Android.DownLoader.4809

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.906.origin
Android.DownLoader.909.origin
Android.RemoteCode.256.origin
Android.Triada.4276
Android.Triada.477.origin
Android.Triada.482.origin
Android.Triada.483.origin

Downloads the following detected threats from the Internet:

Android.DownLoader.906.origin
Android.DownLoader.909.origin
Android.Triada.4276

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cdn.info####.me:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) 60.1####.57.72:8080
TCP(HTTP/1.1) ff.s####.com:8080
TCP(HTTP/1.1) jx####.em####.com:10519
TCP(HTTP/1.1) p####.api.adoc####.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) r.ist####.com:8071
TCP(HTTP/1.1) ni####.bugse####.com:3001
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(HTTP/1.1) s####.x####.com.cn:80
TCP(HTTP/1.1) d0.x####.com.cn:80
TCP(HTTP/1.1) d.bjsd####.com:80
TCP(HTTP/1.1) s####.al####.com:80
TCP(HTTP/1.1) 1####.75.92.94:80
TCP(HTTP/1.1) ym####.89####.com:34656
TCP(HTTP/1.1) ott.h####.com:8071
TCP(HTTP/1.1) a.bjsd####.com:80
TCP(HTTP/1.1) cdn.clou####.xyz:80
TCP(HTTP/1.1) ad.l####.com:3001
TCP(HTTP/1.1) yb.bugse####.com:3002
TCP(HTTP/1.1) im####.uc.cn:80
TCP(HTTP/1.1) yun.b####.com:80
TCP(HTTP/1.1) b####.bugse####.com:3001
TCP(HTTP/1.1) 1142864####.cn-hang####.fc.####.com:80
TCP(HTTP/1.1) b####.bugse####.com:80
TCP(HTTP/1.1) yq####.jn####.ltd:80
TCP(HTTP/1.1) i.ist####.com:8071
TCP(HTTP/1.1) qiniust####.jom####.com:80
TCP(HTTP/1.1) ne####.x####.com.cn:80
TCP(HTTP/1.1) api.adoc####.com:80
TCP(HTTP/1.1) sdk####.come2c####.com:80
TCP(HTTP/1.1) xua####.bugse####.com:80
TCP(HTTP/1.1) r1.baiyuns####.com:80
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) ad.l####.com:80
TCP(HTTP/1.1) yb.bugse####.com:80
TCP(HTTP/1.1) 1713464####.cn-hang####.fc.####.com:80
TCP(HTTP/1.1) err.ta####.com:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) www.f####.com:80
TCP(HTTP/1.1) 1####.201.175.19:80
TCP(HTTP/1.1) mh####.b0.a####.com:80
TCP(HTTP/1.1) ni####.bugse####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) etc.jiguang####.com.####.com:80
TCP(HTTP/1.1) api####.tiantia####.com:80
TCP(HTTP/1.1) d####.dd7####.com:80
TCP(HTTP/1.1) down####.baiyuns####.com:80
TCP(HTTP/1.1) sl.ggve####.com:80
TCP(HTTP/1.1) luozias####.b0.a####.com:80
TCP(HTTP/1.1) p.ist####.com:8071
TCP(HTTP/1.1) v.sho####.com:80
TCP(HTTP/1.1) ad.l####.com:3002
TCP(HTTP/1.1) g.cn.miao####.com:80
TCP(HTTP/1.1) ad.l####.com:3000
TCP(HTTP/1.1) co####.ssp.adoc####.com:80
TCP(HTTP/1.1) vvv.focusd####.cn:80
TCP(HTTP/1.1) i####.xca####.com.####.cn:80
TCP(HTTP/1.1) j####.g####.vip:80
TCP(HTTP/1.1) tt####.vni####.com:20147
TCP(HTTP/1.1) ssph####.cn-hang####.log.####.com:80
TCP(HTTP/1.1) b####.bugse####.com:3002
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) b####.bugse####.com:3000
TCP(HTTP/1.1) 1####.75.90.218:80
TCP(HTTP/1.1) pc.b####.com:80
TCP(HTTP/1.1) dl.bu####.vip:80
TCP(HTTP/1.1) cs.and####.com:80
TCP(HTTP/1.1) c####.x####.com.cn:80
TCP(HTTP/1.1) e4####.0r####.com:10293
TCP(HTTP/1.1) ni####.bugse####.com:3002
UDP(NTP) 2.and####.p####.####.org:123
TCP(SSL/3.0) api.c####.info####.cn:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) a####.d####.com:443
TCP(TLS/1.0) err.ta####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) log.mm####.com:443
TCP(TLS/1.0) ad####.cp####.cn:443
TCP(TLS/1.0) et2.wagbr####.adverti####.####.com:443
TCP(TLS/1.0) i####.u####.cn:443
TCP(TLS/1.0) etc.jiguang####.com.####.com:443
TCP(TLS/1.0) p####.ou####.com:4433
TCP(TLS/1.0) i####.d####.com:443
TCP(TLS/1.0) c.fw####.com:8888
TCP(TLS/1.0) api.g####.vip:443
TCP(TLS/1.0) m.u####.cn:443
TCP(TLS/1.0) i####.51.la:443
TCP(TLS/1.0) s####.d####.com:443
TCP(TLS/1.0) p####.api.adoc####.com:443
TCP(TLS/1.0) n####.uc.cn:443
TCP(TLS/1.0) st3.wagbr####.adverti####.####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) b####.face####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) api.c####.info####.cn:443
TCP(TLS/1.0) s####.al####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) im####.uc.cn:443
TCP(TLS/1.0) h####.cn:443
TCP(TLS/1.0) api.adoc####.com:443
TCP(TLS/1.0) api.info####.me:443
TCP gw.adx####.com:8080
TCP 39.97.1####.60:9091
TCP 1####.249.20.4:87
TCP gu####.feiyip####.com:87

DNS requests:

2.and####.p####.####.org
4v####.8m####.com
a####.d####.com
a####.m.sm.cn
a.bjsd####.com
ad####.cp####.cn
ad.l####.com
api####.tiantia####.com
api.adoc####.com
api.c####.info####.cn
api.g####.vip
api.info####.me
api.m2g.adoc####.com
api.yunco####.com
ass####.xca####.com
b####.bugse####.com
b####.bugse####.com
b####.face####.com
c####.mm####.com
c####.s####.com
c####.x####.com.cn
c.c####.com
c.fw####.com
cdn.clou####.xyz
cdn.info####.me
co####.ssp.adoc####.com
cs.and####.com
d####.dd7####.com
d.bjsd####.com
d0.x####.com.cn
dl.bu####.vip
down####.baiyuns####.com
e4####.0r####.com
err.ta####.com
etc.jiguang####.com
fc.b####.com
ff.s####.com
fou####.ta####.com
g.al####.com
g.cn.miao####.com
gu####.feiyip####.com
gw.adx####.com
h####.c####.com
h####.cn
hm.b####.com
i####.51.la
i####.d####.com
i####.u####.cn
i####.x####.com.cn
i####.xca####.com
i####.xca####.com
i.ist####.com
im####.uc.cn
j####.g####.vip
js.x####.com.cn
jx####.em####.com
l####.m.sm.cn
lg.ca####.com
log.mm####.com
m.u####.cn
ma####.m.ta####.com
n####.uc.cn
ne####.x####.com.cn
ni####.bugse####.com
oi####.kenanta####.com
ott.h####.com
p####.api.adoc####.com
p####.b####.com
p####.bugse####.com
p####.ou####.com
p.ist####.com
pc.b####.com
pco####.c####.com
pco####.sm.cn
php.clou####.xyz
php.sho####.com
pv.s####.com
px####.jueco####.com
r.ist####.com
r1.baiyuns####.com
s####.al####.com
s####.d####.com
s####.d####.com
s####.m.sm.cn
s####.x####.com.cn
s13.c####.com
s2.z####.cn
s23.c####.com
s9.c####.com
s96.c####.com
sdk####.come2c####.com
sl.ggve####.com
ssph####.cn-hang####.log.####.com
t.clou####.xyz
tt####.vni####.com
v.sho####.com
vvv.focusd####.cn
w.i####.com
www.f####.com
xua####.bugse####.com
y####.m.sm.cn
yb.bugse####.com
ym####.89####.com
yq####.jn####.ltd
yun.b####.com
z12.c####.com
z2.c####.com
z3.c####.com
z5.c####.com
z6.c####.com
z7.c####.com
z9.c####.com

HTTP GET requests:

1142864####.cn-hang####.fc.####.com/qs/?pa=####
1142864####.cn-hang####.fc.####.com/xqs/?pa=####
1713464####.cn-hang####.fc.####.com/lg/?lg="0E"55si"55"4F"55hsobuXtcl"55...
1713464####.cn-hang####.fc.####.com/lg/?lg="0E"55si"55"4F"55khfcbu"55"5D...
ad.l####.com/ad
ad.l####.com:3000/api?rdtime=####&id=####&osv=####&imei=####&adid=####&m...
ad.l####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adid=####&m...
ad.l####.com:3002/api?osv=####&imei=####&adid=####&mac=####&density=####...
api.adoc####.com/titan/monitor/device_info
b####.bugse####.com/ad
b####.bugse####.com:3000/api?rdtime=####&id=####&osv=####&imei=####&adid...
b####.bugse####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adid...
b####.bugse####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adid...
c####.x####.com.cn/push/adv.php?pid=####&id=####&oid=####&m=####&pv=####...
c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####
cdn.clou####.xyz/jar/365admob.jar
cdn.clou####.xyz/jar/ad367.jar
cdn.clou####.xyz/jar/bixx1126.jar
cdn.clou####.xyz/jar/js1202.jar
cdn.clou####.xyz/jar/la0116huo.jar
cdn.clou####.xyz/jar/so0117.jar
cdn.clou####.xyz/jar/wals0923.jar
cdn.info####.me/files/3ad950fbff616113801785ca55b88e8c
co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
co####.ssp.adoc####.com/api/v2/fwConfig?channelCode=####&version=####
co####.ssp.adoc####.com/api/v2/fwWebviewRatioConfig?channelCode=####&ver...
co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
d####.c####.l####.####.com/TTT052_0015.y
d####.dd7####.com//upload/sdk2/SDK442dex20200106.jar
d####.dd7####.com//upload/sdk2/modex20191212.jar
d####.dd7####.com/upload/plog/mfgz.jar
d####.dd7####.com/upload/sdk2/inlanddex20200114.jar
d####.dd7####.com/upload/sdk2/rq02dex20190829.jar
d####.dd7####.com/upload/sdk2/zawdex20200106.jar
d####.dd7####.com/upload/sdk3/kzddex20191224.jar
d0.x####.com.cn/adpush/push/ad.php?pid=####&pushtype=####&cid=####&style...
d0.x####.com.cn/pvlog/ad_count.php?t=####
dl.bu####.vip/pptv_1.3.jar
dl.bu####.vip/wa_v210.jar
down####.baiyuns####.com/cy.js
down####.baiyuns####.com/jquery.min.js
down####.baiyuns####.com/static/default.css
down####.baiyuns####.com/static/index.js
down####.baiyuns####.com/static/logo.png
err.ta####.com/error1.html?c=404&u=/hz.aplus.taobao.org/app.gif?&cna=uGO...
etc.jiguang####.com.####.com/chijian_qd001.html
etc.jiguang####.com.####.com/chijian_qd001.js
ff.s####.com:8080/ttad/api/getAd/HOoKYok4gMkH1gXDnyW1FQ==
ff.s####.com:8080/ttad/api/jv5/HOoKYok4gMkH1gXDnyW1FQ==/c159657daa503498...
g.cn.miao####.com/x/k=2148838&p=7V9gw&dx=__IPDX__&rt=2&ns=__IP__&ni=__IE...
g.cn.miao####.com/x/k=2153864&p=7WRep&dx=__IPDX__&rt=2&ns=__IP__&ni=__IE...
g.cn.miao####.com/x/k=2153864&p=7WReq&dx=__IPDX__&rt=2&ns=__IP__&ni=__IE...
g.cn.miao####.com/x/k=2153864&p=7WRer&dx=__IPDX__&rt=2&ns=__IP__&ni=__IE...
g.cn.miao####.com/x/k=2153864&p=7WRes&dx=__IPDX__&rt=2&ns=__IP__&ni=__IE...
gm.mm####.com/9.gif?abc=####&rnd=####
i####.xca####.com.####.cn/b105/s10235/m_20180921003549337191204872501.jpg
i####.xca####.com.####.cn/b105/s10235/s_20180330145641401407657471741.jpg
i####.xca####.com.####.cn/b105/s10235/s_20180921003547308319519213413.jpg
i####.xca####.com.####.cn/b105/s10235/s_20180921003549337191204872501.jpg
i####.xca####.com.####.cn/b105/s10235/s_20180921003601037837850283604.jpg
i####.xca####.com.####.cn/b85/s9703/m_20181029113027275239670792231.jpg
i####.xca####.com.####.cn/b85/s9703/s_20181029113027275239670792231.jpg
i####.xca####.com.####.cn/b85/s9703/s_20181029113135004194068137608.jpg
i####.xca####.com.####.cn/b85/s9703/s_20190513115017522730262930905.jpg
i####.xca####.com.####.cn/b85/s9703/s_20190513115121757275403063997.jpg
i####.xca####.com.####.cn/space/f_zyam.jpg
i####.xca####.com.####.cn/space/f_zyjr.jpg
i####.xca####.com.####.cn/space/f_zytf.jpg
i####.xca####.com.####.cn/space/s10612/e09eb5d1429a2b32621485c96e23bb4e....
i####.xca####.com.####.cn/space/s10612/f5553bca88426d7a5306e3c527f4a485....
i####.xca####.com.####.cn/space/s_ddtj.jpg
i####.xca####.com.####.cn/space/s_dlkt.jpg
i####.xca####.com.####.cn/space/s_kbtj.jpg
i####.xca####.com.####.cn/space/s_zyam.jpg
i####.xca####.com.####.cn/space/s_zyjr.jpg
i####.xca####.com.####.cn/space/s_zytf.jpg
im####.uc.cn/ims?kt=####&at=####&key=aHR####&sign=yx####&tv=####&x####
j####.g####.vip/fd.js
j####.g####.vip/ggx3.js
luozias####.b0.a####.com/ip/lw/qd001.html
luozias####.b0.a####.com/ip/lw/qd001.js
mh####.b0.a####.com/ad/jb003.js
mh####.b0.a####.com/sdk/wk_207.html
ne####.x####.com.cn/images/np_ps_bj.jpg
ne####.x####.com.cn/images/r_map.gif
ne####.x####.com.cn/images/rl_bj.gif
ne####.x####.com.cn/js/Jump.js?v=####
ne####.x####.com.cn/jsinclude/jquery.js
ne####.x####.com.cn/new_ol_config1.html
ne####.x####.com.cn/new_ol_news15.html
ne####.x####.com.cn/new_ol_photo13.html
ne####.x####.com.cn/new_ol_photo4.html
ne####.x####.com.cn/new_ol_space8.html
ne####.x####.com.cn/xcarjump/new_jump_other.php
ni####.bugse####.com/ad
ni####.bugse####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adi...
ni####.bugse####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adi...
p####.api.adoc####.com/ip
pc.b####.com/v
pco####.ta####.com/app.gif?&cna=####
qiniust####.jom####.com/common/1.7.2.min.js
qiniust####.jom####.com/source/search/search.r.js?v=####
qiniust####.jom####.com/source/search/search_emptyfns.r.js
qiniust####.jom####.com/source/search/search_exec.r.js?v=####
qiniust####.jom####.com/source/search/search_tpl_c1.r.js?v=####
qiniust####.jom####.com/source/search/search_tpl_c2.r.js?v=####
qiniust####.jom####.com/tools/jq/1.9-nol.js
qiniust####.jom####.com/tools/requirejs/2.3.js?v=####
s####.al####.com/L1/272/6837/static/wap/img/uc-32.png
s####.al####.com/L1/272/6837/static/wap/img/uc.png
s####.x####.com.cn/flow/flow.php?m=####
s####.x####.com.cn/flow/flow.php?t=####
sl.ggve####.com/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ4NjQiOmZhbHNlLCJ...
ssph####.cn-hang####.log.####.com/logstores/system/track_ua.gif?APIVersi...
ti####.c####.l####.####.com/2011newcar/css/space2015fyl.css?version=####
ti####.c####.l####.####.com/2011newcar/images/askbg8.png
ti####.c####.l####.####.com/2011newcar/images/fdbg11.jpg
ti####.c####.l####.####.com/2011newcar/images/first.jpg
ti####.c####.l####.####.com/2011newcar/images/hdbg_03.jpg
ti####.c####.l####.####.com/2011newcar/images/seat5kg.jpg
ti####.c####.l####.####.com/2011newcar/images/seat5pai1.jpg
ti####.c####.l####.####.com/2011newcar/images/seat5pai2.jpg
ti####.c####.l####.####.com/2011newcar/images/seat5pai21.jpg
ti####.c####.l####.####.com/2011newcar/images/seat7icon-n24.png
ti####.c####.l####.####.com/2011newcar/images/second.jpg
ti####.c####.l####.####.com/2011newcar/images/szface.jpg
ti####.c####.l####.####.com/2011newcar/images/topbg.jpg
ti####.c####.l####.####.com/2011newcar/images/wb_btn1.jpg
ti####.c####.l####.####.com/2015/nav/css/channel_nav.css?v=####
ti####.c####.l####.####.com/2015/nav/images/Header_bg.gif?v=####
ti####.c####.l####.####.com/2015/nav/images/xcar_logov@2x.png?v=####
ti####.c####.l####.####.com/2016/DemioModel/css/common.css?version=####
ti####.c####.l####.####.com/2016/DemioModel/css/demion_v1.css?v=####
ti####.c####.l####.####.com/2016/DemioModel/images/200.jpg
ti####.c####.l####.####.com/2016/DemioModel/images/DemioModel.png
ti####.c####.l####.####.com/2016/DemioModel/images/DemioModel.png?v####
ti####.c####.l####.####.com/PicLib/logo/pl1_40.jpg
ti####.c####.l####.####.com/PicLib/logo/pl2_40.jpg
ti####.c####.l####.####.com/min/?f=####&version=####
ti####.c####.l####.####.com/resource/common/statistic/iwt-min.js
ti####.c####.l####.####.com/ss/newsearch/css/search.css
vvv.focusd####.cn/ad/v1/log.action?action=####&package=####&channel=####...
www.f####.com/
xua####.bugse####.com/ad
xua####.bugse####.com/api?rdtime=####&id=####&osv=####&imei=####&adid=##...
yb.bugse####.com/ad
yb.bugse####.com/api?rdtime=####&id=####&osv=####&imei=####&adid=####&ma...
yb.bugse####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adid=##...
yq####.jn####.ltd/c/wlimqseg.zip
yq####.jn####.ltd/one/44236jghgvjhbwyf.zip
yq####.jn####.ltd/zz/442ghffgtrwyf.zip
yun.b####.com/pw/70777777.jpg
yun.b####.com/pw/765f73646b.jpg
yun.b####.com/tz/6173.jpg
yun.b####.com/xpw/736d7373.jx
yun.b####.com/xpw/7563.jx
yun.b####.com/xtz/741535829.ico
z.c####.com/stat.htm?id=####&cnzz_eid=####
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

HTTP POST requests:

a.bjsd####.com/index.php?r=####
api####.tiantia####.com/ads
api.yunco####.com/service/rest
cs.and####.com/ydt826/sv2
d.bjsd####.com/index.php?r=####
e4####.0r####.com:10293/widlth/
i.ist####.com:8071/6.0.2/1510864978/1
jx####.em####.com:10519/ntmili/
jx####.em####.com:10519/qazggd/
jx####.em####.com:10519/xoslvm/
ott.h####.com:8071/api/10
p.ist####.com:8071/1
r.ist####.com:8071/6.0.2/163832107/2
r1.baiyuns####.com/service/rest
sdk####.come2c####.com/v1/project/sdk
tt####.vni####.com:20147/dijc1v/
v.sho####.com/index.php?r=####
ym####.89####.com:34656/aowbg/
ym####.89####.com:34656/ixowf/
ym####.89####.com:34656/qdkle/
ym####.89####.com:34656/rqiea/

File system changes:

Creates the following files:

/data/data/####/.b0637dbb-7ed6-496a-b0bb-e783807d627b
/data/data/####/114219
/data/data/####/1635348846.dex (deleted)
/data/data/####/1635348846.jar
/data/data/####/1635348846.jar (deleted)
/data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
/data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/9618302918.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/IM.xml
/data/data/####/SMF.xml
/data/data/####/WSsTRq.data-journal
/data/data/####/_p.xml
/data/data/####/_sh.xml
/data/data/####/apkseparate.DoubleBackUpDB.db
/data/data/####/apkseparate.DoubleBackUpDB.db-journal
/data/data/####/app.manager-journal
/data/data/####/atai.jar
/data/data/####/c.dat
/data/data/####/c.dat.tm
/data/data/####/cHB0dl8xLjMuamFy.tmp
/data/data/####/cfg.config.service.xml
/data/data/####/cfg.database.ad-journal
/data/data/####/comngeusjdigqhuid.xml
/data/data/####/config.service.xml
/data/data/####/d2FfdjIxMC5qYXI=.tmp
/data/data/####/data.m
/data/data/####/data.zip
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/download.info
/data/data/####/download.tmp
/data/data/####/dwBYC.data-journal
/data/data/####/dwwesGGb.data-journal
/data/data/####/dwwsWs.data-journal
/data/data/####/edghy6trds.xml
/data/data/####/eoaxwqxm.jar
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/f_00003e
/data/data/####/f_00003f
/data/data/####/f_000040
/data/data/####/f_000041
/data/data/####/f_000042
/data/data/####/f_000043
/data/data/####/f_000044
/data/data/####/f_000045
/data/data/####/f_000046
/data/data/####/f_000047
/data/data/####/fty_fer_zcd_testajkl.txt
/data/data/####/fwswsedfrf.data-journal
/data/data/####/fwwsf.xml
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/gwwqedws.data-journal
/data/data/####/http_newcar.xcar.com.cn_0.localstorage-journal
/data/data/####/http_www.fnnbt.com_0.localstorage-journal
/data/data/####/https_m.uczzd.cn_0.localstorage-journal
/data/data/####/https_yz.m.sm.cn_0.localstorage-journal
/data/data/####/https_yz.m.sm.cn_0.localstorage-journal (deleted)
/data/data/####/im.database.ad-journal
/data/data/####/index
/data/data/####/libch
/data/data/####/libcwzdnq.so
/data/data/####/libcwzdnq.so-32
/data/data/####/libcwzdnq.so-64
/data/data/####/lpl.xml
/data/data/####/maclong.xml
/data/data/####/nhgbbpxz.xml
/data/data/####/nhgbbpxz.xml.bak
/data/data/####/oMHea.xml
/data/data/####/oMHea.xml.bak
/data/data/####/ombjhvs.data-journal
/data/data/####/rq_file.xml
/data/data/####/sGFdwf.data-journal
/data/data/####/spu_ti.xml
/data/data/####/sunn.jar
/data/data/####/sunn.tmp (deleted)
/data/data/####/sunn.x
/data/data/####/suytgf.data-journal
/data/data/####/ttff.xml
/data/data/####/ugr5trds.data-journal
/data/data/####/vpef.xml
/data/data/####/wESUTYe.xml
/data/data/####/wWAys.xml
/data/data/####/wWAys.xml.bak
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wiuhgf.xml
/data/data/####/wry6reww322.xml
/data/data/####/wwwsedwwws.xml
/data/data/####/wwwsedwwws.xml.bak
/data/data/####/wwwwx.xml
/data/data/####/yd_config_c.xml
/data/data/####/ywsMJwa.xml
/data/data/####/ywsMJwa.xml.bak
/data/data/####/zrhzaf.png
/data/media/####/.6173.apk
/data/media/####/.70777777.apk
/data/media/####/.765f73646b.apk
/data/media/####/.eiz
/data/media/####/.nid
/data/media/####/.nomedia
/data/media/####/.qosu
/data/media/####/.usdis
/data/media/####/03A1149AD0C3BB08FF3316A3475BA1B9
/data/media/####/080994405B5F97DB28AA509CC05FA2F5.jar
/data/media/####/080994405B5F97DB28AA509CC05FA2F5.temp
/data/media/####/2b0ef4b7755665fcbd73e5a65e6837ad.xml
/data/media/####/6CDE2987B4E4E3A475F2D96F9B35372A.temp
/data/media/####/6CDE2987B4E4E3A475F2D96F9B35372A.zip
/data/media/####/9088D7915D2BC2DEE6562BDECE89F3E2
/data/media/####/961EA7E2036C89A047B08219D658170F
/data/media/####/AC4DA29A2257772085362C088DC64606.jar
/data/media/####/AC4DA29A2257772085362C088DC64606.temp
/data/media/####/SDK442dex20200106.jar
/data/media/####/_pn
/data/media/####/_shn
/data/media/####/date40003000700
/data/media/####/fty_fer_zcd_testajkl.txt
/data/media/####/inlanddex20200114.jar
/data/media/####/js1202.jar
/data/media/####/kzddex20191224.jar
/data/media/####/la0116huo.jar
/data/media/####/mfgz.jar
/data/media/####/modex20191212.jar
/data/media/####/ottpid.txt
/data/media/####/pidfile.txt
/data/media/####/rq02dex20190829.jar
/data/media/####/so0117.jar
/data/media/####/zawdex20200106.jar

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
cat /proc/version
cat /sys/class/net/wlan0/address
getprop

Loads the following dynamic libraries:

httphttps
libch
libcwzdnq

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding
Des-ECB-NoPadding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
Des-ECB-NoPadding
RSA-None-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial