Android.RemoteCode.8144

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin
Android.RemoteCode.358.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) tv.hub.dianshi####.com:80
TCP(HTTP/1.1) 1####.161.124.146:12340
TCP(HTTP/1.1) vod####.ip####.q####.####.com:80
TCP(HTTP/1.1) im.dianshi####.com:80
TCP(HTTP/1.1) i####.k####.com.####.com:80
TCP(HTTP/1.1) api.dianshi####.com:80
TCP(HTTP/1.1) tra####.dians####.com:80
TCP(HTTP/1.1) dd2.wuko####.com:80
TCP(HTTP/1.1) 64.2####.162.94:80
TCP(HTTP/1.1) cdn.dianshi####.com:80
TCP(HTTP/1.1) cdn.api.dianshi####.com:80
TCP(HTTP/1.1) 1####.56.125.184:80
TCP(HTTP/1.1) c####.dianshi####.com.####.com:80
TCP(HTTP/1.1) 39.1####.143.44:8001
TCP(HTTP/1.1) ask.log.k####.com:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) adash####.man.aliy####.com:80
TCP(TLS/1.0) plb####.u####.com:443
TCP(TLS/1.0) to####.ctobsn####.com.####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) ask.log.k####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) 64.2####.162.94:443
TCP(TLS/1.0) card####.k####.com.####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) d####.100u####.com.####.net:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 64.2####.162.101:443
TCP(TLS/1.2) 1####.177.14.147:443
TCP(TLS/1.2) 64.2####.162.94:443
UDP tm2.binst####.live:13
TCP ms####.m.u####.com:443
UDP tm4.binst####.live:3923
UDP tm3.binst####.live:3923
TCP 1####.20.60.53:12354
UDP tm2.binst####.live:3923
UDP 39.1####.134.87:3479
UDP 1####.194.163.20:443
UDP 1####.194.163.36:443
UDP tm3.binst####.live:13
UDP 2####.255.255.250:1900
UDP tm3.binst####.live:3924
UDP 39.1####.62.19:3478
UDP as1.binst####.live:13
UDP as1.binst####.live:3924
UDP as1.binst####.live:3923
TCP ms####.m.u####.com:80
UDP www.google####.com:443
UDP tm2.binst####.live:3924
UDP tm4.binst####.live:3924

DNS requests:

a####.man.aliy####.com
ad-temp####.k####.com
amdc####.m.ta####.com
and####.b####.qq.com
api.dians####.com
api.dianshi####.com
api.liulian####.com
api.shoujid####.cn
api.tv####.com
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
ask.log.k####.com
c####.dianshi####.com
card####.k####.com
cdn.api.dianshi####.com
cdn.dianshi####.com
cha####.cdn.dianshi####.com
d####.100u####.com
dd2.wuko####.com
g3.l####.com
hub.dianshi####.com
i####.k####.com
im.dianshi####.com
m####.go####.com
msg.umengc####.com
p####.dianshi####.com
plb####.u####.com
rr9---s####.g####.com
sdk.a####.cn
t####.k####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
to####.ctobsn####.com
tra####.dians####.com
tv.hub.dianshi####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
www.go####.com
www.google####.com

HTTP GET requests:

api.dianshi####.com/api/cash/info
api.dianshi####.com/api/coin/info
api.dianshi####.com/api/config/deviceCompat?brand=####&model=####&osver=...
api.dianshi####.com/api/kuyun/list
api.dianshi####.com/api/pan/v1/config/global
api.dianshi####.com/api/pan/v2/space/report?actType=####
api.dianshi####.com/api/pan/v2/ufile/list/family?page=####&size=####&glo...
api.dianshi####.com/api/pan/v2/ufile/list/theme?page=####&size=####&glob...
api.dianshi####.com/api/redpack/info
api.dianshi####.com/api/song/get?page=####&size=####&tagCode=####
api.dianshi####.com/api/sport/list?columnId=####&page=####&pageSize=####...
api.dianshi####.com/api/task/get?
api.dianshi####.com/api/tv/v1/hotchannels?type=####
api.dianshi####.com/api/tvSkin?menunum=####
api.dianshi####.com/api/user/familyAccount/user/getStatus
api.dianshi####.com/api/v1/cloudConfig?ts=####
api.dianshi####.com/api/v1/play/control
api.dianshi####.com/api/v1/plugin?module=####&verCode=####&aver=####&tm=...
api.dianshi####.com/api/v1/plugin?module=####&verCode=####&sdk=####&aver...
api.dianshi####.com/api/v1/user/favorite/get
api.dianshi####.com/api/v17config?type=####&ts=####
api.dianshi####.com/api/v2/song/remind?type=####
api.dianshi####.com/api/v2/user/wx/helplogin
api.dianshi####.com/api/v24/apiConfig
api.dianshi####.com/api/v3/offProgram
api.dianshi####.com/api/v6/channels?ts=####
api.dianshi####.com/apiion
api.dianshi####.com/cfbqbczu?ts=####
api.dianshi####.com/gslb/channel/stream?region=####&isp=####&tm=####&uui...
api.dianshi####.com/ipInfo
ask.log.k####.com/check.do?pid=####&thread_id=####&copyright_id=####&mac...
ask.log.k####.com:443/api/tvsdk/config?ltu=####&bssid=####&sign=####&p_m...
ask.log.k####.com:443/api/tvsdk/prepare?sign=####&request_id=####&mac=##...
ask.log.k####.com:443/api/tvsdk/update?sign=####&mac=####&app_id=####&ti...
c####.dianshi####.com.####.com/api/config/hotChannelTvTypeOne
c####.dianshi####.com.####.com/static/plugin/2c33bd0922058fab1090c221310...
c####.dianshi####.com.####.com/static/plugin/434f9e597755246cfd40f6560c6...
c####.dianshi####.com.####.com/static/plugin/4433709d41777b11ec8dba036a1...
c####.dianshi####.com.####.com/static/plugin/7b2267f9f4f7d9e7c3a360950e3...
c####.dianshi####.com.####.com/static/plugin/e61e185ab965bdd02d59332804a...
c####.dianshi####.com.####.com/static/plugin/e72ccc3cb278342d49769eb0a49...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/-131208...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/-274345...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/-742603...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/-744616...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/-749427...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/-785732...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/-887774...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/2379617...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/2551648...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/4351071...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/5038105...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/5359987...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/7589598...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/8029008...
card####.k####.com.####.com:443/media/cdn/prod/ad-card-templates/8143282...
card####.k####.com.####.com:443/pro/protocol/2021/7/27/10/17/29/16273522...
card####.k####.com.####.com:443/pro/protocol/2022/11/7/11/39/48/16677923...
cdn.api.dianshi####.com/api/programs?cid=####&date=####&tm=####
cdn.dianshi####.com/assets/mobile/temp/ts_cf.json?ts=####
cdn.dianshi####.com/assets/tvTea.json
cdn.dianshi####.com/config/channel/voice_mapping.json
cdn.dianshi####.com/pkg/tv3.0/image/gw_time.txt
cdn.dianshi####.com/pkg/tv3.0/image/hdlogo.png
dd2.wuko####.com/tvclient/sdk?func=####&package=####
g3.l####.com/r?format=####
i####.k####.com.####.com/pro/ad/sdk/jar/2020/11/25/10/46/37272382_160627...
im.dianshi####.com/ws/v2
to####.ctobsn####.com.####.com:443/service/2/app_alert_check/?aid=####&t...
tra####.dians####.com/config?appid=####&uuid=####&cver=####
vod####.ip####.q####.####.com/api/channel/v1/template/detail?templateKey...

HTTP POST requests:

adash####.man.aliy####.com/man/api?ak=####&s=####
and####.b####.qq.com/rqd/async?aid=####
api.dianshi####.com/api/pay/documents
api.dianshi####.com/api/v2/device/info?duid=####&c=####&
ask.log.k####.com/template/check/0/00:00:00:00:00:03/0/1001
ask.log.k####.com/template/check/92/00:00:00:00:00:03/0/1001
d####.100u####.com.####.net:443/reportcomp
msg.umengc####.com:443/tag/add
plb####.u####.com:443/umpx_internal
plb####.u####.com:443/umpx_push_register
to####.ctobsn####.com.####.com:443/service/2/abtest_config/?&os_api=####...
to####.ctobsn####.com.####.com:443/service/2/app_log/?device_platform=##...
to####.ctobsn####.com.####.com:443/service/2/device_register/?aid=####&t...
to####.ctobsn####.com.####.com:443/service/2/log_settings/?device_platfo...
tv.hub.dianshi####.com/u
u####.u####.com:443/unify_logs

File system changes:

Creates the following files:

/data/data/####/-1312085025145288056
/data/data/####/-2743456424884803974
/data/data/####/-7426031560413407583
/data/data/####/-7446161929431181060
/data/data/####/-7494275546626564738
/data/data/####/-7857323045930740017
/data/data/####/-8877748838519959376
/data/data/####/.cl
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1002
/data/data/####/1004
/data/data/####/1cba9979b2d36864387f3d4fe1447e74.0.tmp
/data/data/####/1cba9979b2d36864387f3d4fe1447e74.1
/data/data/####/1cba9979b2d36864387f3d4fe1447e74.1.tmp
/data/data/####/20ebfa2c29c5691608e6f1a11dc1be3b.0.tmp
/data/data/####/20ebfa2c29c5691608e6f1a11dc1be3b.1
/data/data/####/20ebfa2c29c5691608e6f1a11dc1be3b.1.tmp
/data/data/####/2379617456227033167
/data/data/####/2417ba26b88dcef7267b728cc96a0d49.0.tmp
/data/data/####/2417ba26b88dcef7267b728cc96a0d49.1
/data/data/####/2417ba26b88dcef7267b728cc96a0d49.1.tmp
/data/data/####/2551648898271211911
/data/data/####/325dd77e835cecff2003329b751b13bd.0
/data/data/####/325dd77e835cecff2003329b751b13bd.1
/data/data/####/33839264ffbf567dfc914b717a080e54.0.tmp
/data/data/####/33839264ffbf567dfc914b717a080e54.1
/data/data/####/33839264ffbf567dfc914b717a080e54.1.tmp
/data/data/####/35f9b9432c52e0a0a2d41af56a14a733.0
/data/data/####/35f9b9432c52e0a0a2d41af56a14a733.0.tmp
/data/data/####/35f9b9432c52e0a0a2d41af56a14a733.1
/data/data/####/35f9b9432c52e0a0a2d41af56a14a733.1.tmp
/data/data/####/3a2db3b734530a6b7427e7989b9f7277.0.tmp
/data/data/####/3a2db3b734530a6b7427e7989b9f7277.1
/data/data/####/421563956e4461b88c4860f73d5c4795.0.tmp
/data/data/####/421563956e4461b88c4860f73d5c4795.1
/data/data/####/421563956e4461b88c4860f73d5c4795.1.tmp
/data/data/####/4351071184899779741
/data/data/####/4adc6fc6d3390c5878ae766bd69949b9.0.tmp
/data/data/####/4adc6fc6d3390c5878ae766bd69949b9.1
/data/data/####/4adc6fc6d3390c5878ae766bd69949b9.1.tmp
/data/data/####/4c149f56a2f37c4bc78ab80b0ba77450.0.tmp
/data/data/####/4c149f56a2f37c4bc78ab80b0ba77450.1
/data/data/####/4e536cc5a48c9165583064b722efe87b.0.tmp
/data/data/####/4e536cc5a48c9165583064b722efe87b.1
/data/data/####/4e536cc5a48c9165583064b722efe87b.1.tmp
/data/data/####/5038105548106165173
/data/data/####/5359987358570622407
/data/data/####/56a5c25b6c7f92fb587aa5a1b7fda0c4.0.tmp
/data/data/####/56a5c25b6c7f92fb587aa5a1b7fda0c4.1
/data/data/####/5807f5f03e379a777988c112d3a589e9.0.tmp
/data/data/####/5807f5f03e379a777988c112d3a589e9.1
/data/data/####/5807f5f03e379a777988c112d3a589e9.1.tmp
/data/data/####/63cde9655e58a6bf5cd3fa408cabc928.0.tmp
/data/data/####/63cde9655e58a6bf5cd3fa408cabc928.1
/data/data/####/63cde9655e58a6bf5cd3fa408cabc928.1.tmp
/data/data/####/7589598016718928432
/data/data/####/79f56bfdbab87eae36d3bda940ffb3e2.0.tmp
/data/data/####/79f56bfdbab87eae36d3bda940ffb3e2.1
/data/data/####/79f56bfdbab87eae36d3bda940ffb3e2.1.tmp
/data/data/####/7eeea6db125210d689d9d7b7d4dacac8.0.tmp
/data/data/####/7eeea6db125210d689d9d7b7d4dacac8.1
/data/data/####/7eeea6db125210d689d9d7b7d4dacac8.1.tmp
/data/data/####/8029008679275673073
/data/data/####/8143282645073951774
/data/data/####/81b02692d6e9c790a85f08f4e48be0ce.0
/data/data/####/81b02692d6e9c790a85f08f4e48be0ce.0.tmp
/data/data/####/81b02692d6e9c790a85f08f4e48be0ce.1
/data/data/####/81b02692d6e9c790a85f08f4e48be0ce.1.tmp
/data/data/####/873b57dfadb6293c9ae6582b92d2d502.0.tmp
/data/data/####/873b57dfadb6293c9ae6582b92d2d502.1
/data/data/####/92926eacc676308d0819e18dd10ba7bc.0.tmp
/data/data/####/92926eacc676308d0819e18dd10ba7bc.1
/data/data/####/92926eacc676308d0819e18dd10ba7bc.1.tmp
/data/data/####/961e787e1d22a1b113386d9e2fe5d5e8.0.tmp
/data/data/####/961e787e1d22a1b113386d9e2fe5d5e8.1.tmp
/data/data/####/ACCS_BINDumeng;5912cd5f1061d264c8000455.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK.xml.bak
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/BOOT_AD_CONFIG.xml
/data/data/####/CONFIG.xml
/data/data/####/CONFIG.xml.bak
/data/data/####/CUSTOM_CONFIG.xml
/data/data/####/CUSTOM_CONFIG.xml.bak
/data/data/####/ContextData.xml
/data/data/####/DEVICE_INFO.xml
/data/data/####/DEVICE_INFO.xml.bak
/data/data/####/DOWNLOAD_END_AD.xml
/data/data/####/END_AD.xml
/data/data/####/END_AD_BOOT.xml
/data/data/####/EVENT_CONFIG.xml
/data/data/####/LIVE_CONFIG.xml
/data/data/####/LIVE_CONFIG.xml.bak
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PERMANENT_DATA.xml
/data/data/####/PLAY.xml
/data/data/####/PLAY_CONFIG.xml
/data/data/####/PLAY_CONFIG.xml.bak
/data/data/####/SWITCH_CONFIG.xml
/data/data/####/SWITCH_CONFIG.xml.bak
/data/data/####/SYSTEM_INFO.xml
/data/data/####/TAG_URL_SPEC_STREAM_IMAGE_VIP.jpg
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/USER_INFO.xml
/data/data/####/USER_INFO.xml.bak
/data/data/####/a7229fec28d20d696a701e6bb0bfb2d5.0.tmp
/data/data/####/a7229fec28d20d696a701e6bb0bfb2d5.1
/data/data/####/a7229fec28d20d696a701e6bb0bfb2d5.1.tmp
/data/data/####/accs.db-journal
/data/data/####/acd688c11cd8e35d1497fdf279e7412a.0.tmp
/data/data/####/acd688c11cd8e35d1497fdf279e7412a.1
/data/data/####/acd688c11cd8e35d1497fdf279e7412a.1.tmp
/data/data/####/ad_templates_1001.xml
/data/data/####/ad_u_1001.xml
/data/data/####/agoo.pid
/data/data/####/agreement.xml
/data/data/####/agreement.xml.bak
/data/data/####/api.prefs.xml
/data/data/####/api.prefs.xml.bak
/data/data/####/applog_stats.xml
/data/data/####/b31b3a7f587eb677b5ccb50087b6cfe9.0.tmp
/data/data/####/b31b3a7f587eb677b5ccb50087b6cfe9.1
/data/data/####/b31b3a7f587eb677b5ccb50087b6cfe9.1.tmp
/data/data/####/b4fd029fb389fec7311445366f1fcd9e.0.tmp
/data/data/####/b4fd029fb389fec7311445366f1fcd9e.1
/data/data/####/b4fd029fb389fec7311445366f1fcd9e.1.tmp
/data/data/####/b8dfc3554a428d0b07cedd65d59bd726.0.tmp
/data/data/####/b8dfc3554a428d0b07cedd65d59bd726.1
/data/data/####/b8dfc3554a428d0b07cedd65d59bd726.1.tmp
/data/data/####/bb4fed2fb01c51846a78e15f3d0c29e7.0.tmp
/data/data/####/bb4fed2fb01c51846a78e15f3d0c29e7.1
/data/data/####/bb4fed2fb01c51846a78e15f3d0c29e7.1.tmp
/data/data/####/bd_tea_agent.db-journal
/data/data/####/bugly_db_-journal
/data/data/####/c0968fa531339178b2ed07e203745184.0.tmp
/data/data/####/c0968fa531339178b2ed07e203745184.1
/data/data/####/c0968fa531339178b2ed07e203745184.1.tmp
/data/data/####/c95e8fe89978e95a87f3dc7734ccf9d8
/data/data/####/channels.data
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/com.dianshijia.newlive.BETA_VALUES.xml
/data/data/####/com.dianshijia.newlive_preferences.xml
/data/data/####/conf.dat
/data/data/####/count_shop_tip.xml
/data/data/####/crashrecord.xml
/data/data/####/cuuid.xml
/data/data/####/cuuid.xml.bak
/data/data/####/d2ed5397160ed6516b6104a98841b262.0.tmp
/data/data/####/d2ed5397160ed6516b6104a98841b262.1
/data/data/####/d2ed5397160ed6516b6104a98841b262.1.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNjk0Nzg2NDI4NzIw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjk0Nzg2NDIyMjg1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjk0Nzg2NDYyNzI5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjk0Nzg2NDgxMzMw;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE2OTQ3ODY0NjQxOTQ=;
/data/data/####/device_identification_info.xml
/data/data/####/device_preference_1001.xml
/data/data/####/ebb3a33f8c89c81cf5b3efc0ba0be4f5.0.tmp
/data/data/####/ebb3a33f8c89c81cf5b3efc0ba0be4f5.1
/data/data/####/ebb3a33f8c89c81cf5b3efc0ba0be4f5.1.tmp
/data/data/####/ec5cec65369ee3625ada55830c97fe85.0.tmp
/data/data/####/ec5cec65369ee3625ada55830c97fe85.1
/data/data/####/ec63e46aac28de4b38a1a0bb5e204205.0.tmp
/data/data/####/ec63e46aac28de4b38a1a0bb5e204205.1
/data/data/####/ec63e46aac28de4b38a1a0bb5e204205.1.tmp
/data/data/####/epg.dex
/data/data/####/epg.dex.flock (deleted)
/data/data/####/epg.jar
/data/data/####/epg.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f1e2f6b762ba97d485c14a63c5ddcdd9.0
/data/data/####/f1e2f6b762ba97d485c14a63c5ddcdd9.1
/data/data/####/fb6af786f26a2595b3be0ff754fb377a.0.tmp
/data/data/####/fb6af786f26a2595b3be0ff754fb377a.1
/data/data/####/fb6af786f26a2595b3be0ff754fb377a.1.tmp
/data/data/####/header_custom.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_cache.xml.bak
/data/data/####/i==1.2.0&&3.5.10_1694786423687_envelope.log
/data/data/####/i==1.2.0&&3.5.10_1694786428727_envelope.log
/data/data/####/i==1.2.0&&3.5.10_1694786462937_envelope.log
/data/data/####/i==1.2.0&&3.5.10_1694786481756_envelope.log
/data/data/####/info.xml
/data/data/####/inject_track.xml
/data/data/####/journal
/data/data/####/last_sp_session.xml
/data/data/####/launch.log
/data/data/####/libjiagu.so
/data/data/####/libsce.so
/data/data/####/libsce.so.temp
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/log_manager.xml
/data/data/####/material_break_point_info.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/net_node.xml
/data/data/####/okhttp_prefs.xml
/data/data/####/package_infos.xml
/data/data/####/package_infos.xml.bak
/data/data/####/player_strategy.xml
/data/data/####/player_strategy.xml.bak
/data/data/####/plugin.dex
/data/data/####/plugin.dex.flock (deleted)
/data/data/####/plugin.tmp
/data/data/####/plugin_break_point_info.xml
/data/data/####/plugin_config.xml
/data/data/####/pp.dex
/data/data/####/pp.dex.flock (deleted)
/data/data/####/pp.jar
/data/data/####/pp.tmp
/data/data/####/privacy_agreement
/data/data/####/proc_auxv
/data/data/####/promote.dex
/data/data/####/promote.dex.flock (deleted)
/data/data/####/promote.tmp
/data/data/####/promote.tmp (deleted)
/data/data/####/risk_infos.xml
/data/data/####/risk_infos.xml.bak
/data/data/####/risk_user_info.xml
/data/data/####/safe_mode_config.xml
/data/data/####/sce_config.xml
/data/data/####/sce_config.xml.bak
/data/data/####/security_info
/data/data/####/skin_cache_name.xml
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_key_stream.xml
/data/data/####/spider_prefs.xml
/data/data/####/t==8.1.3&&3.5.10_1694786423046_envelope.log
/data/data/####/tv_name_id_map.xml
/data/data/####/tvcore.tmp
/data/data/####/tvlive2.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/user.xml
/data/data/####/user_agreement
/data/data/####/x_google_ad_s_id_123
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/ddev.data
/data/media/####/deviceToken
/data/media/####/device_parameters.dat
/data/media/####/flag.data
/data/media/####/sysid.dat
/data/media/####/uuid.data
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor0
getprop
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls /
ls /sys/class/thermal
sh

Loads the following dynamic libraries:

libBugly
libEncryptorP
libc++_shared
libjiagu
libmmkv
libsce
libtnet-3.1.14
libtvcore

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
DES

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial