Technical information
Malicious functions:
Prompts to install third-party applications.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) mo####.zhu####.s####.com:80
- TCP(HTTP/1.1) get.s####.com:80
- TCP(HTTP/1.1) down####.zhu####.s####.####.com:80
- TCP(HTTP/1.1) a####.b####.qq.com:8011
- TCP(HTTP/1.1) wx.q####.cn:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) q.q####.cn:80
- TCP(HTTP/1.1) www.appc####.com:80
- TCP(HTTP/1.1) de####.ping####.zhu####.####.com:80
- TCP(HTTP/1.1) d####.zhu####.s####.com:80
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) hotg####.jom####.com:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(HTTP/1.1) dl.zhu####.s####.####.com:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(HTTP/1.1) i####.sogo####.com.####.com:80
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) p####.s####.com:443
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP openj####.m.ta####.com:80
- TCP 2####.119.217.112:443
DNS requests:
- a####.b####.qq.com
- a.g####.b####.com
- ag####.m.ta####.com
- amdc####.m.ta####.com
- and####.b####.qq.com
- d####.zhu####.s####.com
- de####.ping####.zhu####.####.com
- dl.zhu####.s####.com
- down####.zhu####.s####.com
- get.s####.com
- i####.sogo####.com
- i####.sogo####.com
- i####.sogo####.com
- i####.sogo####.com
- img.sogo####.com
- m.b####.com
- mo####.zhu####.s####.com
- msg.umengc####.com
- p####.s####.com
- q.q####.cn
- thi####.q####.cn
- thi####.q####.cn
- umen####.m.ta####.com
- umengj####.m.ta####.com
- www.appc####.com
- www.d.appc####.com
- wx.q####.cn
HTTP GET requests:
- d####.zhu####.s####.com/misc/root/gets.html?key=####&ret=####&uid=####&v...
- de####.ping####.zhu####.####.com/?_dv=####&_di=Ual####&_dc=U9g####
- dl.zhu####.s####.####.com/oglxr/open/files/year_2018/day_20180709/154036...
- down####.zhu####.s####.####.com/focusimage/3a/f2/3af22b914b0b7ca32855d40...
- hotg####.jom####.com/data/wisegame/2f69d7c3bd11160e/QRCode_50.apk?from=#...
- i####.sogo####.com.####.com/app/a/100540008/0317c3d4d52b65fba8e9a9197aec...
- i####.sogo####.com.####.com/app/a/100540008/0c4bcc36edd20b7064316dbd7bc7...
- i####.sogo####.com.####.com/app/a/100540008/10e9f2cd9783573b03404c341b02...
- i####.sogo####.com.####.com/app/a/100540008/26630396ff3f9a06bcf5b8e333f8...
- i####.sogo####.com.####.com/app/a/100540008/26b98703fe036101011e056a525f...
- i####.sogo####.com.####.com/app/a/100540008/271d81fbaadee85348b324d96d44...
- i####.sogo####.com.####.com/app/a/100540008/30cf3c96bf4bc5d6b2d9c12569b5...
- i####.sogo####.com.####.com/app/a/100540008/315bab69457cf1591ac806cc1bcf...
- i####.sogo####.com.####.com/app/a/100540008/34224090419eb89b8574381e2bcc...
- i####.sogo####.com.####.com/app/a/100540008/385083ae2be35f1fea2c9ca574a1...
- i####.sogo####.com.####.com/app/a/100540008/3c23cc2287cb265b945871c84f40...
- i####.sogo####.com.####.com/app/a/100540008/3ca479d85b730e180876d11adddc...
- i####.sogo####.com.####.com/app/a/100540008/40cd25508c223af381ccaf19293d...
- i####.sogo####.com.####.com/app/a/100540008/43c2dc756b6ae92ff15950912259...
- i####.sogo####.com.####.com/app/a/100540008/475db7180b29d06427b2d96332e0...
- i####.sogo####.com.####.com/app/a/100540008/4e410a114a43e89a54cc71fdc409...
- i####.sogo####.com.####.com/app/a/100540008/4ecdd9708644ce19979a2a006980...
- i####.sogo####.com.####.com/app/a/100540008/5445c8fc448cb8c631b736aa5224...
- i####.sogo####.com.####.com/app/a/100540008/5520cb1d9f5a61cdb09c4c57acc6...
- i####.sogo####.com.####.com/app/a/100540008/5db9d0a5b66260807f5eb3587255...
- i####.sogo####.com.####.com/app/a/100540008/6020a3e4d715e07b71a79b90b1f5...
- i####.sogo####.com.####.com/app/a/100540008/647d0c016eaae1447ecd6037837a...
- i####.sogo####.com.####.com/app/a/100540008/69613514f3494f309ffc2138175d...
- i####.sogo####.com.####.com/app/a/100540008/6a09f1d73016b39a17d788363554...
- i####.sogo####.com.####.com/app/a/100540008/774bd8c18a3fb0ebeb147b2877b7...
- i####.sogo####.com.####.com/app/a/100540008/8be76be0f7be6c3a95a396c3b402...
- i####.sogo####.com.####.com/app/a/100540008/904e26929739dec84b6cb93fdae4...
- i####.sogo####.com.####.com/app/a/100540008/9c1b510d547cf962a3b0feee009e...
- i####.sogo####.com.####.com/app/a/100540008/9e8ab83713074c205b2b93e21781...
- i####.sogo####.com.####.com/app/a/100540008/b4487b2e2d5cb5816e4436049b29...
- i####.sogo####.com.####.com/app/a/100540008/b78f6c9c43c5b9e8cc2a8c8e41d6...
- i####.sogo####.com.####.com/app/a/100540008/c50a6bafd3fe66f7cec749704b6c...
- i####.sogo####.com.####.com/app/a/100540008/e035f58d054f45b85917a9085573...
- i####.sogo####.com.####.com/app/a/100540008/e121ddd2552582cd63970dd3d258...
- i####.sogo####.com.####.com/app/a/100540008/ea2f59d7181c88fa107bcf9f5a99...
- i####.sogo####.com.####.com/app/a/100540008/ed45dbd6cd4b605b19b75b73333e...
- i####.sogo####.com.####.com/app/a/100540008/edfaa26a54e5dd49309b4e25eb7f...
- i####.sogo####.com.####.com/app/a/100540008/ee1e9afd2568b91c4005557169b4...
- i####.sogo####.com.####.com/app/a/100540008/f0e3b9cd91529933ee54523c3a1a...
- i####.sogo####.com.####.com/app/a/100540014/28335ffba86a1ce15891deb77e42...
- i####.sogo####.com.####.com/app/a/100540014/2b06dab12f6509f11dda99a67b18...
- i####.sogo####.com.####.com/app/a/100540014/30e87b63367ce338a2361ea0e8e0...
- i####.sogo####.com.####.com/app/a/100540014/39b74b36c27c5317e4c5d770bc31...
- i####.sogo####.com.####.com/app/a/100540014/40776fc1e6f042b6ae40226a5dd6...
- i####.sogo####.com.####.com/app/a/100540014/46a1c41e099903103654bf5f2f9e...
- i####.sogo####.com.####.com/app/a/100540014/8905df82061c01e0d2490b46fdb0...
- i####.sogo####.com.####.com/app/a/100540014/8a20ee9c4cae2c17254ea6ca81a4...
- i####.sogo####.com.####.com/app/a/100540014/9cc41106ac8bb274c00769340c05...
- i####.sogo####.com.####.com/app/a/100540014/bc8e7c6f09440a23f2258bda88fb...
- i####.sogo####.com.####.com/app/a/100540014/c1e907c1acbac64e2660083cc9d9...
- i####.sogo####.com.####.com/app/a/100540014/c44406a57c11372f3e77bef1f581...
- i####.sogo####.com.####.com/app/a/100540014/d3184f879422058724dbe8448da2...
- i####.sogo####.com.####.com/app/a/100540014/e0b6929fecad8571e5ca2f0513d4...
- i####.sogo####.com.####.com/app/a/100540014/facde91ad3848f964ec86abd7786...
- i####.sogo####.com.####.com/app/a/100540020/02657941932deaaeff289583f250...
- i####.sogo####.com.####.com/app/a/100540020/0379bf2e7cecb2beb751dd98bf6f...
- i####.sogo####.com.####.com/app/a/100540020/0ad050791dfe7ccca728ac3ac5a1...
- i####.sogo####.com.####.com/app/a/100540020/0b6cc14e7c5f61b0e08c6ec344f1...
- i####.sogo####.com.####.com/app/a/100540020/19051df3ef8c884a199da9bef166...
- i####.sogo####.com.####.com/app/a/100540020/21a17ab37538cbd2862de7b3940d...
- i####.sogo####.com.####.com/app/a/100540020/271d81fbaadee85348b324d96d44...
- i####.sogo####.com.####.com/app/a/100540020/315bab69457cf1591ac806cc1bcf...
- i####.sogo####.com.####.com/app/a/100540020/349dbad25f0970af116643a96e53...
- i####.sogo####.com.####.com/app/a/100540020/3b4744faf9cf265fa07ff8503edc...
- i####.sogo####.com.####.com/app/a/100540020/43c2dc756b6ae92ff15950912259...
- i####.sogo####.com.####.com/app/a/100540020/469ea5772ae338fee8bcaa7889eb...
- i####.sogo####.com.####.com/app/a/100540020/4def5753df25d25fbe1826bab872...
- i####.sogo####.com.####.com/app/a/100540020/5627d3626e835d664b54dc762270...
- i####.sogo####.com.####.com/app/a/100540020/6020a3e4d715e07b71a79b90b1f5...
- i####.sogo####.com.####.com/app/a/100540020/6476fefc389f2cbbab9bb17589c4...
- i####.sogo####.com.####.com/app/a/100540020/6d969312d4457f8f7baf841f3155...
- i####.sogo####.com.####.com/app/a/100540020/82441b439303fd863c1a2511baf8...
- i####.sogo####.com.####.com/app/a/100540020/84397f945a737b6bb21db03575fd...
- i####.sogo####.com.####.com/app/a/100540020/87dcc51065453159dedb9974320a...
- i####.sogo####.com.####.com/app/a/100540020/93974b2365c505c115eb9994f95e...
- i####.sogo####.com.####.com/app/a/100540020/948cd3a75d22b2c4dad74daa5165...
- i####.sogo####.com.####.com/app/a/100540020/affb467412f588e2e825378e1be6...
- i####.sogo####.com.####.com/app/a/100540020/b86543d28ab113291838a6a2cebb...
- i####.sogo####.com.####.com/app/a/100540020/bd0a2aee81453dd9391582a63260...
- i####.sogo####.com.####.com/app/a/100540020/c3811325d84b37389b99ce8e4537...
- i####.sogo####.com.####.com/app/a/100540020/c55edf502e0dccba80592a8a53ef...
- i####.sogo####.com.####.com/app/a/100540020/c7283600321f664f7794ae21e509...
- i####.sogo####.com.####.com/app/a/100540020/ceb36d3b3f2525ea167ae68fed8d...
- i####.sogo####.com.####.com/app/a/100540020/d4e95ee39b5cdfd72bb0e313acc7...
- i####.sogo####.com.####.com/app/a/100540020/da680828921bbbe1d6368ceb8bee...
- i####.sogo####.com.####.com/app/a/100540020/e75b4a7c3111bff0946b5eb977f5...
- i####.sogo####.com.####.com/app/a/100540020/ee1e9afd2568b91c4005557169b4...
- i####.sogo####.com.####.com/app/a/11220004/0a35aa1ec2d5af6f6a8ab73d54260...
- i####.sogo####.com.####.com/app/a/11220004/0a9b038f6064ae2ec3f2c5e07973b...
- i####.sogo####.com.####.com/app/a/11220004/3b0d74d8a56e76a269b6f7783d759...
- i####.sogo####.com.####.com/app/a/11220004/4b73fdb8effbf63ebf0333233d58a...
- i####.sogo####.com.####.com/app/a/11220004/521a489a5ed265794ab117ee86378...
- i####.sogo####.com.####.com/app/a/11220004/5a79e4efd20ec5b6790d07358cab9...
- i####.sogo####.com.####.com/app/a/11220004/66fd2806a8769cc53ad720c0bfeb2...
- i####.sogo####.com.####.com/app/a/11220004/6b540beaecc2ed371138c3b7e58c9...
- i####.sogo####.com.####.com/app/a/11220004/6dc2bdb70d3b9dd30cbafe1fedd86...
- i####.sogo####.com.####.com/app/a/11220004/746a19b8088b265a60340ea988037...
- i####.sogo####.com.####.com/app/a/11220004/82143aed9a30d536e1944ab972390...
- i####.sogo####.com.####.com/app/a/11220004/8d55dad8be873512aeb8aad5f4c82...
- i####.sogo####.com.####.com/app/a/11220004/91dcae1298593e03f054638f7bc31...
- i####.sogo####.com.####.com/app/a/11220004/953bb612248b57c8901a3971ea579...
- i####.sogo####.com.####.com/app/a/11220004/b5485f1ba28bd651ae9f79ca91fd8...
- i####.sogo####.com.####.com/app/a/11220004/b68575c2c9fdc7e89dc06aa58811c...
- i####.sogo####.com.####.com/app/a/11220004/b930abbd5785a34f35db9e264cbcf...
- i####.sogo####.com.####.com/app/a/11220004/bee4515b249bea7c67d768f27648b...
- i####.sogo####.com.####.com/app/a/11220004/d2fb5fb271dfe83344029579eb96d...
- i####.sogo####.com.####.com/app/a/11220004/dd2a4f7937e997702a6df10bd66ae...
- i####.sogo####.com.####.com/app/a/11220004/dfa174b86210711c626d2d634d5b7...
- i####.sogo####.com.####.com/app/a/11220004/e1b4c7db58af6cf7f657484760ba2...
- i####.sogo####.com.####.com/app/a/11220004/e378f6c5e9c4bfa6fd68a022fe19f...
- i####.sogo####.com.####.com/app/a/11220004/e72bf3c09be997ccf9d566a94195a...
- i####.sogo####.com.####.com/app/a/11220004/f17827778cd906aac98778bb90e8d...
- mo####.zhu####.s####.com/android/app/getcomment.html?iv=####&appid=####&...
- mo####.zhu####.s####.com/android/checkjarupdate.html?uid=####&vn=####&ch...
- mo####.zhu####.s####.com/android/config/device.html?iv=####&uid=####&vn=...
- mo####.zhu####.s####.com/android/config/device_entry.html?iv=####&rom=##...
- mo####.zhu####.s####.com/android/downbind.html?iv=####&etoken=####&token...
- mo####.zhu####.s####.com/android/download.html?app_id=####&sogouid=####&...
- mo####.zhu####.s####.com/android/folder/ads/link.html?iv=####&type=####&...
- mo####.zhu####.s####.com/android/list/alsodown.html?pkg=####&iv=####&aid...
- mo####.zhu####.s####.com/android/list/relation.html?s=####&iv=####&l=###...
- mo####.zhu####.s####.com/android/nav/config.html?iv=####&uid=####&vn=###...
- mo####.zhu####.s####.com/android/news/channel.html?&uid=####&vn=####&cha...
- mo####.zhu####.s####.com/android/notify.html?uid=####&vn=####&channel=##...
- mo####.zhu####.s####.com/android/popup.html?iv=####&gid=####&dpi=####&ui...
- mo####.zhu####.s####.com/android/residentRec.html?iv=####&uid=####&vn=##...
- mo####.zhu####.s####.com/android/serverconfig.html?iv=####&mf=####&on=##...
- mo####.zhu####.s####.com/android/sosodetail.html?iv=####&sosoid=####&uid...
- mo####.zhu####.s####.com/android/weather.html?iv=####&bts=####&type=####...
- mo####.zhu####.s####.com/m/appDetail.html?id=####&iv=####&imei=####&uid=...
- mo####.zhu####.s####.com/m/author.html?l=####&aid=####&s=####&iv=####&q=...
- mo####.zhu####.s####.com/m/focus.html?iv=####&tid=####&uid=####&vn=####&...
- mo####.zhu####.s####.com/m/install.html?iv=####&is_first=####&uid=####&v...
- mo####.zhu####.s####.com/m/likeApp.html?iv=####&tid=####&uid=####&vn=###...
- mo####.zhu####.s####.com/m/recommend.html?s=####&token=####&iv=####&c=##...
- q.q####.cn/qqapp/100294784/989079B0960D4EA77C1966E8DE73F026/100
- q.q####.cn/qqapp/100294784/9FDB07940D44CFEDD215C928AC513CBD/100
- q.q####.cn/qqapp/100863168/4266F205B51066438F83810F4890F6AB/100
- thi####.q####.cn/mmopen/vi_32/3CG1Xd5HontKI90s0LpSRjtYTYlia5MmiaTrLqIlQg...
- thi####.q####.cn/mmopen/vi_32/DYAIOgq83erG5QBT05AGBGkw2vVWOK0hiaDrfVeMpO...
- thi####.q####.cn/mmopen/vi_32/EbKZnzlF3P1uWBayXVOqSlAgeia4JXfRovWC8F1m7J...
- thi####.q####.cn/mmopen/vi_32/L5u46mDl9dVUK7E0pmWaUEjWvjwJXbkVdPAfuWYqaU...
- thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTIBShwT5bjuzPaBccC0oSqYYEibg4k5sF...
- thi####.q####.cn/mmopen/vi_32/ice4jhCOTjLrNoXQEBcq54YxSP8t5BGQia28SQxL2b...
- thi####.q####.cn/mmopen/vi_32/v7XamvrSVaRkJsMhbKsZR3HfnlkdFZibCzYf0EibUD...
- thi####.q####.cn/qqapp/100863168/4B4F9C18E4C5753FBF7408C93F1B83AB/100
- thi####.q####.cn/qqapp/100863168/B6B820ACDAF11C5B06960C9310F85132/100
- wap.n.sh####.com/api?action=####&token=####&from=####&type=####&dltype=#...
- www.appc####.com/McDonald/d/2994941/cop.sougouzhushou.app_0/mobi.thinkch...
- www.appc####.com/market/d/2994941/cop.sougouzhushou.app_0/mobi.thinkchan...
- wx.q####.cn/mmopen/vi_32/E59LGbFbxumHUj6zoIhpKRaVQGxiagl4nhfff1xOp9cFusD...
- wx.q####.cn/mmopen/vi_32/Q0j4TwGTfTIXoOxDmLmNbiaR6xPdTCAf0o4Q2DuHdpJAJcg...
- wx.q####.cn/mmopen/vi_32/Q0j4TwGTfTJU3ne8IMOBde5b8Cw1zgAlggZJO6OTFqggOBk...
HTTP POST requests:
- a####.b####.qq.com:8011/rqd/async
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- and####.b####.qq.com/rqd/async
- get.s####.com/q
- mo####.zhu####.s####.com/android/app/usercomment.html?iv=####&pn=####&an...
- mo####.zhu####.s####.com/android/checkapptotal.html?iv=####&sdkversion=#...
- mo####.zhu####.s####.com/android/checkupdate.html?andid=####
- mo####.zhu####.s####.com/android/folder/game/type.html?iv=####&gid=####&...
- mo####.zhu####.s####.com/android/loadscreen.html?dpi=####&iv=####&uid=##...
- mo####.zhu####.s####.com/android/updateNotify.html?iv=####&dpi=####&sdkv...
Modified file system:
Creates the following files:
- /data/data/####/-1005864984-1641978195
- /data/data/####/-1197960752-1285632402
- /data/data/####/-1197960752-1903695041
- /data/data/####/-1197960752-288262758
- /data/data/####/-1197960752108212601
- /data/data/####/-11979607521699733854
- /data/data/####/-11979607522089474695
- /data/data/####/-1197960752529682046
- /data/data/####/-12037498741105756323
- /data/data/####/-1286391772-321021504
- /data/data/####/-1452697297-1566277205
- /data/data/####/-1452697297-237371428
- /data/data/####/-1452697297-980022210
- /data/data/####/-14526972971103405823
- /data/data/####/-1452697297167138210
- /data/data/####/-14526972971735908479
- /data/data/####/-14526972971872240635
- /data/data/####/-1492552333-1003615979
- /data/data/####/-1530247445123262621
- /data/data/####/-15570777191105769024
- /data/data/####/-1578119070-1753544706
- /data/data/####/-1578119070-815590610
- /data/data/####/-1707433842-1048023706
- /data/data/####/-1707433842-1462165783
- /data/data/####/-1707433842-428094796
- /data/data/####/-1707433842-459352042
- /data/data/####/-17074338421221624450
- /data/data/####/-17074338421801060040
- /data/data/####/-17074338421984345267
- /data/data/####/-170743384270198528
- /data/data/####/-1707433842926995947
- /data/data/####/-1749258493-1358958566
- /data/data/####/-1759168299-1817557836
- /data/data/####/-1864753015-1817557836
- /data/data/####/-1962170387-1253000783
- /data/data/####/-1962170387-1328637980
- /data/data/####/-1962170387-1505267352
- /data/data/####/-1962170387-778948208
- /data/data/####/-19621703871932122942
- /data/data/####/-19621703872046907779
- /data/data/####/-1962170387644954251
- /data/data/####/-1970197987-1124013916
- /data/data/####/-20838339061391985132
- /data/data/####/-303790805-1616817955
- /data/data/####/-33246811-1280297272
- /data/data/####/-616505053-1281506809
- /data/data/####/-6165050531973445401
- /data/data/####/-616505053940927647
- /data/data/####/-7168233981105756323
- /data/data/####/-745582236-1817557836
- /data/data/####/-746083343-296135732
- /data/data/####/-746737472-1910982728
- /data/data/####/-9194488481649380235
- /data/data/####/-919448848194293244
- /data/data/####/-923571924-593907677
- /data/data/####/1067005471-1102655916
- /data/data/####/1067005471-1389116703
- /data/data/####/1067005471-1947446086
- /data/data/####/1067005471-2089571649
- /data/data/####/1067005471-2139591304
- /data/data/####/1067005471-719579862
- /data/data/####/1067005471-866353577
- /data/data/####/10670054711506277234
- /data/data/####/1067005471164910480
- /data/data/####/10670054712114489846
- /data/data/####/1067005471291115318
- /data/data/####/1067005471616226180
- /data/data/####/1067005471879786982
- /data/data/####/1067005472-1096758625
- /data/data/####/1067005472-1178671194
- /data/data/####/1067005472-1582262166
- /data/data/####/1067005472-158645440
- /data/data/####/1067005472-1635559608
- /data/data/####/1067005472-167493522
- /data/data/####/1067005472-1755335090
- /data/data/####/1067005472-1859588748
- /data/data/####/1067005472-1969158779
- /data/data/####/1067005472-2039344636
- /data/data/####/1067005472-322076301
- /data/data/####/1067005472-57187735
- /data/data/####/1067005472-920910019
- /data/data/####/1067005472215859512
- /data/data/####/1067005472673568683
- /data/data/####/1067005473-105617495
- /data/data/####/1067005473-1189268919
- /data/data/####/1067005473-12619624
- /data/data/####/1067005473-1301834077
- /data/data/####/1067005473-1314789925
- /data/data/####/1067005473-1367330778
- /data/data/####/1067005473-1550854406
- /data/data/####/1067005473-1605374549
- /data/data/####/1067005473-167029060
- /data/data/####/1067005473-1802893483
- /data/data/####/1067005473-1911733926
- /data/data/####/1067005473-2028191859
- /data/data/####/1067005473-2076599845
- /data/data/####/1067005473-2112544273
- /data/data/####/1067005473-343658432
- /data/data/####/1067005473-370915221
- /data/data/####/1067005473-460214757
- /data/data/####/1067005473-897228602
- /data/data/####/10670054731022913458
- /data/data/####/10670054731401783565
- /data/data/####/10670054731479421807
- /data/data/####/10670054731522730983
- /data/data/####/10670054731633992911
- /data/data/####/10670054731741653836
- /data/data/####/1067005473193381058
- /data/data/####/10670054732131489310
- /data/data/####/10670054732144704355
- /data/data/####/10670054732147361658
- /data/data/####/1067005473333288045
- /data/data/####/1067005473708466697
- /data/data/####/1067005473733514124
- /data/data/####/1067005473760044342
- /data/data/####/1067005473803170812
- /data/data/####/1175173981-858516005
- /data/data/####/1190131415-1319773466
- /data/data/####/1305459034-127983996
- /data/data/####/1334561555369814966
- /data/data/####/1349325521-634412561
- /data/data/####/13760259462008169662
- /data/data/####/1460521977-593907677
- /data/data/####/1557233448-753326965
- /data/data/####/1611602864-1541726469
- /data/data/####/16116028641067495174
- /data/data/####/16584436061032009608
- /data/data/####/1711254200-1280297272
- /data/data/####/17552342091130716888
- /data/data/####/1798091040-1280297272
- /data/data/####/1845155199-308324410
- /data/data/####/1923102161804144727
- /data/data/####/2034980719-1406286695
- /data/data/####/395746085-1572429152
- /data/data/####/402211791105756323
- /data/data/####/4754180171321394796
- /data/data/####/506813650-321021504
- /data/data/####/540557898-186402643
- /data/data/####/6536597201909811840
- /data/data/####/771946748-186402643
- /data/data/####/793620192-487924182
- /data/data/####/941393632-593907677
- /data/data/####/957344668-1817557836
- /data/data/####/ACCS_BINDumeng;58eee65d07fe654c91002627.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alvin2.xml
- /data/data/####/Badge.Main.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/NotificationCenter_Pre.xml
- /data/data/####/PB_SP.xml
- /data/data/####/PingBackManager_Pre.xml
- /data/data/####/SGLocSDK.xml
- /data/data/####/SOGOUPLUS_CONFIG.xml
- /data/data/####/account.db-journal
- /data/data/####/accs.db-journal
- /data/data/####/agoo.pid
- /data/data/####/androidtool.db-journal
- /data/data/####/app_config.xml
- /data/data/####/app_config.xml (deleted)
- /data/data/####/app_usage.db
- /data/data/####/app_usage.db-journal
- /data/data/####/bugly_db_-journal
- /data/data/####/com.sogou.androidtool.push_service_setting.xml
- /data/data/####/credit_share_preferences.xml
- /data/data/####/downloads_classic.db-journal
- /data/data/####/eudemon
- /data/data/####/file_log.txt
- /data/data/####/home_app_n
- /data/data/####/home_app_p
- /data/data/####/home_game_n
- /data/data/####/home_game_p
- /data/data/####/home_lb_n
- /data/data/####/home_lb_p
- /data/data/####/home_sf_n
- /data/data/####/home_sf_p
- /data/data/####/localRoot.json
- /data/data/####/local_crash_lock
- /data/data/####/location_config.xml
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/nav_app_selected
- /data/data/####/nav_app_unselected
- /data/data/####/nav_game_selected
- /data/data/####/nav_game_unselected
- /data/data/####/nav_manage_selected
- /data/data/####/nav_manage_unselected
- /data/data/####/nav_rank_selected
- /data/data/####/nav_rank_unselected
- /data/data/####/nav_select_selected
- /data/data/####/nav_select_unselected
- /data/data/####/patchmanage.db
- /data/data/####/patchmanage.db-journal
- /data/data/####/pb_db
- /data/data/####/pb_db-journal
- /data/data/####/pback
- /data/data/####/push_config.xml
- /data/data/####/security_info
- /data/data/####/soso.db
- /data/data/####/soso.db-journal
- /data/data/####/tab_config.json
- /data/data/####/temp
- /data/data/####/unupdateapp_v2.db
- /data/data/####/unupdateapp_v2.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/.nomedia
- /data/media/####/.sg_firstlauch.cfg
- /data/media/####/52fe388296314396ad3bae8648878d53
- /data/media/####/9ca79c6ae9a4401cb9b9b776d4c30904
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/b679a9f508404a7bac5abee982f738c7
- /data/media/####/comwuba80701.apk
- /data/media/####/d384b0987b944743966fc6e84e5ff0a7
- /data/media/####/deviceToken
- /data/media/####/mobithinkchangeandroidqrcode50.apk
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c type su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:58eee65d07fe654c91002627","utdid":"W9BUJ7hOxHIDAGdzx1FgzC4F","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- cat /sys/class/net/wlan0/address
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 777 <Package Folder>/cache
- chmod 777 <Package Folder>/files
- getprop ro.board.platform
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.kernel.qemu
- getprop ro.miui.ui.version.name
- getprop ro.smartisan.version
- getprop ro.vivo.os.version
- sh
- su
Loads the following dynamic libraries:
- Bugly
- diff
- rutx
- sogouenc
- tnet-3.1
- uninstall
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-GCM-NoPadding
Uses elevated priveleges.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about APN settings.
Gains access to information about active device administrators.
Gains access to information about installed applications.
Gains access to information about running applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
