Android.Packed.37097

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.683.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) 4####.92.62.1:80
TCP(HTTP/1.0) pis.al####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) t.p####.ico####.com:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) pus.al####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) p####.ico####.com:80
TCP(HTTP/1.1) api.s####.mob.com:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) cdn.app.4####.####.com:80
TCP(HTTP/1.1) 7s####.v2.com.####.com:80
TCP(TLS/1.0) gl####.w.kunl####.####.com:443
TCP(TLS/1.0) w####.q####.s####.####.com:443
TCP(TLS/1.0) tinyq####.ove####.b0.####.com:443
TCP(TLS/1.0) pns.al####.com:443
TCP(TLS/1.0) l####.4####.top:443
UDP 1####.168.60.254:4466

DNS requests:

a####.exc.mob.com
a####.u####.com
api.s####.mob.com
c####.comi####.cn
c####.comi####.cn
c####.comi####.cn
cdn.app.4####.top
cdn.game####.org
cdn.ico####.com
l####.4####.top
oc.u####.com
p####.ico####.com
pis.al####.com
pns.al####.com
pss.al####.com
pus.al####.com
t.p####.ico####.com

HTTP GET requests:

7s####.v2.com.####.com/1110_ccover_598233b224e3ee47.jpg?imageVi####
7s####.v2.com.####.com/11568_ccover_ebd0b99f9d63bb1f.jpg?imageVi####
7s####.v2.com.####.com/11878_ccover_37dbea9882d57b94.jpg?imageVi####
7s####.v2.com.####.com/11887_ccover_hp_1de79150d096cfa0.jpg?imageVi####
7s####.v2.com.####.com/11944_ccover_26ea0389f7fa0730.jpg?imageVi####
7s####.v2.com.####.com/11972_ccover_d07c0f53b85a4390.jpg?imageVi####
7s####.v2.com.####.com/12092_ccover_hp_54f2ad0af58b8ade.jpg?imageVi####
7s####.v2.com.####.com/12265_ccover_90c2f2d8b65a2b28.jpg?imageVi####
7s####.v2.com.####.com/12407_ccover_hp_3bf98bda96d12e99.jpg?imageVi####
7s####.v2.com.####.com/12413_ccover_hl_ceee34771229b8df.jpg?imageVi####
7s####.v2.com.####.com/12482_ccover_9cf4f02bdc858319.jpg?imageVi####
7s####.v2.com.####.com/12536_ccover_e7ac9b8d9897c5ef.jpg?imageVi####
7s####.v2.com.####.com/12683_ccover_1e8937631bcabde6.jpg?imageVi####
7s####.v2.com.####.com/12811_ccover_0e036b6052b90573.jpg?imageVi####
7s####.v2.com.####.com/12846_ccover_420e0e4cd6cbf51f.jpg?imageVi####
7s####.v2.com.####.com/12851_ccover_cb5ed053e8946b9d.jpg?imageVi####
7s####.v2.com.####.com/12863_ccover_38361aaa8d720f6e.jpg?imageVi####
7s####.v2.com.####.com/12902_ccover_5349e025b6b7f5a2.jpg?imageVi####
7s####.v2.com.####.com/12946_ccover_ea5c855a265c692e.jpg?imageVi####
7s####.v2.com.####.com/12964_ccover_cb4ffbae818fd4b1.jpg?imageVi####
7s####.v2.com.####.com/12977_1_acover_6c2c799f3ea02ef5.jpg?imageVi####
7s####.v2.com.####.com/12977_2_acover_1bec228dfdda6054.jpg?imageVi####
7s####.v2.com.####.com/12977_3_acover_09f2c48724677e71.jpg?imageVi####
7s####.v2.com.####.com/12977_4_10_42eec25e2312d852.jpg?imageMo####
7s####.v2.com.####.com/12977_4_11_d383a0f61d7f3351.jpg?imageMo####
7s####.v2.com.####.com/12977_4_12_a3d8d51fa657fc2d.jpg?imageMo####
7s####.v2.com.####.com/12977_4_13_b78de6ffdac1a409.jpg?imageMo####
7s####.v2.com.####.com/12977_4_14_52a8c9404ac76301.jpg?imageMo####
7s####.v2.com.####.com/12977_4_15_109fdc4455498487.jpg?imageMo####
7s####.v2.com.####.com/12977_4_16_be977d28477f3aea.jpg?imageMo####
7s####.v2.com.####.com/12977_4_17_ec60c2630f8ba53a.jpg?imageMo####
7s####.v2.com.####.com/12977_4_18_a34772fc58562ac8.jpg?imageMo####
7s####.v2.com.####.com/12977_4_19_66404368bf5630b8.jpg?imageMo####
7s####.v2.com.####.com/12977_4_1_311fd1d3152a5135.jpg?imageMo####
7s####.v2.com.####.com/12977_4_20_8c84c16fedc04c71.jpg?imageMo####
7s####.v2.com.####.com/12977_4_21_472e926365db5ae4.jpg?imageMo####
7s####.v2.com.####.com/12977_4_22_d5dafae0952a1896.jpg?imageMo####
7s####.v2.com.####.com/12977_4_23_f58cfa81af9cec0f.jpg?imageMo####
7s####.v2.com.####.com/12977_4_24_c1c4a2ec08299ff7.jpg?imageMo####
7s####.v2.com.####.com/12977_4_25_feb3c058f690116d.jpg?imageMo####
7s####.v2.com.####.com/12977_4_26_a8c282a065d88ac0.jpg?imageMo####
7s####.v2.com.####.com/12977_4_27_6ab548fc44392839.jpg?imageMo####
7s####.v2.com.####.com/12977_4_28_5aa7cd34b3a9bca7.jpg?imageMo####
7s####.v2.com.####.com/12977_4_29_20f626302f5a7dfa.jpg?imageMo####
7s####.v2.com.####.com/12977_4_2_f6e86f6920326cb3.jpg?imageMo####
7s####.v2.com.####.com/12977_4_30_0503d9440f41e44f.jpg?imageMo####
7s####.v2.com.####.com/12977_4_31_4e4dfb78da6b7c12.jpg?imageMo####
7s####.v2.com.####.com/12977_4_32_8a244316717aa8d7.jpg?imageMo####
7s####.v2.com.####.com/12977_4_33_bd75b8610847b2b5.jpg?imageMo####
7s####.v2.com.####.com/12977_4_34_0761c2ef042c628a.jpg?imageMo####
7s####.v2.com.####.com/12977_4_35_ca113314c1012e63.jpg?imageMo####
7s####.v2.com.####.com/12977_4_36_64c2cc02a382ecbc.jpg?imageMo####
7s####.v2.com.####.com/12977_4_37_fb95853bd76508d5.jpg?imageMo####
7s####.v2.com.####.com/12977_4_38_2a98a12a5a079be1.jpg?imageMo####
7s####.v2.com.####.com/12977_4_39_0c20fc2762f0bf67.jpg?imageMo####
7s####.v2.com.####.com/12977_4_3_8876a6bc4179d4d4.jpg?imageMo####
7s####.v2.com.####.com/12977_4_40_067bdaa2b7b3ddd2.jpg?imageMo####
7s####.v2.com.####.com/12977_4_41_51e461905f96dae2.jpg?imageMo####
7s####.v2.com.####.com/12977_4_42_d37d27d450436e93.jpg?imageMo####
7s####.v2.com.####.com/12977_4_43_47b3bcc456a51287.jpg?imageMo####
7s####.v2.com.####.com/12977_4_44_e57555ba1c2cd620.jpg?imageMo####
7s####.v2.com.####.com/12977_4_45_ebd9e9ea0b4d1926.jpg?imageMo####
7s####.v2.com.####.com/12977_4_46_2535400b7a69eefd.jpg?imageMo####
7s####.v2.com.####.com/12977_4_47_07d564fcb800d3fe.jpg?imageMo####
7s####.v2.com.####.com/12977_4_48_66a3c68f82f90af7.jpg?imageMo####
7s####.v2.com.####.com/12977_4_49_005f568855bbc204.jpg?imageMo####
7s####.v2.com.####.com/12977_4_4_4c31145145b85838.jpg?imageMo####
7s####.v2.com.####.com/12977_4_50_a63f2adb0982dfe0.jpg?imageMo####
7s####.v2.com.####.com/12977_4_51_a13e7e12b737d191.jpg?imageMo####
7s####.v2.com.####.com/12977_4_52_a67fa272e5ea8172.jpg?imageMo####
7s####.v2.com.####.com/12977_4_53_e09b0c668492b0cf.jpg?imageMo####
7s####.v2.com.####.com/12977_4_54_b632d078d51a29a8.jpg?imageMo####
7s####.v2.com.####.com/12977_4_55_af36c9a90fe8487f.jpg?imageMo####
7s####.v2.com.####.com/12977_4_56_c1ad4da42930a285.jpg?imageMo####
7s####.v2.com.####.com/12977_4_57_c742f956b31d66ec.jpg?imageMo####
7s####.v2.com.####.com/12977_4_58_d0f9b948517538a3.jpg?imageMo####
7s####.v2.com.####.com/12977_4_59_4bbf94eb7ba91fd6.jpg?imageMo####
7s####.v2.com.####.com/12977_4_5_c8605267688877e2.jpg?imageMo####
7s####.v2.com.####.com/12977_4_60_4347a97bb05806f7.jpg?imageMo####
7s####.v2.com.####.com/12977_4_61_2ac07d8da38849fc.jpg?imageMo####
7s####.v2.com.####.com/12977_4_62_bc61a9f38cc29f0a.jpg?imageMo####
7s####.v2.com.####.com/12977_4_63_8f944c119cbe045d.jpg?imageMo####
7s####.v2.com.####.com/12977_4_64_e76029a380827d1e.jpg?imageMo####
7s####.v2.com.####.com/12977_4_65_22dc8cf4b7e357af.jpg?imageMo####
7s####.v2.com.####.com/12977_4_66_28752cf6b3d936b0.jpg?imageMo####
7s####.v2.com.####.com/12977_4_67_0265827672cfc67a.jpg?imageMo####
7s####.v2.com.####.com/12977_4_68_d1233cc321ae2dc0.jpg?imageMo####
7s####.v2.com.####.com/12977_4_69_a59d5d9f4811a835.jpg?imageMo####
7s####.v2.com.####.com/12977_4_6_7667bd0e9c75b13e.jpg?imageMo####
7s####.v2.com.####.com/12977_4_70_6c36e535f6610c39.jpg?imageMo####
7s####.v2.com.####.com/12977_4_71_a14db8c91d310e29.jpg?imageMo####
7s####.v2.com.####.com/12977_4_72_2c422612bf0c9442.jpg?imageMo####
7s####.v2.com.####.com/12977_4_73_f6657e135a58753e.jpg?imageMo####
7s####.v2.com.####.com/12977_4_74_4e27520f1768803f.jpg?imageMo####
7s####.v2.com.####.com/12977_4_75_d6b00b63bfcc4556.jpg?imageMo####
7s####.v2.com.####.com/12977_4_76_095c36b51b5a9fbf.jpg?imageMo####
7s####.v2.com.####.com/12977_4_77_e8c7e82f6a4cc403.jpg?imageMo####
7s####.v2.com.####.com/12977_4_78_1a8c26d766f91343.jpg?imageMo####
7s####.v2.com.####.com/12977_4_79_ae7c89f8d1b83928.jpg?imageMo####
7s####.v2.com.####.com/12977_4_7_c0c3d7af77cc9d0f.jpg?imageMo####
7s####.v2.com.####.com/12977_4_80_3940e73de0197d04.jpg?imageMo####
7s####.v2.com.####.com/12977_4_81_25d46388279e6329.jpg?imageMo####
7s####.v2.com.####.com/12977_4_82_39d4af952891b1a2.jpg?imageMo####
7s####.v2.com.####.com/12977_4_83_1b1aabc211d2a813.jpg?imageMo####
7s####.v2.com.####.com/12977_4_84_1245a04e83e32c4f.jpg?imageMo####
7s####.v2.com.####.com/12977_4_85_af90cbd60b06fe22.jpg?imageMo####
7s####.v2.com.####.com/12977_4_86_8265e8d096e4fa1d.jpg?imageMo####
7s####.v2.com.####.com/12977_4_87_ce3d80506dfede4b.jpg?imageMo####
7s####.v2.com.####.com/12977_4_88_a945879e99e56e50.jpg?imageMo####
7s####.v2.com.####.com/12977_4_89_620a71b261788576.jpg?imageMo####
7s####.v2.com.####.com/12977_4_8_99eaa1d06270e333.jpg?imageMo####
7s####.v2.com.####.com/12977_4_90_6c0ac67c02a5e03b.jpg?imageMo####
7s####.v2.com.####.com/12977_4_91_c4ec887de777b6cd.jpg?imageMo####
7s####.v2.com.####.com/12977_4_9_5cb40b0985cf57ea.jpg?imageMo####
7s####.v2.com.####.com/12977_4_acover_22b9f548c2f2fd45.jpg?imageVi####
7s####.v2.com.####.com/12977_5_acover_54916460a48c263f.jpg?imageVi####
7s####.v2.com.####.com/12977_6_acover_6d20b945e42c8f18.jpg?imageVi####
7s####.v2.com.####.com/12977_ccover_38cc6e7e8e40fc36.jpg?imageVi####
7s####.v2.com.####.com/13014_ccover_b7e3a143e921a286.jpg?imageVi####
7s####.v2.com.####.com/13017_ccover_498cbf78050def9e.jpg?imageVi####
7s####.v2.com.####.com/707_ccover_15013fa5afc813ec.jpg?imageVi####
cdn.app.4####.####.com/swenjian/you
cdn.game####.org/strategy/UnknownDev
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/larger4.3
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.game####.org/strategy/symlink-adbd
pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg

HTTP POST requests:

a####.exc.mob.com/errconf
a####.u####.com/app_logs
api.s####.mob.com/conf4
api.s####.mob.com/conn
api.s####.mob.com/data2
api.s####.mob.com/log4
api.s####.mob.com/snsconf
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
p####.ico####.com/categorylist
p####.ico####.com/handshake
p####.ico####.com/homepage
pis.al####.com/p/pcdn/i.php?v=####
pss.al####.com/iku/log/acc
pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
t.p####.ico####.com/allcomic
t.p####.ico####.com/comicdetail
t.p####.ico####.com/epinfo
t.p####.ico####.com/getcomments2
t.p####.ico####.com/getextinfo
t.p####.ico####.com/splashinfo
t.p####.ico####.com/syncextinfo

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/049e8956-f65d-4986-8bd8-342e7c74a34a
/data/data/####/0a5c476d-f89e-4257-ab22-dd182e6e0ef8
/data/data/####/13aad100-32d9-4160-a468-d64bba552196
/data/data/####/1740c449fc10be62df60ba0f18696c9f
/data/data/####/3084394a-cc94-4a18-9146-bcb470bcc736
/data/data/####/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/88feeecb-97d8-47a0-bcfd-c4f53df7c496
/data/data/####/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/ContextData.xml
/data/data/####/ICOMICO_PREFERENCE.xml
/data/data/####/Matrix
/data/data/####/SUBOXLOG_
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/a4cd04b5-0325-4f67-8f39-8f3da6bb4d76
/data/data/####/a5ae9817-8ea7-48ef-866d-1110a821f780.jar
/data/data/####/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/b18a021d11a3004d25017230b681476b
/data/data/####/beb684b0-88be-42b7-aaf9-80605281ff18
/data/data/####/c61913b615fb6224701377a119081f36
/data/data/####/ddexe
/data/data/####/debuggerd
/data/data/####/device.db
/data/data/####/fafe19ab-f29b-4a23-966a-2e62180f17b2
/data/data/####/fb49fe60-25f9-4c7a-aa8f-30ccc46d078e
/data/data/####/fileWork
/data/data/####/h.jar
/data/data/####/h.xml
/data/data/####/icomico_db-journal
/data/data/####/install-recovery.sh
/data/data/####/libjiagu-194053768.so
/data/data/####/libpcdn_acc.zip
/data/data/####/libpcdn_acc_new.so
/data/data/####/mivmi.xml
/data/data/####/mob_sdk_exception_1.xml
/data/data/####/mobclick_agent_cached_com.wh.comics.cartoon606
/data/data/####/mobclick_agent_online_setting_com.wh.comics.cartoon.xml
/data/data/####/pcdnconfigs.xml
/data/data/####/pidof
/data/data/####/root3
/data/data/####/share_sdk_1.xml
/data/data/####/sharesdk.db-journal
/data/data/####/su
/data/data/####/supolicy
/data/data/####/toolbox
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/vmeni.db-journal
/data/data/####/wsroot.sh
/data/media/####/.ba
/data/media/####/.dk
/data/media/####/.lock
/data/media/####/10cgyrnvvnzohmq5zz6nuajrd.0.tmp
/data/media/####/12d51im2x1xpfh0x1r1l284ub.0.tmp
/data/media/####/12d51im2x1xpfh0x1r1l284ub.downtmp.downtmp
/data/media/####/12jyombwfqi362m5rfghwh6xk.0.tmp
/data/media/####/12sducz6z0a8ialopll1dwsjf.0.tmp
/data/media/####/12sducz6z0a8ialopll1dwsjf.downtmp.downtmp
/data/media/####/14lnyrv7wl98buq4fnsdzpqkc.0.tmp
/data/media/####/14lnyrv7wl98buq4fnsdzpqkc.downtmp.downtmp
/data/media/####/171exjso953flq4fvv2d6rmm7.0.tmp
/data/media/####/171exjso953flq4fvv2d6rmm7.downtmp.downtmp
/data/media/####/1ari5exov86mlffed9j4k4064.0.tmp
/data/media/####/1ari5exov86mlffed9j4k4064.downtmp.downtmp
/data/media/####/1cga6cbvg3ubmow5picbgqc7q.0.tmp
/data/media/####/1cga6cbvg3ubmow5picbgqc7q.downtmp.downtmp
/data/media/####/1eeg65ek91rnijo0jnj8ruc6s.0.tmp
/data/media/####/1f52bc6cy1qqqmbrjktalp461.0.tmp
/data/media/####/1floezy53t8xtrmwo4d9ypgpz.0.tmp
/data/media/####/1floezy53t8xtrmwo4d9ypgpz.downtmp.downtmp
/data/media/####/1gkzmckj6ycq3o3m3uxq913a8.0.tmp
/data/media/####/1ib5uveb6evc5pblk8hga4mta.0.tmp
/data/media/####/1ib5uveb6evc5pblk8hga4mta.downtmp.downtmp
/data/media/####/1iujum40jhtax7asjhnyavesp.0.tmp
/data/media/####/1iujum40jhtax7asjhnyavesp.downtmp.downtmp
/data/media/####/1j3x2a8lx71x6v6sb59svn6hw.0.tmp
/data/media/####/1j3x2a8lx71x6v6sb59svn6hw.downtmp.downtmp
/data/media/####/1pf5kaqvi4a2vi6li18wsjpls.0.tmp
/data/media/####/1pf5kaqvi4a2vi6li18wsjpls.downtmp.downtmp
/data/media/####/1pvsfmvbfbs1r20ouzq998nfb.0.tmp
/data/media/####/1ribkn03d26s4tayn3yb0p62p.0.tmp
/data/media/####/1ribkn03d26s4tayn3yb0p62p.downtmp.downtmp
/data/media/####/1s4pm34rmxc3xog0gmmktycwh.0.tmp
/data/media/####/1tb4nifi0k2pzq2lgmz5cprsi.0.tmp
/data/media/####/1tb4nifi0k2pzq2lgmz5cprsi.downtmp.downtmp
/data/media/####/1uba65bawv4pmz4tnpcsay7b.0.tmp
/data/media/####/1xjli53apivupxmr5ckkdspvy.0.tmp
/data/media/####/1xjli53apivupxmr5ckkdspvy.downtmp.downtmp
/data/media/####/1ykwrtrxtknbqtv2woqoj782m.0.tmp
/data/media/####/1ykwrtrxtknbqtv2woqoj782m.downtmp.downtmp
/data/media/####/1zserc9x6750izm4auusml5ph.0.tmp
/data/media/####/1zserc9x6750izm4auusml5ph.downtmp.downtmp
/data/media/####/23b99qmj57u2qx5119lcc3r99.0.tmp
/data/media/####/2539docelw7lmlo5c6inkwx83.0.tmp
/data/media/####/2539docelw7lmlo5c6inkwx83.downtmp.downtmp
/data/media/####/261lerptw445pqif578c6u3rh.0.tmp
/data/media/####/261lerptw445pqif578c6u3rh.downtmp.downtmp
/data/media/####/27cvt6tko3vho21sjqolayczs.0.tmp
/data/media/####/27cvt6tko3vho21sjqolayczs.downtmp.downtmp
/data/media/####/27typ2wjat1fnco4vr7auztj1.0.tmp
/data/media/####/286x494880pm1y4mvb5lw280g.0.tmp
/data/media/####/286x494880pm1y4mvb5lw280g.downtmp.downtmp
/data/media/####/2apy95t5xdqvtj2zz0krxdk01.0.tmp
/data/media/####/2apy95t5xdqvtj2zz0krxdk01.downtmp.downtmp
/data/media/####/2ce9gim1m5h513yccl8an032h.0.tmp
/data/media/####/2e3aefaz84cb4s84lrqdpe98e.0.tmp
/data/media/####/2e3aefaz84cb4s84lrqdpe98e.downtmp.downtmp
/data/media/####/2g1yyr3nury1kgvkbziv9jj4y.0.tmp
/data/media/####/2g1yyr3nury1kgvkbziv9jj4y.downtmp.downtmp
/data/media/####/2ijw0lt4s1alef8lsoid816ba.0.tmp
/data/media/####/2ijw0lt4s1alef8lsoid816ba.downtmp.downtmp
/data/media/####/2ntpt8uwaw6tilrnmtppunm1o.downtmp.downtmp
/data/media/####/2o829o8d65cy5dc8wemhi49c2.0.tmp
/data/media/####/2o829o8d65cy5dc8wemhi49c2.downtmp.downtmp
/data/media/####/2sb8kf2z8gaf6t2myeo0ui1io.0.tmp
/data/media/####/2sb8kf2z8gaf6t2myeo0ui1io.downtmp.downtmp
/data/media/####/2sf8d60i5bm1k6luovkwykiww.0.tmp
/data/media/####/2sf8d60i5bm1k6luovkwykiww.downtmp.downtmp
/data/media/####/2v8msxnox63fkcvcw3cdwbpsa.0.tmp
/data/media/####/2v8msxnox63fkcvcw3cdwbpsa.downtmp.downtmp
/data/media/####/2vb8upm0w31anx720gnuuiive.0.tmp
/data/media/####/30sctwrhghakak85f3g5t445f.0.tmp
/data/media/####/33npfk5hjgiqpinykvnq893w3.0.tmp
/data/media/####/33npfk5hjgiqpinykvnq893w3.downtmp.downtmp
/data/media/####/35ibkep74pyxhbn77ju8yzc5p.0.tmp
/data/media/####/35ibkep74pyxhbn77ju8yzc5p.downtmp.downtmp
/data/media/####/37d0v26vwvf5kpo6pvluxampg.0.tmp
/data/media/####/37d0v26vwvf5kpo6pvluxampg.downtmp.downtmp
/data/media/####/38dureol7w3w5e06nxuvjjtsx.0.tmp
/data/media/####/38dureol7w3w5e06nxuvjjtsx.downtmp.downtmp
/data/media/####/3c53r9250os8mpipbln7yef9w.0.tmp
/data/media/####/3c53r9250os8mpipbln7yef9w.downtmp.downtmp
/data/media/####/3cwzjofjuce3xus34873h7iyp.0.tmp
/data/media/####/3cwzjofjuce3xus34873h7iyp.downtmp.downtmp
/data/media/####/3d9jaj0nsi8ljuur93w8i2zsm.0.tmp
/data/media/####/3d9jaj0nsi8ljuur93w8i2zsm.downtmp.downtmp
/data/media/####/3ddrikvphsxz7d59qyruwsoq9.0.tmp
/data/media/####/3ddrikvphsxz7d59qyruwsoq9.downtmp.downtmp
/data/media/####/3dscruwvdq30qivxaauqxeqhu.downtmp.downtmp
/data/media/####/3ljgk6d21v8q3nivb20enn2t8.0.tmp
/data/media/####/3ob7cr5207eylzpfj25jm7zfr.0.tmp
/data/media/####/3ob7cr5207eylzpfj25jm7zfr.downtmp.downtmp
/data/media/####/3p5gcgssxt8fn5izny0nrvlj3.0.tmp
/data/media/####/3p5gcgssxt8fn5izny0nrvlj3.downtmp.downtmp
/data/media/####/3p96tjqfw9xp16e5z2rlzw6a.0.tmp
/data/media/####/3p96tjqfw9xp16e5z2rlzw6a.downtmp.downtmp
/data/media/####/3pq7racq6uodd7syiuwux3clj.0.tmp
/data/media/####/3pq7racq6uodd7syiuwux3clj.downtmp.downtmp
/data/media/####/3q3tebuf7ou7wqqhh27owqp3m.0.tmp
/data/media/####/3sg9npwq9uqe9fmm5c9izls3e.0.tmp
/data/media/####/3sppvaunl91q0vz2ptztfof5e.0.tmp
/data/media/####/3sppvaunl91q0vz2ptztfof5e.downtmp.downtmp
/data/media/####/3vekx20l3drlyqxs93mdfxlal.0.tmp
/data/media/####/3vgs3tm1rgn7jqyhnur7bel8e.0.tmp
/data/media/####/3xz1jtdwasllfgss2p3sws97z.0.tmp
/data/media/####/41v2kw2i8i58gz48h19tl4i.0.tmp
/data/media/####/41v2kw2i8i58gz48h19tl4i.downtmp.downtmp
/data/media/####/424967r4pljx5kia702xsnh90.0.tmp
/data/media/####/4315vgljjaesg3nswxyx4gred.0.tmp
/data/media/####/4315vgljjaesg3nswxyx4gred.downtmp.downtmp
/data/media/####/43gjcgynbvtrepmp7z0r39uyu.0.tmp
/data/media/####/43gjcgynbvtrepmp7z0r39uyu.downtmp.downtmp
/data/media/####/44oy623cos1l6gb4jy2qzskd5.0.tmp
/data/media/####/44oy623cos1l6gb4jy2qzskd5.downtmp.downtmp
/data/media/####/459niri2x1byo448zdiq8dqan.0.tmp
/data/media/####/459niri2x1byo448zdiq8dqan.downtmp.downtmp
/data/media/####/4bh3vdrh34nwac4th00bpm3bj.0.tmp
/data/media/####/4bh3vdrh34nwac4th00bpm3bj.downtmp.downtmp
/data/media/####/4c70ivrfabs4pwr1gosfo2b7a.0.tmp
/data/media/####/4c70ivrfabs4pwr1gosfo2b7a.downtmp.downtmp
/data/media/####/4em3bv8mdzg9aqzr05ixglb32.0.tmp
/data/media/####/4g9nk9oh9u2of1w2e7988rhpc.0.tmp
/data/media/####/4g9nk9oh9u2of1w2e7988rhpc.downtmp.downtmp
/data/media/####/4h227d2eqa899jzt5172468ld.0.tmp
/data/media/####/4h227d2eqa899jzt5172468ld.downtmp.downtmp
/data/media/####/4lbyhm6wuju7gva8fket25wkl.0.tmp
/data/media/####/4lbyhm6wuju7gva8fket25wkl.downtmp.downtmp
/data/media/####/4mdeem6px0xsdbzq6qn0yeyff.0.tmp
/data/media/####/4mdeem6px0xsdbzq6qn0yeyff.downtmp.downtmp
/data/media/####/4mscy42ww0jqyn9f2fu7y29c9.0.tmp
/data/media/####/4noreaqxec4yvc1lvqchi5ws2.0.tmp
/data/media/####/4noreaqxec4yvc1lvqchi5ws2.downtmp.downtmp
/data/media/####/4oba93xw9wimx20jbdauf1s8t.0.tmp
/data/media/####/4oba93xw9wimx20jbdauf1s8t.downtmp.downtmp
/data/media/####/4pn7rdw355yzy7xlt00dc3sve.0.tmp
/data/media/####/4pumtw9qc0z9ovavq2i4lfea2.0.tmp
/data/media/####/4pumtw9qc0z9ovavq2i4lfea2.downtmp.downtmp
/data/media/####/4pzd3aaxlphujg5r98c16fmpr.0.tmp
/data/media/####/4pzd3aaxlphujg5r98c16fmpr.downtmp.downtmp
/data/media/####/4zafe1xt9juk52u90fd4ri88n.0.tmp
/data/media/####/51kjzc2w8lbrd755vbfu2d8xo.0.tmp
/data/media/####/51uwsurt7dr2ufqu33ifvr0xi.0.tmp
/data/media/####/51uwsurt7dr2ufqu33ifvr0xi.downtmp.downtmp
/data/media/####/535j40hpnx8qerhxe3pd0xhwd.0.tmp
/data/media/####/572nfw03fqpzstrd015lxwpxj.0.tmp
/data/media/####/57t7qq9w5peino10p7rxpj0qg.0.tmp
/data/media/####/5ast1vlfxsmadgutbxi3xveh2.0.tmp
/data/media/####/5ast1vlfxsmadgutbxi3xveh2.downtmp.downtmp
/data/media/####/5ceu0enmfr3ve6kso1veghnjp.0.tmp
/data/media/####/5eyzkxg6ut4d1iwcw246j9r0m.0.tmp
/data/media/####/5eyzkxg6ut4d1iwcw246j9r0m.downtmp.downtmp
/data/media/####/5grzw8ljrfkl7i5zmvmo5tp08.0.tmp
/data/media/####/5lxkjvzuwjoxiib8gzfhfhy7y.0.tmp
/data/media/####/5lxoenifvr7m2x033pja0e1dm.0.tmp
/data/media/####/5ns7bjgutxxxgfz0zmlw1d2pc.0.tmp
/data/media/####/5ns7bjgutxxxgfz0zmlw1d2pc.downtmp.downtmp
/data/media/####/5r30rzs9gboyqqene6f167q6e.0.tmp
/data/media/####/5r30rzs9gboyqqene6f167q6e.downtmp.downtmp
/data/media/####/5s3legov607lhcbjstlygj1eb.0.tmp
/data/media/####/5s3legov607lhcbjstlygj1eb.downtmp.downtmp
/data/media/####/5t8c4jhcvfyadituwn38pboc8.0.tmp
/data/media/####/5uer0r2fvb3482nq4ne5fwn0s.0.tmp
/data/media/####/5uer0r2fvb3482nq4ne5fwn0s.downtmp.downtmp
/data/media/####/5z1544euog0r8loed0fmi3qnq.0.tmp
/data/media/####/5z1544euog0r8loed0fmi3qnq.downtmp.downtmp
/data/media/####/5ztozpx7vyf1rdxg9bfehowhk.0.tmp
/data/media/####/60415ecp09w2meqpgbed3btph.0.tmp
/data/media/####/60415ecp09w2meqpgbed3btph.downtmp.downtmp
/data/media/####/60mso2t9ruajt2hs6p1dry1t.downtmp.downtmp
/data/media/####/61sz1bkhcklxrk347iqhmamu5.0.tmp
/data/media/####/628ml6pvs0hy7bmpdir34phne.0.tmp
/data/media/####/628ml6pvs0hy7bmpdir34phne.downtmp.downtmp
/data/media/####/66vwrhldh9t5eca0i10c1h0yb.0.tmp
/data/media/####/67ax2ixef1dn2gd4uigx146vt.0.tmp
/data/media/####/67ax2ixef1dn2gd4uigx146vt.downtmp.downtmp
/data/media/####/69of7k2c7ao9egogyzewqbahq.0.tmp
/data/media/####/6er1pbyux3ds5leb7wv057c5u.0.tmp
/data/media/####/6g49kwpn4swc226zotfersuc2.0.tmp
/data/media/####/6g49kwpn4swc226zotfersuc2.downtmp.downtmp
/data/media/####/6gbup5hs3ic8zop7hyfs5tuv4.0.tmp
/data/media/####/6gbup5hs3ic8zop7hyfs5tuv4.downtmp.downtmp
/data/media/####/6iwqt2xh3m2x1wtvreg8l42rf.downtmp.downtmp
/data/media/####/6qb94rua4f565twsdtnlfia8e.0.tmp
/data/media/####/6qb94rua4f565twsdtnlfia8e.downtmp.downtmp
/data/media/####/6qkbowsh7gdoakr6ri10xheli.0.tmp
/data/media/####/6qmov9mxdouej482s5j8ff25q.0.tmp
/data/media/####/6qmov9mxdouej482s5j8ff25q.downtmp.downtmp
/data/media/####/6rngdfknfw2tatkf2qb9fqqaz.0.tmp
/data/media/####/6s5mxydawilnw9kmnaigzbtbx.0.tmp
/data/media/####/6sy4m3rmktmidqyas9g1gziqh.0.tmp
/data/media/####/6sy4m3rmktmidqyas9g1gziqh.downtmp.downtmp
/data/media/####/6t7hrupbilsrglw2gejwogwql.0.tmp
/data/media/####/6t7hrupbilsrglw2gejwogwql.downtmp.downtmp
/data/media/####/6wdn3e9ul0yeohaxtnybsxmdd.0.tmp
/data/media/####/6xhnw3k17898r3gvgvc73g23p.0.tmp
/data/media/####/6xmmvl0gq4amnmk99a98xg829.0.tmp
/data/media/####/6xmmvl0gq4amnmk99a98xg829.downtmp.downtmp
/data/media/####/6yeo9wsq55oks5z5es1vfompa.0.tmp
/data/media/####/71tn95cn5v8bzkuv6lemo00o7.0.tmp
/data/media/####/71tn95cn5v8bzkuv6lemo00o7.downtmp.downtmp
/data/media/####/734fsemz67c9sfvqxjkxahid7.0.tmp
/data/media/####/734fsemz67c9sfvqxjkxahid7.downtmp.downtmp
/data/media/####/755xu263ofbx0kuf0k4teepvx.0.tmp
/data/media/####/78l4fjkos0f6xqvef8kstj2sn.0.tmp
/data/media/####/78l4fjkos0f6xqvef8kstj2sn.downtmp.downtmp
/data/media/####/78sr9ku00v22690r4cg54x7gl.0.tmp
/data/media/####/7bafzk0yiy5u2w0lsnppkgv1k.0.tmp
/data/media/####/7bafzk0yiy5u2w0lsnppkgv1k.downtmp.downtmp
/data/media/####/7bi2hqm88i36drba7dpc8okeg.0.tmp
/data/media/####/7bj1q5u4qzi2ancssgvi8pz81.0.tmp
/data/media/####/7bj1q5u4qzi2ancssgvi8pz81.downtmp.downtmp
/data/media/####/7c9hfv50mgkc1u2hm9qv96vsq.0.tmp
/data/media/####/7c9hfv50mgkc1u2hm9qv96vsq.downtmp.downtmp
/data/media/####/7e1ba9tre9zgtdx3qe7zounba.0.tmp
/data/media/####/7e1ba9tre9zgtdx3qe7zounba.downtmp.downtmp
/data/media/####/8w6pn0kjkz1nhotrtn0mh8xb.0.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a531894c6a6c1614b83562b7e4915916.downtmp
/data/media/####/cwvbncgo1a1g23qaj026zcsz.0.tmp
/data/media/####/gq88p6mpzswo6u5qsov1sce1.0.tmp
/data/media/####/journal.tmp
/data/media/####/kf80595zd0iz5fprq6yv8b8k.0.tmp
/data/media/####/kf80595zd0iz5fprq6yv8b8k.downtmp.downtmp
/data/media/####/myself.dat
/data/media/####/pdgtdbz8us2qxcdzi8p5d5wv.0.tmp
/data/media/####/pdgtdbz8us2qxcdzi8p5d5wv.downtmp.downtmp
/data/media/####/vnboibjujnh5pbb8ihcqiu7u.0.tmp
/data/media/####/x8tft67ksdx86j4y2e93ma3b.0.tmp
/data/media/####/x8tft67ksdx86j4y2e93ma3b.downtmp.downtmp
/data/media/####/ytwhvvogrh5eatdl7vx713fw.0.tmp

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu-194053768.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
sh

Loads the following dynamic libraries:

libjiagu-194053768
libpcdn_acc
neh
pcdn_acc

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-ECB-NoPadding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial