Android.Packed.27817

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.336.origin
Android.Mixi.13.origin
Android.Mixi.16.origin
Android.Triada.1
Android.Triada.133
Android.Xiny.10.origin
Android.Xiny.164.origin
Android.Xiny.166.origin
Android.Xiny.202.origin
Android.Xiny.72.origin
Android.Xiny.73.origin
Android.Xiny.90.origin

Network activity:

Connecting to:

a####.####.com
a####.####.net
ac####.####.COM
androi####.####.com
busi####.####.com
d####.####.com
d239g0z####.####.net
duapps-####.####.com
e####.####.com
en####.####.com
g####.####.com
gpup####.####.com
h####.####.net
i####.####.net
k####.####.com
m####.####.com
newfeat####.####.com
p####.####.com
pl####.####.com
rrx68gi####.####.net
s####.####.com
s####.####.net
ser####.####.com
w####.####.com

HTTP GET requests:

androi####.####.com/index.php/OfferList/getOfferListNew?start=####&limit...
androi####.####.com/postback/getOfferjurl?info=bT####&adc=####
androi####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####...
androi####.####.com/setting/mbr?p=####&hp=####&l=####&c=####&prod=####&s...
g####.####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.####.com/rtf/180562885f3e4c613c5e9844caef22755.slze
gpup####.####.com/rtf/408c223fa967dc4d9933c57041b7f49f.slze
gpup####.####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
gpup####.####.com/rtf/4303e8e0c1feae973da3a9e9f6774365.slze
gpup####.####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
gpup####.####.com/rtf/6115c9af6b1c30917b41f5c378956f40.slze
gpup####.####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
gpup####.####.com/rtf/6408c259f823e8db8ced83ef353a06b4.slze
gpup####.####.com/rtf/806a6b70c891c315e00b5dfd26af42ed.slze

HTTP POST requests:

a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
busi####.####.com/business/active
busi####.####.com/business/click
busi####.####.com/business/download
busi####.####.com/business/impression
d####.####.com/aap.do
m####.####.com/errorview/api/601
p####.####.com:8080/OsService/OsStrategy
pl####.####.com/ad.php
s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
s####.####.com/ggview/rsddateindex
s####.####.com/newservice/newgetApks.action
s####.####.com/newservice/newopenOrSale.action
w####.####.com/newservice/newgetApks.action
w####.####.com/newservice/newopenOrSale.action
w####.####.com:7077/sdk/sd.action?b=####
w####.####.com:8081/sm/sr/re/sy
w####.####.com:8081/sm/sr/rt/ry
w####.####.com:8081/sm/sr/run/hy
w####.####.com:8081/sm/sr/sp/py
w####.####.com:8081/sm/sr/sy/ly

Modified file system:

Creates the following files:

<Package Folder>/app_DEX_OPT/05097758.dex
<Package Folder>/app_DEX_OPT/09060505.dex
<Package Folder>/app_DEX_OPT/19489411.dex
<Package Folder>/app_DEX_OPT/29934314.dex
<Package Folder>/app_DEX_OPT/30608392.dex
<Package Folder>/app_DEX_OPT/31928218.dex
<Package Folder>/app_DEX_OPT/34144864.dex
<Package Folder>/app_DEX_OPT/35711799.dex
<Package Folder>/app_DEX_OPT/41254295.dex
<Package Folder>/app_DEX_OPT/45729721.dex
<Package Folder>/app_DEX_OPT/46677914.dex
<Package Folder>/app_DEX_OPT/52476850.dex
<Package Folder>/app_DEX_OPT/55329253.dex
<Package Folder>/app_DEX_OPT/56762763.dex
<Package Folder>/app_DEX_OPT/57421736.dex
<Package Folder>/app_DEX_OPT/61164836.dex
<Package Folder>/app_DEX_OPT/61802927.dex
<Package Folder>/app_DEX_OPT/66991146.dex
<Package Folder>/app_DEX_OPT/69513572.dex
<Package Folder>/app_DEX_OPT/72259251.dex
<Package Folder>/app_DEX_OPT/76947843.dex
<Package Folder>/app_DEX_OPT/80255393.dex
<Package Folder>/app_DEX_OPT/93988943.dex
<Package Folder>/app_DEX_OPT/94742315.dex
<Package Folder>/app_DEX_OPT/94871184.dex
<Package Folder>/app_DEX_OPT/99320274.dex
<Package Folder>/app_dex/170804123208951.dex
<Package Folder>/app_dex/f0.zip
<Package Folder>/app_odex/f0.dex
<Package Folder>/app_sslcache/h.online-metrix.net.443
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/duspf517.xml
<Package Folder>/com.init.env/####/ebtables_csyp_radish
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1501849939327.zip
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/ps_pcys_hd
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1501849940118.zip
<Package Folder>/databases/Pk.dataBase-journal
<Package Folder>/databases/StaticDataC.dataBase
<Package Folder>/databases/StaticDataC.dataBase-journal
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/ddPk.dataBase-journal
<Package Folder>/databases/gpab.db
<Package Folder>/databases/gpab.db-journal
<Package Folder>/databases/link.dataBase
<Package Folder>/databases/link.dataBase-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/smalldb2
<Package Folder>/databases/smalldb2-journal
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.catr.apk
<Package Folder>/files/####/.center.tapk
<Package Folder>/files/####/.client
<Package Folder>/files/####/.dg
<Package Folder>/files/####/.dico.apk
<Package Folder>/files/####/.dlme.apk
<Package Folder>/files/####/.dlsb.apk
<Package Folder>/files/####/.dsmt.apk
<Package Folder>/files/####/.ir
<Package Folder>/files/####/.p.apk
<Package Folder>/files/####/.service
<Package Folder>/files/####/.ukd
<Package Folder>/files/####/.uks
<Package Folder>/files/####/.uok
<Package Folder>/files/####/05097758.apk
<Package Folder>/files/####/09060505.apk
<Package Folder>/files/####/110011Copy.data
<Package Folder>/files/####/1501849935463.apk
<Package Folder>/files/####/170804123208951.apk
<Package Folder>/files/####/170804123208951.apk (deleted)
<Package Folder>/files/####/19489411.apk
<Package Folder>/files/####/2016082319911
<Package Folder>/files/####/29934314.apk
<Package Folder>/files/####/30608392.apk
<Package Folder>/files/####/31928218.apk
<Package Folder>/files/####/34144864.apk
<Package Folder>/files/####/35711799.apk
<Package Folder>/files/####/41254295.apk
<Package Folder>/files/####/45729721.apk
<Package Folder>/files/####/46677914.apk
<Package Folder>/files/####/52476850.apk
<Package Folder>/files/####/55329253.apk
<Package Folder>/files/####/56762763.apk
<Package Folder>/files/####/57421736.apk
<Package Folder>/files/####/5f79d63143102423ac148986c2ae37a0.data.temp
<Package Folder>/files/####/61164836.apk
<Package Folder>/files/####/61802927.apk
<Package Folder>/files/####/66991146.apk
<Package Folder>/files/####/69513572.apk
<Package Folder>/files/####/72259251.apk
<Package Folder>/files/####/76947843.apk
<Package Folder>/files/####/80255393.apk
<Package Folder>/files/####/93988943.apk
<Package Folder>/files/####/94742315.apk
<Package Folder>/files/####/94871184.apk
<Package Folder>/files/####/99320274.apk
<Package Folder>/files/####/N2023.data
<Package Folder>/files/####/N2025.data
<Package Folder>/files/####/N2026.data
<Package Folder>/files/####/N2029.data
<Package Folder>/files/####/N2030.data
<Package Folder>/files/####/N2031.data
<Package Folder>/files/####/N2040.data
<Package Folder>/files/####/N2043.data
<Package Folder>/files/####/N2044.data
<Package Folder>/files/####/N2045.data
<Package Folder>/files/####/N2046.data
<Package Folder>/files/####/N2048.data
<Package Folder>/files/####/N2050.data
<Package Folder>/files/####/N2051.data
<Package Folder>/files/####/N2058.data
<Package Folder>/files/####/N2061.data
<Package Folder>/files/####/a.xml
<Package Folder>/files/####/ac.jar
<Package Folder>/files/####/ac.jar.tmp
<Package Folder>/files/####/b.png
<Package Folder>/files/####/busybox
<Package Folder>/files/####/checkFile0
<Package Folder>/files/####/dz_p866.data
<Package Folder>/files/####/dz_p868.data
<Package Folder>/files/####/env201707251650.data
<Package Folder>/files/####/gp41.data
<Package Folder>/files/####/mkdevsh
<Package Folder>/files/####/myshell
<Package Folder>/files/####/p_dzpg48.data
<Package Folder>/files/####/p_dzsd45.data
<Package Folder>/files/####/p_dzwk44.data
<Package Folder>/files/####/r1
<Package Folder>/files/####/r2
<Package Folder>/files/####/r3
<Package Folder>/files/####/r4
<Package Folder>/files/####/rl23.data
<Package Folder>/files/####/rs40.data
<Package Folder>/files/####/rsh
<Package Folder>/files/####/rt8
<Package Folder>/files/####/supolicy
<Package Folder>/files/####/ym43.data
<Package Folder>/files/.flurryagent.63f56a47
<Package Folder>/files/.imprint
<Package Folder>/files/5f79d63143102423ac148986c2ae37a0.data
<Package Folder>/files/aps.db
<Package Folder>/files/frtv
<Package Folder>/files/frtv.dex
<Package Folder>/files/frtv.jar
<Package Folder>/files/mcxr.png
<Package Folder>/files/mobclick_agent_cached_<Package>6000
<Package Folder>/files/native_service
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/userstate.txt
<Package Folder>/p.dz866/####/ODY2ZXhl
<Package Folder>/p.dz866/####/ODY2ZXhl1501849965602.zip
<Package Folder>/p.dz866/####/ZGV4ZXoy
<Package Folder>/p.dz866/####/ZGV4ZXoy1501849964890.zip
<Package Folder>/p.dz866/####/error
<Package Folder>/p.dz868/####/ODY4X2V4
<Package Folder>/p.dz868/####/ODY4X2V41501849971854.zip
<Package Folder>/p.dz868/####/error
<Package Folder>/p.dzpg48/####/ZDExMDN6
<Package Folder>/p.dzpg48/####/ZDExMDN61501850004352.zip
<Package Folder>/p.dzpg48/####/error
<Package Folder>/p.dzsd45/####/ZVhWdGFXVXpNZz09
<Package Folder>/p.dzsd45/####/ZVhWdGFXVXpNZz091501849990530.zip
<Package Folder>/p.dzsd45/####/error
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk9
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk91501849998771.zip
<Package Folder>/p.dzwk44/####/error
<Package Folder>/p.gp41/####/.md
<Package Folder>/p.gp41/####/1501850008390.jar
<Package Folder>/p.gp41/####/2A63DF2C983CE370A9205B913A7F4B45
<Package Folder>/p.gp41/####/3C009D66CAABD433CCD1D841E6AF0BF3
<Package Folder>/p.gp41/####/408.jar
<Package Folder>/p.gp41/####/421.jar
<Package Folder>/p.gp41/####/4AB712239B2BDBC7C0FFCE3039D3C027
<Package Folder>/p.gp41/####/610.jar
<Package Folder>/p.gp41/####/617.jar
<Package Folder>/p.gp41/####/640.jar
<Package Folder>/p.gp41/####/834C8EAFCA3DB238A4EF547DDC644C6B
<Package Folder>/p.gp41/####/B11C222F5B18FADD2FFA4C70E35F4AC8
<Package Folder>/p.gp41/####/E8EE0B0E8C98EFCC1566F520B5CF12B0
<Package Folder>/p.gp41/####/forever.sh
<Package Folder>/p.gp41/####/gpdu
<Package Folder>/p.gp41/####/p.gp41_preferences.xml
<Package Folder>/p.gp41/####/p.gp41_preferences.xml.bak
<Package Folder>/p.gp41/####/test
<Package Folder>/p.rl23/####/cnVuc2hlbGwy
<Package Folder>/p.rl23/####/cnVuc2hlbGwy1501849953023.zip
<Package Folder>/p.rl23/####/forever.sh
<Package Folder>/p.sr40/####/cnVuc2hlbGwy
<Package Folder>/p.sr40/####/cnVuc2hlbGwy1501849941666.zip
<Package Folder>/p.sr40/####/forever.sh
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh5
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh51501849955072.zip
<Package Folder>/p.ym43/####/forever.sh
<Package Folder>/shared_prefs/.dmgames_prefs.xml
<Package Folder>/shared_prefs/.dmgames_prefs.xml.bak
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160218.xml
<Package Folder>/shared_prefs/20160218.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/CUID.xml
<Package Folder>/shared_prefs/CookiePrefsFile.xml
<Package Folder>/shared_prefs/Oveead.xml
<Package Folder>/shared_prefs/OverseaSDK.xml
<Package Folder>/shared_prefs/OverseaSDK.xml.bak
<Package Folder>/shared_prefs/SponsorPayAdvertiserState.xml
<Package Folder>/shared_prefs/SponsorPayPublisherState.xml
<Package Folder>/shared_prefs/ThreatMetrixMobileSDK.xml
<Package Folder>/shared_prefs/ai.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apsad.xml.bak
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/data_statistical.xml
<Package Folder>/shared_prefs/data_statistical.xml.bak
<Package Folder>/shared_prefs/gfprf.xml
<Package Folder>/shared_prefs/gfprf.xml.bak
<Package Folder>/shared_prefs/googleda.xml
<Package Folder>/shared_prefs/gpac.xml
<Package Folder>/shared_prefs/kksdk.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/moertry.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/xapcinfo.xml
<Package Folder>/update.dex
<SD-Card>/.adslib/com.joyjia.ring@1.apk
<SD-Card>/.androidsystem/####/files.db
<SD-Card>/.androidsystem/1d0bc90adba92c34018b37cbf2cdeb65.jpg
<SD-Card>/.androidsystem/8cae814dc50fd532e626afe2bbbab2d3.jpg
<SD-Card>/.androidsystem/8fef497989fc8a12d9dfa27415e03962.jpg
<SD-Card>/.dmplatform/####/aHR0cDovL2QyMzlnMHo2N2pjdGVkLmNsb3VkZnJvbnQubmV0L2ljb25zL2ljb25fS25pZmVGbGlwLnBuZw==
<SD-Card>/APPMarket/####/420154211.jpg.tmp
<SD-Card>/Android/####/update.jar
<SD-Card>/app/####/appChannel
<SD-Card>/baidu/####/journal
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid
<SD-Card>/cpf/cpf.txt
<SD-Card>/test
<SD-Card>/userstate.txt

Miscellaneous:

Executes next shell scripts:

.hulu
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh ./mkdevsh
/system/bin/sh <Package Folder>/files/.snow/.zip/rsh
<Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
<Package Folder>/p.gp41/files/.play/test <Package Folder>/p.gp41/files/.play/ e4e9bd1629b64d73b7c51387df1e1406
app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
app_process /system/bin com.android.commands.pm.Pm disable com.master.main.yaogirl.longe.wei
app_process /system/bin com.android.commands.pm.Pm disable com.qiu.qing.bing.shuo.tu
app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
app_process /system/bin com.android.commands.pm.Pm disable com.slave.wuw.yiyi.ranran.fang
app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
app_process /system/bin com.android.commands.pm.Pm enable com.master.main.yaogirl.longe.wei
app_process /system/bin com.android.commands.pm.Pm enable com.qiu.qing.bing.shuo.tu
app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
app_process /system/bin com.android.commands.pm.Pm enable com.slave.wuw.yiyi.ranran.fang
chcon u:object_r:system_file:s0 /system/bin/.author
chcon u:object_r:system_file:s0 /system/bin/debuggerd
chcon u:object_r:system_file:s0 /system/lib/libsoon.so
chcon u:object_r:system_file:s0 /system/xbin/.ci.pm
chcon u:object_r:system_file:s0 /system/xbin/.cp
chcon u:object_r:system_file:s0 /system/xbin/.rainin
chcon u:object_r:system_file:s0 /system/xbin/supolicy
chmod 0755 <Package Folder>/com.init.env
chmod 0771 <Package Folder>/p.gp41/.syslib-
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dz866/files/ODY2ZXhl
chmod 0777 <Package Folder>/p.dz866/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dz866/files/error
chmod 0777 <Package Folder>/p.dz868/files/ODY4X2V4
chmod 0777 <Package Folder>/p.dz868/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dz868/files/error
chmod 0777 <Package Folder>/p.dzpg48/files/ZDExMDN6
chmod 0777 <Package Folder>/p.dzpg48/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzpg48/files/error
chmod 0777 <Package Folder>/p.dzsd45/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzsd45/files/ZVhWdGFXVXpNZz09
chmod 0777 <Package Folder>/p.dzsd45/files/error
chmod 0777 <Package Folder>/p.dzwk44/files/ZDJsdWEyeGxNekk9
chmod 0777 <Package Folder>/p.dzwk44/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzwk44/files/error
chmod 0777 <Package Folder>/p.gp41/files/forever.sh
chmod 0777 <Package Folder>/p.rl23/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.rl23/files/forever.sh
chmod 0777 <Package Folder>/p.sr40/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.sr40/files/forever.sh
chmod 0777 <Package Folder>/p.ym43/files/Wlhod1gzbDFiVjh5
chmod 0777 <Package Folder>/p.ym43/files/forever.sh
chmod 770 <Package Folder>/p.gp41/files/.play/test
chmod 777 <Package Folder>/files/.snow/.catr.apk
chmod 777 <Package Folder>/files/.snow/.client
chmod 777 <Package Folder>/files/.snow/.dg
chmod 777 <Package Folder>/files/.snow/.rshs
chmod 777 <Package Folder>/files/.snow/.service
chmod 777 <Package Folder>/files/.snow/.ukd
chmod 777 <Package Folder>/files/.snow/.uks
chmod 777 <Package Folder>/files/.snow/.uok
chmod 777 <Package Folder>/files/.snow/.zip/
chmod 777 <Package Folder>/files/.snow/.zip/boy
chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
chmod 777 <Package Folder>/files/.snow/.zip/post.sh
chmod 777 <Package Folder>/files/.snow/.zip/r1
chmod 777 <Package Folder>/files/.snow/.zip/r2
chmod 777 <Package Folder>/files/.snow/.zip/r3
chmod 777 <Package Folder>/files/.snow/.zip/r4
chmod 777 <Package Folder>/files/.snow/.zip/rsh
chmod 777 <Package Folder>/files/.snow/.zip/rt8
chmod 777 <Package Folder>/files/.snow/a.xml
chmod 777 <Package Folder>/files/.snow/b.png
chmod 777 <Package Folder>/files/.snow/busybox
chmod 777 <Package Folder>/files/.snow/ex0
chmod 777 <Package Folder>/files/.snow/myshell
chmod 777 <Package Folder>/files/.snow/supolicy
chmod 777 <Package Folder>/files/.work/postroot.sh
chown 0.0 /data/local/tmp/.catr.apk
chown 0.0 /data/local/tmp/busybox
chown 0.0 /system/app/Dingps.apk
chown 0.0 /system/app/Linkcai.apk
chown 0.0 /system/app/Lowerp.apk
chown 0.0 /system/app/MainMaster.apk
chown 0.0 /system/app/WelSlave.apk
chown 0.0 /system/app/oneshs.apk
chown 0.0 /system/bin/.author
chown 0.0 /system/bin/debuggerd
chown 0.0 /system/lib/libsoon.so
chown 0.0 /system/xbin/.ci.pm
chown 0.0 /system/xbin/.cp
chown 0.0 /system/xbin/.rainin
chown 0.0 /system/xbin/supolicy
chown 0:0 /data/local/tmp/.catr.apk
chown 0:0 /data/local/tmp/busybox
chown 0:0 /system/app/Dingps.apk
chown 0:0 /system/app/Linkcai.apk
chown 0:0 /system/app/Lowerp.apk
chown 0:0 /system/app/MainMaster.apk
chown 0:0 /system/app/WelSlave.apk
chown 0:0 /system/app/oneshs.apk
chown 0:0 /system/bin/.author
chown 0:0 /system/bin/debuggerd
chown 0:0 /system/lib/libsoon.so
chown 0:0 /system/xbin/.ci.pm
chown 0:0 /system/xbin/.cp
chown 0:0 /system/xbin/.rainin
chown 0:0 /system/xbin/supolicy
conbb od2gf04pd9
cufsdosck ac554db364f
cufsmgr eb47495f7bb
df /system
getenforce
getprop
logcat -d -v time
ls -l /system/bin/su
mount -o remount ro /system
mount -o remount rw /system
mount -o remount,ro /system
mount -o remount,rw /system
mount -ro remount ro /system
mount -ro remount,ro /system
mount -wo remount rw /system
mount -wo remount,rw /system
ps_pcys_hd
ps_pcys_hd -c id
rm /system/bin/debuggerd
rm <Package Folder>/files/.snow/.e0.data
rm <Package Folder>/files/.snow/ex0
sh
sh <Package Folder>/p.gp41/files/.play/test <Package Folder>/p.gp41/files/.play/ e4e9bd1629b64d73b7c51387df1e1406
su
syssp -h e4e9bd1629b64d73b7c51387df1e1406 <Package Folder>/p.gp41/.syslib-

Loads the following dynamic libraries:

fasten
mono
trustdefender-jni
unity

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding

Uses elevated priveleges.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial