Android.Click.1887

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Click.1620

Network activity:

Connects to:

UDP(???) and####.google####.com:443
UDP(???) pla####.google####.com:443
UDP(???) rr6---s####.g####.com:443
TCP(???) c####.u####.online:4443
UDP(???) and####.a####.go####.com:443
UDP(???) 1####.43.61.142:443
TCP(???) 1####.46.66.113:7006
TCP(???) 27.44.2####.28:21000
TCP(???) s.zhineng####.cn:443
UDP(???) easytom####.com:19000
UDP(???) 1####.43.61.144:443
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) s.zhineng####.cn:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(TLS/1.0) s.zhineng####.cn:443
TCP(TLS/1.0) f####.j####.cn:443
TCP(TLS/1.0) 1####.43.61.144:443
TCP(TLS/1.0) bj####.j####.cn:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) ce3e####.j####.cn:443
TCP(TLS/1.0) c####.u####.online:4443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) alog-de####.u####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) sdk.verific####.jig####.cn:443
TCP(TLS/1.0) pushsty####.qini####.com:443
TCP(TLS/1.0) tbsreco####.i####.qq.com:443
TCP(TLS/1.0) fe-####.cn-hang####.log.####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) co####.j####.cn:443
TCP(TLS/1.0) b.u####.com.cn:9903
TCP(TLS/1.0) c####.u####.online:443
TCP(TLS/1.0) ad####.zhineng####.cn:443
TCP(TLS/1.2) 1####.217.17.206:443
TCP(TLS/1.2) 2####.239.38.223:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 1####.251.151.119:443

DNS requests:

ad####.zhineng####.cn
ads.zhineng####.cn
alog-de####.u####.com
and####.a####.go####.com
and####.b####.qq.com
and####.cli####.go####.com
and####.google####.com
android####.go####.com
api-mar####.zhineng####.cn
b.u####.com.cn
bj####.j####.cn
c####.u####.online
ce3e####.j####.cn
co####.cmpass####.com
co####.j####.cn
connect####.gst####.com
easytom####.com
er####.u####.com.####.com
f####.j####.cn
fe-####.cn-hang####.log.####.com
firebas####.google####.com
i####.me
i.y####.com
l####.cmpass####.com
new-####.u####.com
o####.e.189.cn
one####.cmpass####.com
pho####.u####.online
pla####.google####.com
pla####.googleu####.com
playsto####.google####.com
prod-lt####.google####.com
pushsty####.qini####.com
rr6---s####.g####.com
s.j####.cn
s.zhineng####.cn
sdk.verific####.jig####.cn
sis.j####.io
smartop####.jig####.cn
tbsreco####.i####.qq.com
u####.u####.com
wap.cmpass####.com
www.cmpass####.com

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
s.zhineng####.cn/t/boot

File system changes:

Creates the following files:

/data/app/####/.x86_64
/data/app/####/com.android.vending.apk
/data/app/####/config.en
/data/app/####/config.x86_64
/data/app/####/libandroidx.graphics.path.so
/data/app/####/libapkanalysis.so
/data/app/####/libbrotli.so
/data/app/####/libcronet.151.0.7922.71.so
/data/app/####/libmappedcountercacheversionjni.so
/data/app/####/libtensorflowlite_jni.so
/data/app/####/libzucchini.so
/data/app/####/libzwrapper.so
/data/data/####/.fsgkea
/data/data/####/.imprint
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/0a1e73bf-52a3-4994-b1d2-a2f26a01048e
/data/data/####/1002
/data/data/####/1004
/data/data/####/1787012752621
/data/data/####/271b56dd-c8da-4850-bb59-b27a445d3a61
/data/data/####/479ea08d7aa8886d0dce75c32f939161.0.tmp
/data/data/####/479ea08d7aa8886d0dce75c32f939161.1
/data/data/####/479ea08d7aa8886d0dce75c32f939161.1.tmp
/data/data/####/4f82d59251ae71e89381b363eed570bb9339198bd33afd6....0.tmp
/data/data/####/4f82d59251ae71e89381b363eed570bb9339198bd33afd6...a790.0
/data/data/####/6aed41c1399aad8369218d7fa0df9a13.0.tmp
/data/data/####/6aed41c1399aad8369218d7fa0df9a13.1.tmp
/data/data/####/72c95403-983b-49d2-9193-b60838ea6b06
/data/data/####/824403aa-f0c5-470c-822b-18282abb0b2e
/data/data/####/8554907b5f54c76ff8648ffcc4c70c998370e7a1c2013a9....0.tmp
/data/data/####/8554907b5f54c76ff8648ffcc4c70c998370e7a1c2013a9...9cce.0
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DQEQqmzicnRf (deleted)
/data/data/####/GLTLhxuFjeIu (deleted)
/data/data/####/IpInfos.xml
/data/data/####/Push_Page_Config.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/USER_PROTOCOL.xml
/data/data/####/VERIFY_SP.xml
/data/data/####/VERIFY_SP.xml.bak
/data/data/####/VERSION_INFO.xml
/data/data/####/WEEX_VERSION_TYPE.xml
/data/data/####/WEEX_VERSION_TYPE.xml.bak
/data/data/####/WEEX_VERSION_TYPE.xml.bak (deleted)
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzU3N2M2MzQyZTBmNTVhMWQ4YTAwMThhZQ.sp
/data/data/####/Y29uZmlnXzU3N2M2MzQyZTBmNTVhMWQ4YTAwMThhZQ.sp.bak
/data/data/####/ani_config.cache
/data/data/####/b38fbf16c7cbb7461e6924216f2e288a.0.tmp
/data/data/####/b38fbf16c7cbb7461e6924216f2e288a.1
/data/data/####/b38fbf16c7cbb7461e6924216f2e288a.1.tmp
/data/data/####/bac.catch
/data/data/####/bugly_db_-journal
/data/data/####/bwc.catch
/data/data/####/c2e001ba-17b9-488f-91ad-c2ad8f1c64ad
/data/data/####/c3849b7ce6149117a4cb0ab1e1589052.0.tmp
/data/data/####/c3849b7ce6149117a4cb0ab1e1589052.1
/data/data/####/c3849b7ce6149117a4cb0ab1e1589052.1.tmp
/data/data/####/cab8a3518933eea302d939852c630043.0.tmp
/data/data/####/cab8a3518933eea302d939852c630043.1
/data/data/####/cab8a3518933eea302d939852c630043.1.tmp
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/classes.oat
/data/data/####/cn.jiguang.common.xml
/data/data/####/cn.jiguang.common.xml.bak
/data/data/####/cn.jiguang.joperate.jcore_config.xml
/data/data/####/cn.jiguang.jverify_v4.xml
/data/data/####/cn.jiguang.prefs.xml
/data/data/####/cn.jiguang.sdk.address.xml
/data/data/####/cn.jiguang.sdk.user.profile.xml
/data/data/####/cn.jiguang.union.ads.core.common.prefs.remote.xml
/data/data/####/cn.jiguang.union.ads.core.common.prefs.remote.xml.bak
/data/data/####/cn.jiguang.verifysdk.sms.xml
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.config.xml
/data/data/####/cn.jpush.config.xml.bak
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/cn.jpush.statistics.xml
/data/data/####/cn.jpush.statistics.xml.bak
/data/data/####/com.midea.vm.washer.BETA_VALUES.xml
/data/data/####/core_info
/data/data/####/crash_dump.log
/data/data/####/crashrecord.xml
/data/data/####/d7ac513d1142285918989965629e104f.0.tmp
/data/data/####/d7ac513d1142285918989965629e104f.1
/data/data/####/d7ac513d1142285918989965629e104f.1.tmp
/data/data/####/e1d86561-2d1d-4644-966a-a8f096a840b5
/data/data/####/efs_launch.xml
/data/data/####/efs_launch.xml.bak
/data/data/####/efsid
/data/data/####/efsid6056
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/i==1.2.0&&2.3.0_1787012753221_dW5pZnlfbG9ncw==;.log
/data/data/####/internal_debug.xml
/data/data/####/internal_debug.xml.bak
/data/data/####/itconfig.sp
/data/data/####/itconfig.sp.bak
/data/data/####/journal
/data/data/####/jpush_local_notification.db
/data/data/####/jpush_local_notification.db-journal
/data/data/####/jpush_local_notification.db-journal (deleted)
/data/data/####/jpush_local_notification.db-wal
/data/data/####/libjiagu.so
/data/data/####/libweexjsb.so
/data/data/####/load_statistic_cache.json
/data/data/####/local_crash_lock
/data/data/####/native_record_lock
/data/data/####/old_report_cache.l
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/prefs.lock
/data/data/####/proc_auxv
/data/data/####/push_stat_cache.json
/data/data/####/rl.catch
/data/data/####/sai.xml
/data/data/####/security_info
/data/data/####/sendlock
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/ssoconfigs.xml
/data/data/####/t==9.4.4&&2.3.0_1787012753405_dW5pZnlfbG9ncw==;.log
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_emergence.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/uifa.xml
/data/data/####/um_policy_grant.xml
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/um_umcrash.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak
/data/data/####/unique
/data/data/####/ver
/data/data/####/weex_default_settings.xml
/data/data/####/z==1.2.0&&2.3.0_1787012748162_emNmZw==;.log
/data/media/####/.push_deviceid
/data/media/####/1.png
/data/media/####/10.png
/data/media/####/2.png
/data/media/####/2026-08-18.txt
/data/media/####/3.png
/data/media/####/4.png
/data/media/####/6.png
/data/media/####/8.png
/data/media/####/9.png
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/abcPay.png
/data/media/####/abnormal.png
/data/media/####/actived-stamp@2x.png
/data/media/####/activestatus.js
/data/media/####/activity.js
/data/media/####/activity_redbag_bg@2x.png
/data/media/####/activity_redbag_icon@2x.png
/data/media/####/activity_redbag_order_icon.png
/data/media/####/ad-cmb-title.png
/data/media/####/ad-icon@2x.png
/data/media/####/ad_walfare.toggle.png
/data/media/####/ad_walfare.toggle_open.png
/data/media/####/ad_walfare_temp.png
/data/media/####/ad_welfare_bg.png
/data/media/####/add_icon@2x.png
/data/media/####/advImg.png
/data/media/####/agreement.js
/data/media/####/air_cold.png
/data/media/####/air_cold_active.png
/data/media/####/air_control_cut.png
/data/media/####/air_control_plus.png
/data/media/####/air_home.png
/data/media/####/air_hot.png
/data/media/####/air_hot_active.png
/data/media/####/air_icon.png
/data/media/####/air_wind.png
/data/media/####/air_wind2.png
/data/media/####/air_wind2_active.png
/data/media/####/air_wind_active.png
/data/media/####/air_winddir.png
/data/media/####/air_winddir_active.png
/data/media/####/alipay.png
/data/media/####/alliance.js
/data/media/####/apple.png
/data/media/####/applyrefund.js
/data/media/####/appointmentIcon.png
/data/media/####/arr-blue@2x.png
/data/media/####/arr-red@2x.png
/data/media/####/arrow-org@2x.png
/data/media/####/arrow-r-red.png
/data/media/####/arrowDown.png
/data/media/####/arrowIcon.png
/data/media/####/arrowRight.png
/data/media/####/arrowUp.png
/data/media/####/arrow_r.png
/data/media/####/arrow_right@3x.png
/data/media/####/arrow_right_blue copy.png
/data/media/####/arrow_right_blue.png
/data/media/####/back.png
/data/media/####/back_black@2x.png
/data/media/####/back_w.png
/data/media/####/balanceInsufficient.js
/data/media/####/bg.png
/data/media/####/bindWaterCard.js
/data/media/####/bindalipay.js
/data/media/####/black_bg@2x.png
/data/media/####/bleLoding.gif
/data/media/####/bleTest.js
/data/media/####/ble_connecting.gif
/data/media/####/bleopenguide.png
/data/media/####/blue_hint@2x.png
/data/media/####/bluetoothConnect.js
/data/media/####/boComPay.png
/data/media/####/bocPay.png
/data/media/####/bootstrap.js
/data/media/####/bottom_bg@2x.png
/data/media/####/box.png
/data/media/####/box_device.png
/data/media/####/box_select.png
/data/media/####/btn_scale.gif
/data/media/####/bubble.png
/data/media/####/buySuccess.js
/data/media/####/buyticket.js
/data/media/####/campusOneCardPay.png
/data/media/####/cashier.js
/data/media/####/cashierNew.js
/data/media/####/ccbPay.png
/data/media/####/cf_device.png
/data/media/####/check@2x.png
/data/media/####/check_@3x.png
/data/media/####/checked_@3x.png
/data/media/####/choosebathroom.js
/data/media/####/chuifeng@3x.png
/data/media/####/close.png
/data/media/####/close@3x.png
/data/media/####/closeTips.png
/data/media/####/close_b@3x.png
/data/media/####/close_icon.png
/data/media/####/close_w@3x.png
/data/media/####/cmb-icon@2x.png
/data/media/####/cmbPay.png
/data/media/####/complete.png
/data/media/####/connecting copy.gif
/data/media/####/connecting.gif
/data/media/####/consume-icon@2x.png
/data/media/####/coupon.js
/data/media/####/coupon@2x.png
/data/media/####/couponCashier.js
/data/media/####/couponIcon.png
/data/media/####/coupon_bg_grey@2x.png
/data/media/####/coupon_bg_s@2x.png
/data/media/####/dcf_l.png
/data/media/####/dcf_r.png
/data/media/####/device-1.png
/data/media/####/device-10.png
/data/media/####/device-2.png
/data/media/####/device-3.png
/data/media/####/device-4.png
/data/media/####/device-8.png
/data/media/####/device-9.png
/data/media/####/deviceConnect.js
/data/media/####/deviceControl.js
/data/media/####/deviceSelector.js
/data/media/####/deviceShare.js
/data/media/####/deviceTypeId_1.png
/data/media/####/deviceTypeId_10.png
/data/media/####/deviceTypeId_3.png
/data/media/####/deviceTypeId_4.png
/data/media/####/deviceTypeId_9.png
/data/media/####/device_head@3x.png
/data/media/####/discountTips.png
/data/media/####/errorOerders.png
/data/media/####/expand-d@2x.png
/data/media/####/expand-r@2x.png
/data/media/####/expire_stamp@3x.png
/data/media/####/expired-icon@2x.png
/data/media/####/eye_close@2x.png
/data/media/####/eye_open@2x.png
/data/media/####/feature-big9-tip.png
/data/media/####/feature-bigdryer-tip.png
/data/media/####/feature-dryer-tip.png
/data/media/####/file4md5.json
/data/media/####/fixCode.js
/data/media/####/free@3x.png
/data/media/####/giftIcon.png
/data/media/####/giftIcon@2x.png
/data/media/####/grab@2x.png
/data/media/####/gradient-org@2x.png
/data/media/####/hairdryer.png
/data/media/####/head_bg_shower@2x.png
/data/media/####/help_icon.png
/data/media/####/home.js
/data/media/####/home_arrow.png
/data/media/####/home_arrow_r.png
/data/media/####/home_card.png
/data/media/####/home_coupon.png
/data/media/####/home_device_bg.png
/data/media/####/home_fixedCode.png
/data/media/####/home_item_bg.png
/data/media/####/home_money.png
/data/media/####/home_order.png
/data/media/####/home_question.png
/data/media/####/home_recordsList.png
/data/media/####/home_refresh.png
/data/media/####/home_scan.png
/data/media/####/home_shadow.png
/data/media/####/home_shadow2.png
/data/media/####/home_tuizu.png
/data/media/####/home_waterCard.png
/data/media/####/home_zulin.png
/data/media/####/huangguan@2x.png
/data/media/####/huawei.png
/data/media/####/icon_arrow@3x.png
/data/media/####/icon_arrow_blue@2x.png
/data/media/####/icon_check@3x.png
/data/media/####/icon_info@3x.png
/data/media/####/icon_red_tip@3x.png
/data/media/####/icon_shop@3x.png
/data/media/####/icon_tip@2x.png
/data/media/####/icon_untip@3x.png
/data/media/####/ineffective_stamp@3x.png
/data/media/####/laba@2x.png
/data/media/####/laba_grey@2x.png
/data/media/####/liquid-checked.png
/data/media/####/liquid-unchecked.png
/data/media/####/loading-1.png
/data/media/####/loading-2.png
/data/media/####/loading.gif
/data/media/####/location.png
/data/media/####/location_dark@2x.png
/data/media/####/location_icon.png
/data/media/####/location_icon@2x.png
/data/media/####/lowtriangle.png
/data/media/####/more_black@2x.png
/data/media/####/more_black@3x.png
/data/media/####/myOrder.js
/data/media/####/noConsumeRecord.png
/data/media/####/noData@3x.png
/data/media/####/noRecord.png
/data/media/####/noService_water.png
/data/media/####/nodata_icon.png
/data/media/####/nodicBleTest.js
/data/media/####/norecord@2x.png
/data/media/####/notice-red@3x.png
/data/media/####/notice@3x.png
/data/media/####/oppo.png
/data/media/####/order-bolun.png
/data/media/####/order-box.png
/data/media/####/order-dry.png
/data/media/####/order-guntong.png
/data/media/####/order-xixie.png
/data/media/####/orderDetail.js
/data/media/####/orderError.js
/data/media/####/orderIcon.png
/data/media/####/orderList.js
/data/media/####/order_launcher.png
/data/media/####/orders.js
/data/media/####/pabPay.png
/data/media/####/payStatus.js
/data/media/####/paystatus-checking.gif
/data/media/####/permssion1@3x.png
/data/media/####/permssion2@3x.png
/data/media/####/phone.png
/data/media/####/placeOrder.js
/data/media/####/powerRecord.js
/data/media/####/problemIcon.png
/data/media/####/process@3x.png
/data/media/####/program.js
/data/media/####/programOld.js
/data/media/####/promotion.png
/data/media/####/question-circle@2x.png
/data/media/####/question-grey@2x.png
/data/media/####/radioIcon.png
/data/media/####/rb_standard@2x.png
/data/media/####/rb_standard_grey@2x.png
/data/media/####/rechargeagreement.js
/data/media/####/recordrecharge.js
/data/media/####/records.js
/data/media/####/recordsDetails.js
/data/media/####/redbag@2x.png
/data/media/####/redbaglist.js
/data/media/####/refresh.png
/data/media/####/refresh@2x.png
/data/media/####/refresh@3x.png
/data/media/####/refund-icon@2x.png
/data/media/####/refundrecord.js
/data/media/####/rentWithdrawalOrder.js
/data/media/####/reservation.js
/data/media/####/reservationOld.js
/data/media/####/rightArrowIcon.png
/data/media/####/right_arrow@2x.png
/data/media/####/right_arrow_1@2x.png
/data/media/####/running.gif
/data/media/####/runningOrder.js
/data/media/####/samsung.png
/data/media/####/scanError.js
/data/media/####/scanIcon.png
/data/media/####/scan_water_service.png
/data/media/####/search@3x.png
/data/media/####/searchStore.js
/data/media/####/search_icon.png
/data/media/####/select.png
/data/media/####/select@2x.png
/data/media/####/selectRoom.js
/data/media/####/selectedIcon.png
/data/media/####/serviceSubject.js
/data/media/####/setEightBitCode.js
/data/media/####/setFixCode.js
/data/media/####/setcode.js
/data/media/####/share_add_icon.png
/data/media/####/shopIcon.png
/data/media/####/shower_bg_sm@2x.png
/data/media/####/shower_device.png
/data/media/####/shower_public@2x.png
/data/media/####/shower_scan@2x.png
/data/media/####/src_images_noConsumeRecord.png
/data/media/####/src_images_phone.png
/data/media/####/starting.gif
/data/media/####/store-icon@2x.png
/data/media/####/store.js
/data/media/####/success-icon.png
/data/media/####/success_icon.png
/data/media/####/success_icon@2x.png
/data/media/####/success_result.png
/data/media/####/tbslog.txt
/data/media/####/threemonthsagolist.js
/data/media/####/ticketPay.png
/data/media/####/time-limit.png
/data/media/####/tipsIcon@3x.png
/data/media/####/tipsIcon@3x_w.png
/data/media/####/topTest.png
/data/media/####/ujingfont.ttf
/data/media/####/unbindWaterCard.js
/data/media/####/unionPay.png
/data/media/####/unionPayLogo.png
/data/media/####/unselect@2x.png
/data/media/####/uptriangle.png
/data/media/####/userule.js
/data/media/####/washer_center.png
/data/media/####/washer_right.png
/data/media/####/waterCardBg.png
/data/media/####/waterCardManage.js
/data/media/####/waterCardScan.png
/data/media/####/water_detail_icon@3x.png
/data/media/####/water_home.png
/data/media/####/water_home_close.png
/data/media/####/water_home_list.png
/data/media/####/water_home_location.png
/data/media/####/water_home_money.png
/data/media/####/water_home_newUserActivity.png
/data/media/####/water_home_recommendation_btn.png
/data/media/####/water_home_recommendation_close.png
/data/media/####/water_home_right.png
/data/media/####/water_home_scan.png
/data/media/####/water_home_water.png
/data/media/####/waterdropIcon.png
/data/media/####/wechatIcon.png
/data/media/####/wechatPay.png
/data/media/####/weex4native.json
/data/media/####/white-bottom-org@2x.png
/data/media/####/white-bottom@2x.png
/data/media/####/xiaomi.png
/data/misc/####/primary.prof
/data/user_de/####/move_to_de_records.xml

Miscellaneous:

Executes the following shell scripts:

/data/app/<Package>-1/lib/arm//libweexjsb.so 156 180 1 /data/user/0/<Package>/app_crash/crash_dump.log
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
getprop
getprop ro.product.cpu.abi
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh -c type su

Loads the following dynamic libraries:

libBugly
libc++_shared
libcrashsdk
libhpatchz
libjiagu
libumeng-spy
libweexcore

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RC4
RSA-ECB-OAEPWithSHA-256AndMGF1Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding
desede-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Attempts to detect sandbox environment.

Changes the clipboard data.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial