Android.Packed.42934

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.859.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) s.fas####.net:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) aliyun-####.al####.com:80
TCP(HTTP/1.1) do.sta.cn####.com:80
TCP(HTTP/1.1) src.r####.com.####.com:80
TCP(HTTP/1.1) rcv.a####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) sdk.c####.com:80
TCP(HTTP/1.1) if.a####.com.cn:8000
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) g.fas####.net:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(TLS/1.0) an####.l####.com:443
TCP(TLS/1.0) fy.innot####.com:443
TCP(TLS/1.0) co####.in####.com:443
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) yt####.s####.com:443
TCP(TLS/1.0) tt####.wa####.cn:443
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) sis.baixunt####.com:18443
TCP sis.baixunt####.com:3000
TCP ope####.m.ta####.com:443
UDP sis.baixunt####.com:19000
TCP openj####.m.ta####.com:443
UDP 1####.168.111.1:137
UDP 2####.0.0.1:9998

DNS requests:

a####.m.ta####.com
accscdn####.m.ta####.com
acs4pu####.m.ta####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
ag####.m.ta####.com
an####.l####.com
api.a####.com
baixunt####.com
beacon####.aliy####.com
c####.baixunt####.com
cdn.a####.com
cgi.con####.qq.com
co####.in####.com
dat####.te####.cn
do.sta.cn####.com
fp.fraudme####.cn
fy.innot####.com
g.fas####.net
if.a####.com.cn
imgc####.qq.com
l####.tbs.qq.com
l.fas####.net
mi.g####.qq.com
mo####.b####.com
mobads-####.b####.com
mpush####.al####.com
pv.s####.com
rcv.a####.com
re####.baixunt####.com
s####.e.qq.com
s.fas####.net
sdk.c####.com
sis.baixunt####.com
src.r####.com
tt####.wa####.cn
yt####.s####.com

HTTP GET requests:

cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
g.fas####.net/ga?slotid=####&pid=####&hid=####&jdata=####
g.fas####.net/ga?slotid=####&pid=####&xid=####&hid=####&jdata=####
gdv.a.s####.com/cityjson?ie=####
mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
rcv.a####.com/show?CAAQTg.####
s.fas####.net/imp?e=####&pid=####&sid=####&mid=####
s.fas####.net/l?slotid=####&action=####&adid=####&pvid=####&p1=####&p2=#...
src.r####.com.####.com/kubo/dex/hh_8.2_120.dex

HTTP POST requests:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&deviceId=####&pla...
aliyun-####.al####.com/config
api.a####.com/frontend/api/ad/pull
beacon####.aliy####.com/beacon/fetch/config/byappkey
do.sta.cn####.com/do.js
if.a####.com.cn:8000/paste/fill
l####.tbs.qq.com/ajax?c=####&k=####
s####.e.qq.com/activate
sdk.c####.com/versiontapi.php?v=####&type=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/.td-3
/data/data/####/.tdck
/data/data/####/01a8a6e4-b87e-48d4-a5eb-0866185999e9
/data/data/####/18bc8d55-1eda-4efd-8e5d-96b03e410339
/data/data/####/2838.yaqcookie
/data/data/####/28ab1dbce40aa4fead41d6820bbfb570511df2ebbabf908....0.tmp
/data/data/####/30d8a0a5bf7cc2f69e4fe087c59d97618cea04507e2719c....0.tmp
/data/data/####/44736e06ab7587a8c75b3ce45a46bd7403300dd1f487a9a....0.tmp
/data/data/####/484fdc60ff2f5bfaecf5b449e61e47f24a78a027bd9a57a....0.tmp
/data/data/####/56b5680ab21bf2c120a707c6960c08daa0466c5475d7d5b....0.tmp
/data/data/####/87af3bec-800a-4d93-95a0-0e585200bece
/data/data/####/917eb5e6-f0e9-4468-80fd-5d6ab2c50b3e
/data/data/####/94094d5a8e984d4ce3c8cb9b6951eaf33fafb5bb1b01722....0.tmp
/data/data/####/ACCS_BIND24720081.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/BuglySdkInfos.xml
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml.bak
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml.bak (deleted)
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/DailyNews.xml
/data/data/####/DownloadTaskStore.db-journal
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/JPushSA_Config.xml
/data/data/####/LKME_Server_Request_Queue.xml
/data/data/####/MultiDex.lock
/data/data/####/OFFERSCONFIG1.xml
/data/data/####/OxgHkj2lz09F-journal
/data/data/####/Push_Page_Config.xml
/data/data/####/T-3rLHJEpuO9TlXsbpef0E-icLYv53mZ
/data/data/####/T-CUIqP2dyJ_KJHHs6vq3UuPPKX52foB
/data/data/####/T01NWuXTzUuLGW3HqLEzDE9CkuJjhH7E
/data/data/####/T0P0lSmGoh3qGZmfo4Y_vU6R7tXBSp0O
/data/data/####/T0vY7TrQeGXvto5lr6dbnkOtiye81bGj
/data/data/####/T1K_trh5chIn1T3VRpmZK0bOsRLwxcKF
/data/data/####/T1Na0vQ9UBrpKcPEQo-X10RHv_6DVxCd
/data/data/####/T1sFwowouRAmufzdyZTehUnjEsKv5aIQ
/data/data/####/T2CpvrKWfecvoywUx6EBvEalZ2aAuOEA
/data/data/####/T2HWkoKFiMUuOiDPMrzKFUqRQ9Th-9XB
/data/data/####/T3ExInWFvNYfvu9uk7fIm09UuyCxo4pQ
/data/data/####/T4_gs9ZEYgYU8i0twoERL0TlTo5R01CF
/data/data/####/T4cYLuMakAFfedp5aZG45kIgNm29ydbw
/data/data/####/T5Md3qJ7oEyS_UBEdIcKHESqtvo6oQZv
/data/data/####/T5NQJEGg7UUihaln_pG2pUTvF5ov2xwW
/data/data/####/T5TdEGUOlX8uoGRz87Bz0EiccHguAgw3
/data/data/####/T5doxziIq6F9g1IuUqj8g0aUOpGLuDHe
/data/data/####/T5oSrQ3BMt-p6Z24IoMeMUFOMCMp8zoB
/data/data/####/T6avHetrn_ksykNTOo3o30Trzb8wuJ8N
/data/data/####/T6oU07we63R2bAN4-aFjw0QpiXpsITWx
/data/data/####/T6rBDnBDxxsERTo-QJVZHkmuObCx1C4w
/data/data/####/T6wzEAam09YWIoOl8pxH30G5d981H2ml
/data/data/####/T6xwJGN3o9zR6LEee4yqG050-_imX73P
/data/data/####/T7QQqH0ZLvMy42aslJfwL0gV1reQ7cXL
/data/data/####/T7f2TGMUffJ-tYyy5I9RQULBGhyz6c3w
/data/data/####/T87EV9Uyp4mFScrsEabR-U-NGQLJOiU7
/data/data/####/T8tbVOQXhioqN6RW8bqbO0t5IyWVMbOB
/data/data/####/T9FrH2ExlAW1j7nzy7vSkkPdVoTu9mWZ
/data/data/####/T9GxlDIF5yFIg-DRspedDkhTNbRhEt5d
/data/data/####/T9Z63ozSpHRblsgawYoJZEMxgmVqEib7
/data/data/####/T9akiM7CjhpdPhjAlI-LlEU7dFEMgABZ
/data/data/####/T_3T1jgV9LaBp3lJdIq7EkveqqOLJNxa
/data/data/####/T_V6oXVJUTEYqycXd5i7i0YfgXEwhDya
/data/data/####/TwWCO9G1-FEeDWpE-LGUSk7tbLssbHBG
/data/data/####/TwZyQucTTvGhYB8tirMsiENtaSMyQLLw
/data/data/####/TwmOmXnCf0yBbTvHcoJiBECU5JxV6bl-
/data/data/####/Tx_DOGEPlVSjPTeZr5byeEmOXZtxraKi
/data/data/####/TyeZLPOa8W_xbVQJ2rhzz0zO67GsaFeT
/data/data/####/Tyf-t_OYvdjPVmkZboEkok5qrn53U7VU
/data/data/####/Tz-IZqaZb1UjrPi6eYoCCE_FZFD1CCd9
/data/data/####/Tz4p9EfVKZrqLuyXYq257Eu91NYVeG93
/data/data/####/TzkuJUiCb9_KfqhSkqETjk0Wbk7_1fea
/data/data/####/UTCommon.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__builtinversion__.jar
/data/data/####/__xadsdk__remote__final__running__.jar
/data/data/####/a570dce37f2abc021c3cb54e29361dd3679d91d7ea8fe38....0.tmp
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/ap.Lock
/data/data/####/ax_c.xml
/data/data/####/c331a889-47c6-410c-bb28-5bbf6ba2bfe7
/data/data/####/c7e944713dd2a722fe42e4a34ecaa378413ef4e6a76e9a0....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/cn.push.preferences.v2.rid.xml
/data/data/####/cn.push.preferences.v2.xml
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/com.im.keyValueStore.aes_key_store.xml
/data/data/####/com.im.keyValueStore.config_store.xml
/data/data/####/com.im.keyValueStore.sdk_version_store.xml
/data/data/####/com.im_7.1.0.db
/data/data/####/com.im_7.1.0.db-journal
/data/data/####/com.push.sdk.user.profile.xml
/data/data/####/com.tencent.open.config.json.1105964143
/data/data/####/com.yunju.dailynews.xml
/data/data/####/com.yunju.dailynews.xml.bak
/data/data/####/com.yunju.dailynews_preferences.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/core_info
/data/data/####/d2d28e1b874eab72dcf67b0bc65390f6a27c2c9f63d72f9....0.tmp
/data/data/####/d519ab1d488d734a94ab05282625074ee989c8953a59ef5....0.tmp
/data/data/####/d818968bae61d05b0fbde8c99d4eb11178e6050f8391a16....0.tmp
/data/data/####/dab180d0e97d561cb66fb213e8cbffab91685836d29728e....0.tmp
/data/data/####/db7d300a3287517f8032df05db5d04ae7625b1f0c0159b9....0.tmp
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/dexMethod.82560842.dat
/data/data/####/e55475488ca85a94c7c6e4d88339e40e
/data/data/####/e55475488ca85a94c7c6e4d88339e40e-journal
/data/data/####/e5d633d415dc3b61094c92b8099540d0774fb8ea709e8d3....0.tmp
/data/data/####/eudemon
/data/data/####/f83d798ab6cc62b5b9581b87adc74ed09df30b2e2517b36....0.tmp
/data/data/####/fm_shared.xml
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/hh_8.4.dex
/data/data/####/hh_8.4.dex (deleted)
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jqIqJYOT3JpT-journal
/data/data/####/libjiagu1502583314.so
/data/data/####/libyaqbasic.82560842.so
/data/data/####/libyaqpro.82560842.so
/data/data/####/linkedme_link_active_sp.xml
/data/data/####/loc_plugin.dex
/data/data/####/loc_plugin.ini
/data/data/####/mc120.dex
/data/data/####/mc_cache.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/push_device_info.xml
/data/data/####/push_stat_cache.json
/data/data/####/push_stat_cache_history.json
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/td_fm.jar
/data/data/####/testin.data.allocation.0e21432b0dada125891821d3...eb.xml
/data/data/####/testin.data.identify.xml
/data/data/####/testinad-journal
/data/data/####/testinbug-journal
/data/data/####/testindata-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/update_lc
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/yaqsdkcookie
/data/data/####/ymdex.jar
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid2
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid2
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid2
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid2
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.acid
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.cuid
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.cuid2
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid2
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.acid
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.cuid
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.cuid2
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid2
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid2
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.acid
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.cuid
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.cuid2
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.acid
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.cuid
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.cuid2
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid2
/data/media/####/.54835cf5b563a206fd5112aa828721d9.acid
/data/media/####/.54835cf5b563a206fd5112aa828721d9.cuid
/data/media/####/.54835cf5b563a206fd5112aa828721d9.cuid2
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid2
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid2
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid2
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid2
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid2
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid2
/data/media/####/.8d777f385d3dfec8815d20f7496026dc.acid
/data/media/####/.8d777f385d3dfec8815d20f7496026dc.cuid
/data/media/####/.8d777f385d3dfec8815d20f7496026dc.cuid2
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid2
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid2
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid2
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid2
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid2
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid2
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid2
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid2
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid2
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid2
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/.td-3
/data/media/####/.tdck
/data/media/####/1ac6dd2181664df58fc372f2fe4b5c54
/data/media/####/249c96e7254d4da8bebcaa324d546dcc
/data/media/####/4DyOQTU2bbOx00gaPOkL6g
/data/media/####/6aec9720a848428bb6fe3e4dca210bdb
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/aacout
/data/media/####/axacount
/data/media/####/com.tencent.mobileqq_connectSdk.19.02.23.16.log
/data/media/####/cusc
/data/media/####/cusc2
/data/media/####/cusys
/data/media/####/cusys2
/data/media/####/f84678cffc1246ae960eed3cab72ed9d
/data/media/####/qtac
/data/media/####/systemccu
/data/media/####/systemccu2
/data/media/####/tbslog.txt
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"24720081","utdid":"XHF2BmvmSAwDAGdzx1FYLsl0","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /sys/class/net/wlan0/address
chmod 444/storage/emulated/0/.td-3
chmod 444/storage/emulated/0/.tdck
chmod 444/storage/emulated/0/Alarms/.td-3
chmod 444/storage/emulated/0/Alarms/.tdck
chmod 444/storage/emulated/0/DCIM/.tdck
chmod 444/storage/emulated/0/Download/.td-3
chmod 444/storage/emulated/0/Download/.tdck
chmod 444/storage/emulated/0/Notifications/.td-3
chmod 444/storage/emulated/0/Notifications/.tdck
chmod 444/storage/emulated/0/Podcasts/.tdck
chmod 444/storage/emulated/0/axacount/.td-3
chmod 444/storage/emulated/0/axacount/.tdck
chmod 444/storage/emulated/0/cusc/.td-3
chmod 444/storage/emulated/0/cusc/.tdck
chmod 444/storage/emulated/0/cusc2/.tdck
chmod 444/storage/emulated/0/cusys2/.td-3
chmod 444/storage/emulated/0/cusys2/.tdck
chmod 444/storage/emulated/0/systemccu/.td-3
chmod 444/storage/emulated/0/systemccu/.tdck
chmod 444/storage/emulated/0/tencent/.tdck
chmod 444/storage/emulated/0/testin/.td-3
chmod 444/storage/emulated/0/testin/.tdck
chmod 444/storage/emulated/0/wcout/.td-3
chmod 444/storage/emulated/0/wcout/.tdck
chmod 444/storage/emulated/0/wxt/.td-3
chmod 444/storage/emulated/0/wxt/.tdck
chmod 444/storage/emulated/0/wxtac/.td-3
chmod 444/storage/emulated/0/wxtac/.tdck
chmod 500 <Package Folder>/files/DaemonServer
df
getprop
getprop net.dns1
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
id
ls -i
ls -l
ls -l /system/xbin/su
mount
ps
sh
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/devices
sh -c cat /proc/mounts
sh -c cat /proc/partitions
sh -c cat /proc/self/maps
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh /data/user/0/<Package>/files/T01NWuXTzUuLGW3HqLEzDE9CkuJjhH7E
sh /data/user/0/<Package>/files/T4cYLuMakAFfedp5aZG45kIgNm29ydbw
sh /data/user/0/<Package>/files/T5TdEGUOlX8uoGRz87Bz0EiccHguAgw3
sh /data/user/0/<Package>/files/T5oSrQ3BMt-p6Z24IoMeMUFOMCMp8zoB
sh /data/user/0/<Package>/files/T8tbVOQXhioqN6RW8bqbO0t5IyWVMbOB
sh <Package Folder>/files/T-3rLHJEpuO9TlXsbpef0E-icLYv53mZ
sh <Package Folder>/files/T-CUIqP2dyJ_KJHHs6vq3UuPPKX52foB
sh <Package Folder>/files/T0P0lSmGoh3qGZmfo4Y_vU6R7tXBSp0O
sh <Package Folder>/files/T0vY7TrQeGXvto5lr6dbnkOtiye81bGj
sh <Package Folder>/files/T1K_trh5chIn1T3VRpmZK0bOsRLwxcKF
sh <Package Folder>/files/T1Na0vQ9UBrpKcPEQo-X10RHv_6DVxCd
sh <Package Folder>/files/T1sFwowouRAmufzdyZTehUnjEsKv5aIQ
sh <Package Folder>/files/T2CpvrKWfecvoywUx6EBvEalZ2aAuOEA
sh <Package Folder>/files/T2HWkoKFiMUuOiDPMrzKFUqRQ9Th-9XB
sh <Package Folder>/files/T3ExInWFvNYfvu9uk7fIm09UuyCxo4pQ
sh <Package Folder>/files/T4_gs9ZEYgYU8i0twoERL0TlTo5R01CF
sh <Package Folder>/files/T5Md3qJ7oEyS_UBEdIcKHESqtvo6oQZv
sh <Package Folder>/files/T5NQJEGg7UUihaln_pG2pUTvF5ov2xwW
sh <Package Folder>/files/T5doxziIq6F9g1IuUqj8g0aUOpGLuDHe
sh <Package Folder>/files/T6avHetrn_ksykNTOo3o30Trzb8wuJ8N
sh <Package Folder>/files/T6oU07we63R2bAN4-aFjw0QpiXpsITWx
sh <Package Folder>/files/T6rBDnBDxxsERTo-QJVZHkmuObCx1C4w
sh <Package Folder>/files/T6wzEAam09YWIoOl8pxH30G5d981H2ml
sh <Package Folder>/files/T6xwJGN3o9zR6LEee4yqG050-_imX73P
sh <Package Folder>/files/T7QQqH0ZLvMy42aslJfwL0gV1reQ7cXL
sh <Package Folder>/files/T7f2TGMUffJ-tYyy5I9RQULBGhyz6c3w
sh <Package Folder>/files/T87EV9Uyp4mFScrsEabR-U-NGQLJOiU7
sh <Package Folder>/files/T9FrH2ExlAW1j7nzy7vSkkPdVoTu9mWZ
sh <Package Folder>/files/T9GxlDIF5yFIg-DRspedDkhTNbRhEt5d
sh <Package Folder>/files/T9Z63ozSpHRblsgawYoJZEMxgmVqEib7
sh <Package Folder>/files/T9akiM7CjhpdPhjAlI-LlEU7dFEMgABZ
sh <Package Folder>/files/T_3T1jgV9LaBp3lJdIq7EkveqqOLJNxa
sh <Package Folder>/files/T_V6oXVJUTEYqycXd5i7i0YfgXEwhDya
sh <Package Folder>/files/TwWCO9G1-FEeDWpE-LGUSk7tbLssbHBG
sh <Package Folder>/files/TwZyQucTTvGhYB8tirMsiENtaSMyQLLw
sh <Package Folder>/files/TwmOmXnCf0yBbTvHcoJiBECU5JxV6bl-
sh <Package Folder>/files/Tx_DOGEPlVSjPTeZr5byeEmOXZtxraKi
sh <Package Folder>/files/TyeZLPOa8W_xbVQJ2rhzz0zO67GsaFeT
sh <Package Folder>/files/Tyf-t_OYvdjPVmkZboEkok5qrn53U7VU
sh <Package Folder>/files/Tz-IZqaZb1UjrPi6eYoCCE_FZFD1CCd9
sh <Package Folder>/files/Tz4p9EfVKZrqLuyXYq257Eu91NYVeG93
sh <Package Folder>/files/TzkuJUiCb9_KfqhSkqETjk0Wbk7_1fea
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat app
stat cat
stat etc
stat net
stat random
uname -a
uname -r

Loads the following dynamic libraries:

InnoSo
bugout-ndk
jcore123
libjiagu1502583314
libyaqbasic.82560842
libyaqpro.82560842
native-lib
tnet-3.1
tongdun
ut_c_api

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
PBEWITHMD5andDES
RSA-ECB-NoPadding
RSA-ECB-nopadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
PBEWITHMD5andDES
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial