box.jom####.com/it/u=2902386774,2034853982&fm=76
box.jom####.com/it/u=2962259408,3125672836&fm=76
box.jom####.com/it/u=3004942923,3302520070&fm=76
box.jom####.com/it/u=310445324,694921658&fm=76
box.jom####.com/it/u=3138743507,3728806229&fm=76
box.jom####.com/it/u=3207100922,2947870568&fm=76
box.jom####.com/it/u=3240398336,3389615642&fm=76
box.jom####.com/it/u=326561860,3824299582&fm=76
box.jom####.com/it/u=3335963470,2980791554&fm=76
box.jom####.com/it/u=3338203536,3614097140&fm=76
box.jom####.com/it/u=338097025,2190016770&fm=76
box.jom####.com/it/u=3409019002,3768345488&fm=76
box.jom####.com/it/u=352366022,3202084841&fm=76
box.jom####.com/it/u=3609535856,4134694241&fm=76
box.jom####.com/it/u=362552100,3308572158&fm=76
box.jom####.com/it/u=3665535325,3822996823&fm=76
box.jom####.com/it/u=3677229935,3861017593&fm=76
box.jom####.com/it/u=3840926354,4017304945&fm=76
box.jom####.com/it/u=397187382,2125601513&fm=76
box.jom####.com/it/u=4019669016,1152596053&fm=76
box.jom####.com/it/u=4090523315,4205237302&fm=76
box.jom####.com/it/u=4111294463,800650790&fm=76
box.jom####.com/it/u=416099583,2170993079&fm=76
box.jom####.com/it/u=4198494657,1559579554&fm=76
box.jom####.com/it/u=4217571386,1613213634&fm=76
box.jom####.com/it/u=4244025284,1300786779&fm=76
box.jom####.com/it/u=4274608525,1507073155&fm=76
box.jom####.com/it/u=439814094,3218006628&fm=76
box.jom####.com/it/u=444041928,3302823438&fm=76
box.jom####.com/it/u=506370248,2407249221&fm=76
box.jom####.com/it/u=518869138,4176473259&fm=76
box.jom####.com/it/u=526698023,3413048942&fm=76
box.jom####.com/it/u=532645031,3911915710&fm=76
box.jom####.com/it/u=573611691,3213343411&fm=76
box.jom####.com/it/u=5871021,1294843693&fm=76
box.jom####.com/it/u=589546862,2241888480&fm=76
box.jom####.com/it/u=597068059,1774618764&fm=76
box.jom####.com/it/u=64422092,1968328821&fm=76
box.jom####.com/it/u=704438683,3281331795&fm=76
box.jom####.com/it/u=72506108,1949106642&fm=76
box.jom####.com/it/u=735823441,4040288244&fm=76
box.jom####.com/it/u=748813502,4133817067&fm=76
box.jom####.com/it/u=78531821,1861842175&fm=76
box.jom####.com/it/u=829564793,3923717155&fm=85&app=2&f=JPEG?w=####&h=##...
box.jom####.com/it/u=861567632,4255134222&fm=76
box.jom####.com/it/u=890144760,1344736620&fm=76
box.jom####.com/it/u=911557225,1350274063&fm=76
box.jom####.com/it/u=928769438,1774876841&fm=76
c####.baidust####.com/cpro/ui/cm.js
c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
c####.baidust####.com/cpro/ui/pr.js
c####.baidust####.com/sync.htm?cproid=####
c####.jd.com/du?&baidu_error=####&timestamp=####
c####.jd.com/du?&baidu_user_id=####&cookie_version=####&timestamp=####&e...
c.c####.com/c.php?id=####
c.c####.com/core.php?web_id=####&t=####
c.c####.com/stat.php?id=####&web_id=####
cm.g.doublec####.net/pixel?google_nid=####&googl####
cm.g.doublec####.net/pixel?google_nid=####&google_cm=####&google_tc=####
cm.pos.b####.com/allyes?allyes_id=####&allyes_cver=####&extra=####
cm.pos.b####.com/gpixel?google_error=####
cm.pos.b####.com/pixel?dspid=####
cm.qt####.com/pixel?allyes_dspid=####&allye####&extra=####
dup.baidust####.com/js/os.js
g####.d.cg/js/forum-1.js
g####.d.cg/m.js
gm.mm####.com/9.gif?abc=####&rnd=####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.js?14819a5####
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
j.ba####.cn/avnkbbdsn.js
j.ba####.cn/bvzdlc.js
j.ba####.cn/ezroffhvb.js
j.ba####.cn/hcrkludlb.js
j.ba####.cn/lgvovcdvo.js
m.mnw.cn.####.com/
m.mnw.cn.####.com/news/top/
m.mnw.cn.####.com/photo/
m.mnw.cn.####.com/style/come.jpg
m.mnw.cn.####.com/style/jquery.min.js
m.mnw.cn.####.com/yule/
m.ta####.com/?sprefer=####
map####.y####.com.cn/s/mapping/?baidu_error=####&timestamp=####
map####.y####.com.cn/s/mapping/?baidu_user_id=####&cookie_version=####&t...
nsc####.b####.com/v.gif?pid=####&type=####&sign=####&desturl=####&linkid...
pos.b####.com/gcrm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/gcrm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/kchm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/kchm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/ocjm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/ocjm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/ocum?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/ocum?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cce=####&ant=####&dri...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cce=####&drs=####&ccd...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cce=####&exps=####&tl...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cfv=####&pss=####&ti=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cja=####&dc=####&pis=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cpl=####&tcn=####&dai...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cpl=####&tlm=####&cce...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&dc=####&psr=####&ti=#...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&dis=####&ti=####&pss=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&dtm=####&exps=####&ps...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&dtm=####&tpr=####&dis...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&par=####&chi=####&dis...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&par=####&cmi=####&ti=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&par=####&pcs=####&tcn...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&psr=####&tpr=####&dis...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&tlm=####&dtm=####&cec...
pos.b####.com/sync_pos.htm?cproid=####
pos.b####.com/sync_pos.htm?cproid=####&t=####
pos.b####.com/vcam?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/vcam?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/zcnm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
q.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
s####.jom####.com/static/api/css/select_share.css?v=####
s####.jom####.com/static/api/css/share_popup.css?v=####
s####.jom####.com/static/api/css/share_style0_16.css?v=####
s####.jom####.com/static/api/img/share/icons_0_16.png?v=####
s####.jom####.com/static/api/img/share/selectshare_close.png?v=####
s####.jom####.com/static/api/img/share/share-search-icon.png
s####.jom####.com/static/api/js/base/tangram.js?v=####
s####.jom####.com/static/api/js/component/partners.js?v=####
s####.jom####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
s####.jom####.com/static/api/js/share/api_base.js
s####.jom####.com/static/api/js/share/image_api.js
s####.jom####.com/static/api/js/share/select_api.js
s####.jom####.com/static/api/js/share/share_api.js?v=####
s####.jom####.com/static/api/js/trans/logger.js?v=####
s####.jom####.com/static/api/js/view/image_view.js
s####.jom####.com/static/api/js/view/select_view.js?v=####
s####.jom####.com/static/api/js/view/share_view.js?v=####
s####.jom####.com/static/api/js/view/view_base.js
s####.jom####.com/v.gif
s####.tc.qq.com/open/js/jweixin-1.0.0.js
s.c####.b####.com/s.htm?cproid=####&t=####
up####.mnw.cn.####.com/
up####.mnw.cn.####.com//2017/1016/1508121972975.jpg
up####.mnw.cn.####.com/2017/0925/1506300453487.jpg
up####.mnw.cn.####.com/2017/0925/1506300699294.jpg
up####.mnw.cn.####.com/2017/0925/1506301693116.jpg
up####.mnw.cn.####.com/2017/0928/1506558287395.jpg
up####.mnw.cn.####.com/2017/0929/1506677121337.jpg
up####.mnw.cn.####.com/2017/0929/1506677302101.jpg
up####.mnw.cn.####.com/2017/1017/1508212547705.jpg
up####.mnw.cn.####.com/2017/1121/1511230766464.jpg
up####.mnw.cn.####.com/2017/1225/1514195994905.jpg
up####.mnw.cn.####.com/2018/0109/1515479781703.jpg
up####.mnw.cn.####.com/2018/0414/thumb_120_70_1523677467966.jpg
up####.mnw.cn.####.com/2018/0420/1524186959931.jpg
up####.mnw.cn.####.com/2018/0421/1524289457553.jpg
up####.mnw.cn.####.com/2018/0422/1524359020112.jpg
up####.mnw.cn.####.com/2018/0422/1524391034220.png
up####.mnw.cn.####.com/2018/0423/1524446378358.jpg
up####.mnw.cn.####.com/2018/0423/1524450722856.jpg
up####.mnw.cn.####.com/2018/0424/1524528706980.jpg
up####.mnw.cn.####.com/2018/0424/1524531394567.jpg
up####.mnw.cn.####.com/2018/0424/1524533466969.jpg
up####.mnw.cn.####.com/2018/0424/1524533486288.jpg
up####.mnw.cn.####.com/2018/0424/1524535901720.jpg
up####.mnw.cn.####.com/2018/0424/1524539426810.jpg
up####.mnw.cn.####.com/2018/0424/1524539979144.jpg
up####.mnw.cn.####.com/2018/0424/1524539979532.jpg
up####.mnw.cn.####.com/2018/0424/1524539979665.jpg
up####.mnw.cn.####.com/2018/0424/1524539979729.jpg
up####.mnw.cn.####.com/2018/0424/1524539979756.jpg
up####.mnw.cn.####.com/2018/0424/1524549563102.jpg
up####.mnw.cn.####.com/2018/0424/1524566248619.jpg
up####.mnw.cn.####.com/2018/0425/1524613827567.jpg
up####.mnw.cn.####.com/2018/0425/1524613831526.jpg
up####.mnw.cn.####.com/2018/0425/1524613838213.jpg
up####.mnw.cn.####.com/2018/0425/1524613844206.jpg
up####.mnw.cn.####.com/2018/0425/1524613851624.jpg
up####.mnw.cn.####.com/2018/0425/1524616207891.jpg
up####.mnw.cn.####.com/2018/0425/1524616634214.jpg
up####.mnw.cn.####.com/2018/0425/1524617633702.jpg
up####.mnw.cn.####.com/2018/0425/1524617689444.jpg
up####.mnw.cn.####.com/2018/0425/1524617710561.jpg
up####.mnw.cn.####.com/2018/0425/1524617729655.jpg
up####.mnw.cn.####.com/2018/0425/1524618139111.jpg
up####.mnw.cn.####.com/2018/0425/1524618139189.jpg
up####.mnw.cn.####.com/2018/0425/1524618139197.jpg
up####.mnw.cn.####.com/2018/0425/1524618139238.jpg
up####.mnw.cn.####.com/2018/0425/1524618139280.jpg
up####.mnw.cn.####.com/2018/0425/1524618139320.jpg
up####.mnw.cn.####.com/2018/0425/1524618139333.jpg
up####.mnw.cn.####.com/2018/0425/1524618139341.jpg
up####.mnw.cn.####.com/2018/0425/1524618139477.jpg
up####.mnw.cn.####.com/2018/0425/1524618139496.jpg
up####.mnw.cn.####.com/2018/0425/1524618139513.jpg
up####.mnw.cn.####.com/2018/0425/1524618139566.jpg
up####.mnw.cn.####.com/2018/0425/1524618139736.jpg
up####.mnw.cn.####.com/2018/0425/1524618139744.jpg
up####.mnw.cn.####.com/2018/0425/1524618139810.jpg
up####.mnw.cn.####.com/2018/0425/1524618139842.jpg
up####.mnw.cn.####.com/2018/0425/1524618139920.jpg
up####.mnw.cn.####.com/2018/0425/1524618352247.jpg
up####.mnw.cn.####.com/2018/0425/1524618380129.jpg
up####.mnw.cn.####.com/2018/0425/1524618400700.jpg
up####.mnw.cn.####.com/2018/0425/1524618711351.jpg
up####.mnw.cn.####.com/2018/0425/1524618729589.jpg
up####.mnw.cn.####.com/2018/0425/1524619927752.jpg
up####.mnw.cn.####.com/2018/0425/1524619946233.jpg
up####.mnw.cn.####.com/2018/0425/1524621863672.jpg
up####.mnw.cn.####.com/2018/0425/1524625243829.jpg
up####.mnw.cn.####.com/2018/0425/1524625986507.png
up####.mnw.cn.####.com/2018/0425/1524627437685.jpeg
up####.mnw.cn.####.com/2018/0425/1524628035421.jpg
up####.mnw.cn.####.com/2018/0425/1524628119334.jpg
up####.mnw.cn.####.com/2018/0425/1524628745947.jpg
up####.mnw.cn.####.com/2018/0425/1524639569977.jpg
up####.mnw.cn.####.com/2018/0425/1524640376690.jpg
up####.mnw.cn.####.com/2018/0425/1524640378340.jpg
up####.mnw.cn.####.com/2018/0425/1524640382977.jpg
up####.mnw.cn.####.com/2018/0425/1524640389840.jpg
up####.mnw.cn.####.com/2018/0425/1524640821924.jpg
up####.mnw.cn.####.com/2018/0425/1524641953306.jpg
up####.mnw.cn.####.com/2018/0425/1524644169579.jpg
up####.mnw.cn.####.com/2018/0425/1524644196881.jpg
up####.mnw.cn.####.com/2018/0425/thumb_120_70_1524644169579.jpg
up####.mnw.cn.####.com/ad/baidu/20B5L.js
up####.mnw.cn.####.com/edu/
up####.mnw.cn.####.com/js/config.js
up####.mnw.cn.####.com/news/
up####.mnw.cn.####.com/news/fj/1984132.html
up####.mnw.cn.####.com/news/top/1984135.html
up####.mnw.cn.####.com/news/world/
up####.mnw.cn.####.com/quanzhou/licheng/1983561.html
up####.mnw.cn.####.com/style/flip.js
up####.mnw.cn.####.com/style/logo.jpg
up####.mnw.cn.####.com/style/menu.png
up####.mnw.cn.####.com/style/more.jpg
up####.mnw.cn.####.com/style/ser.jpg
up####.mnw.cn.####.com/style/wap_2016.css
up####.mnw.cn.####.com/style/wap_2017.css?v=####
up####.mnw.cn.####.com/wap/style/css/content.css?v=####
up####.mnw.cn.####.com/wap/style/images/logo.png
up####.mnw.cn.####.com/wap/style/images/menu.png
up####.mnw.cn.####.com/wap/style/js/baseFontSize.js
wap.n.sh####.com/sdk/c.js?appid=####
wap.n.sh####.com/tcbox?service=####&action=####&data=####
wn.pos.b####.com/adx.php?c=####
www.ta####.com/
z####.b####.com/customer_search/api/rs?sid=####&plate_url=####&t=####
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
zha####.b####.com/api/customsearch/click?logid=0&version=0&prod_id=rp&pl...
zha####.b####.com/cse/search?s=####&loc=####&width=####&isIframe=####&re...
zha####.b####.com/static/css/mobileDefault.css?v=####
zha####.b####.com/static/img/cse.gif?url=http://so.mnw.cn/cse/search?s=#...
zha####.b####.com/static/img/fdj3.png
zha####.b####.com/static/img/remove.gif
zha####.b####.com/static/js/baidu-ajax.js
zha####.b####.com/static/js/jquery-1.7.2.min.js
zha####.b####.com/static/js/statistic.js

HTTP POST requests:

plg.abcdse####.com:7901/pl/config

Modified file system:

Creates the following files:

/data/data/####/3129362.jar
/data/data/####/3129419.jar
/data/data/####/3129436.jar
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/f_00003e
/data/data/####/f_00003f
/data/data/####/f_000040
/data/data/####/f_000041
/data/data/####/f_000042
/data/data/####/f_000043
/data/data/####/f_000044
/data/data/####/f_000045
/data/data/####/f_000046
/data/data/####/f_000047
/data/data/####/f_000048
/data/data/####/f_000049
/data/data/####/f_00004a
/data/data/####/f_00004b
/data/data/####/f_00004c
/data/data/####/f_00004d
/data/data/####/f_00004e
/data/data/####/f_00004f
/data/data/####/f_000050
/data/data/####/f_000051
/data/data/####/f_000052
/data/data/####/f_000053
/data/data/####/f_000054
/data/data/####/f_000055
/data/data/####/f_000056
/data/data/####/f_000057
/data/data/####/f_000058
/data/data/####/f_000059
/data/data/####/f_00005a
/data/data/####/f_00005b
/data/data/####/f_00005c
/data/data/####/f_00005d
/data/data/####/f_00005e
/data/data/####/f_00005f
/data/data/####/f_000060
/data/data/####/f_000061
/data/data/####/f_000062
/data/data/####/f_000063
/data/data/####/f_000064
/data/data/####/f_000065
/data/data/####/f_000066
/data/data/####/f_000067
/data/data/####/f_000068
/data/data/####/f_000069
/data/data/####/f_000069 (deleted)
/data/data/####/f_00006a
/data/data/####/f_00006a (deleted)
/data/data/####/f_00006b
/data/data/####/f_00006b (deleted)
/data/data/####/f_00006c
/data/data/####/f_00006d
/data/data/####/f_00006e
/data/data/####/f_00006f
/data/data/####/f_000070
/data/data/####/f_000071
/data/data/####/f_000072
/data/data/####/f_000073
/data/data/####/f_000074
/data/data/####/f_000075
/data/data/####/f_000076
/data/data/####/f_000077
/data/data/####/f_000078
/data/data/####/f_000079
/data/data/####/f_00007a
/data/data/####/f_00007b
/data/data/####/f_00007c
/data/data/####/index
/data/data/####/monitor.so
/data/data/####/web1.jar
/data/data/####/web2035.temp
/data/data/####/web2035.temp (deleted)
/data/data/####/web2092.temp
/data/data/####/web2109.temp
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/79a2520f22b9e1526ff93176029603b8_1.79
/data/media/####/cfg.xml
/data/media/####/plcfg.xml
/data/media/####/webadlist.xml
/data/media/####/webinfo.xml

Miscellaneous:

Loads the following dynamic libraries:

monitor

Uses the following algorithms to encrypt data:

DES-ECB-NoPadding

Uses the following algorithms to decrypt data:

DES-ECB-NoPadding

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial