Android.DownLoader.3516

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSpy.677.origin

Downloads the following detected threats from the Web:

Android.SmsSpy.677.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) IEKF####.gcj####.cn:80
TCP(HTTP/1.1) 1####.55.16.91:8080
TCP(HTTP/1.1) q####.qi1####.com:14302
TCP(HTTP/1.1) 1####.55.17.147:8080
TCP(HTTP/1.1) preload####.hishen####.com:5500
TCP(HTTP/1.1) prelo####.hishen####.com:80
TCP(HTTP/1.1) sdk.qi1####.com:80
TCP(HTTP/1.1) q####.qi1####.com:15302
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) p####.nj####.com.####.com:8080
TCP(HTTP/1.1) 1####.124.104.179:8080
TCP(HTTP/1.1) qyc####.qi1####.com:8200
TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) z####.wann####.com:9600

DNS requests:

IEKF####.gcj####.cn
a####.u####.com
hangzho####.oss-cn-####.aliy####.com
p####.nj####.com
prelo####.hishen####.com
preload####.hishen####.com
q####.qi1####.com
qyc####.qi1####.com
sdk.qi1####.com
z####.wann####.com
zxc####.wann####.com

HTTP GET requests:

IEKF####.gcj####.cn/1/40063-C01
hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
p####.nj####.com.####.com:8080/png/ic_jyyy.png
p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
p####.nj####.com.####.com:8080/res/novel/app/icon/1.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/2.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/3.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/4.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/5.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/6.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/7.jpg
p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2020.jar
prelo####.hishen####.com/project_preloaded/36dd4e9586a7461ab707925c0ac78...
prelo####.hishen####.com/project_preloaded/69a5abb02d194050a4995a7fbafd6...
prelo####.hishen####.com/project_preloaded/b0a7a2a12f4f49168816270ec4419...
prelo####.hishen####.com/project_preloaded/f72f4f8dfc2f4a5a964debf349233...
preload####.hishen####.com:5500/api-plugin-jar/alipayRedEnvelopes/conten...
qyc####.qi1####.com:8200/sdk/file?H3q6JBA####
sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar
sdk.qi1####.com/vpssdk/andrcool_1.0.1.jar

HTTP POST requests:

a####.u####.com/app_logs
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveDevice
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveFile
q####.qi1####.com:14302/sdk_login?t=####
q####.qi1####.com:15302/sdk_login?t=####
qyc####.qi1####.com:8200/sdk/log
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Modified file system:

Creates the following files:

<Package Folder>/app_payload_odex/<Package>.jar
<Package Folder>/app_payload_res/####/._logo_img_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_0_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_1_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_2_3.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_3_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_4_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_5_2.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_0.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_1.jpg
<Package Folder>/app_payload_res/####/._mm_show_6_2.jpg
<Package Folder>/app_payload_res/####/._pg_1.png
<Package Folder>/app_payload_res/####/._pg_2.png
<Package Folder>/app_payload_res/####/._pg_3.png
<Package Folder>/app_payload_res/####/._pic_bg.png
<Package Folder>/app_payload_res/####/._pic_mm_0.jpg
<Package Folder>/app_payload_res/####/._pic_mm_1.jpg
<Package Folder>/app_payload_res/####/._pic_mm_2.jpg
<Package Folder>/app_payload_res/####/._pic_mm_3.jpg
<Package Folder>/app_payload_res/####/._pic_mm_4.jpg
<Package Folder>/app_payload_res/####/._pic_mm_5.jpg
<Package Folder>/app_payload_res/####/._pic_mm_6.jpg
<Package Folder>/app_payload_res/####/._pic_mm_7.jpg
<Package Folder>/app_payload_res/####/._price1.jpg
<Package Folder>/app_payload_res/####/._price3.png
<Package Folder>/app_payload_res/logo_img_0.jpg
<Package Folder>/app_payload_res/maan.so
<Package Folder>/app_payload_res/mm_show_0_0.jpg
<Package Folder>/app_payload_res/mm_show_0_1.jpg
<Package Folder>/app_payload_res/mm_show_0_2.jpg
<Package Folder>/app_payload_res/mm_show_0_3.jpg
<Package Folder>/app_payload_res/mm_show_1_0.jpg
<Package Folder>/app_payload_res/mm_show_1_1.jpg
<Package Folder>/app_payload_res/mm_show_1_2.jpg
<Package Folder>/app_payload_res/mm_show_1_3.jpg
<Package Folder>/app_payload_res/mm_show_2_0.jpg
<Package Folder>/app_payload_res/mm_show_2_1.jpg
<Package Folder>/app_payload_res/mm_show_2_2.jpg
<Package Folder>/app_payload_res/mm_show_2_3.jpg
<Package Folder>/app_payload_res/mm_show_3_0.jpg
<Package Folder>/app_payload_res/mm_show_3_1.jpg
<Package Folder>/app_payload_res/mm_show_3_2.jpg
<Package Folder>/app_payload_res/mm_show_4_0.jpg
<Package Folder>/app_payload_res/mm_show_4_1.jpg
<Package Folder>/app_payload_res/mm_show_4_2.jpg
<Package Folder>/app_payload_res/mm_show_5_0.jpg
<Package Folder>/app_payload_res/mm_show_5_1.jpg
<Package Folder>/app_payload_res/mm_show_5_2.jpg
<Package Folder>/app_payload_res/mm_show_6_0.jpg
<Package Folder>/app_payload_res/mm_show_6_1.jpg
<Package Folder>/app_payload_res/mm_show_6_2.jpg
<Package Folder>/app_payload_res/pg_1.png
<Package Folder>/app_payload_res/pg_2.png
<Package Folder>/app_payload_res/pg_3.png
<Package Folder>/app_payload_res/pic_bg.png
<Package Folder>/app_payload_res/pic_mm_0.jpg
<Package Folder>/app_payload_res/pic_mm_1.jpg
<Package Folder>/app_payload_res/pic_mm_2.jpg
<Package Folder>/app_payload_res/pic_mm_3.jpg
<Package Folder>/app_payload_res/pic_mm_4.jpg
<Package Folder>/app_payload_res/pic_mm_5.jpg
<Package Folder>/app_payload_res/pic_mm_6.jpg
<Package Folder>/app_payload_res/pic_mm_7.jpg
<Package Folder>/app_payload_res/price1.jpg
<Package Folder>/app_payload_res/price3.png
<Package Folder>/app_payload_res/story_btn_read.png
<Package Folder>/app_payload_res/tab1_0.png
<Package Folder>/app_payload_res/tab1_1.png
<Package Folder>/app_payload_res/tab2_0.png
<Package Folder>/app_payload_res/tab2_1.png
<Package Folder>/app_process_lock/1122154108822.35
<Package Folder>/app_process_lock/1122154108822.35 (deleted)
<Package Folder>/app_process_lock/1122154108888.4
<Package Folder>/app_process_lock/1122154108888.4 (deleted)
<Package Folder>/app_process_lock/1122154108900.31
<Package Folder>/app_process_lock/1122154108900.31 (deleted)
<Package Folder>/app_process_lock/1122154108909.67
<Package Folder>/app_process_lock/1122154108909.67 (deleted)
<Package Folder>/app_process_lock/1122154108915.97
<Package Folder>/app_process_lock/1122154108915.97 (deleted)
<Package Folder>/app_process_lock/1122154108922.13
<Package Folder>/app_process_lock/1122154108922.13 (deleted)
<Package Folder>/app_process_lock/1122154108933.73
<Package Folder>/app_process_lock/1122154108933.73 (deleted)
<Package Folder>/app_process_lock/1122154109282.32
<Package Folder>/app_process_lock/1122154109282.32 (deleted)
<Package Folder>/app_process_lock/1122154109302.77
<Package Folder>/app_process_lock/1122154109302.77 (deleted)
<Package Folder>/app_process_lock/1122154109326.92
<Package Folder>/app_process_lock/1122154109326.92 (deleted)
<Package Folder>/app_process_lock/1122154109389.51
<Package Folder>/app_process_lock/1122154109389.51 (deleted)
<Package Folder>/app_process_lock/1122154109406.58
<Package Folder>/app_process_lock/1122154109406.58 (deleted)
<Package Folder>/app_process_lock/1122154109426.68
<Package Folder>/app_process_lock/1122154109426.68 (deleted)
<Package Folder>/app_process_lock/1122154109487.28
<Package Folder>/app_process_lock/1122154109487.28 (deleted)
<Package Folder>/app_process_lock/1122154109525.03
<Package Folder>/app_process_lock/1122154109525.03 (deleted)
<Package Folder>/app_process_lock/1122154109692.51
<Package Folder>/app_process_lock/1122154109692.51 (deleted)
<Package Folder>/app_process_lock/1122154109713.01
<Package Folder>/app_process_lock/1122154109713.01 (deleted)
<Package Folder>/app_process_lock/1122154109797.83
<Package Folder>/app_process_lock/1122154109797.83 (deleted)
<Package Folder>/app_process_lock/1122154109802.01
<Package Folder>/app_process_lock/1122154109802.01 (deleted)
<Package Folder>/app_process_lock/1122154109822.56
<Package Folder>/app_process_lock/1122154109822.56 (deleted)
<Package Folder>/app_process_lock/1122154109845.07
<Package Folder>/app_process_lock/1122154109845.07 (deleted)
<Package Folder>/app_process_lock/1122154109910.39
<Package Folder>/app_process_lock/1122154109910.39 (deleted)
<Package Folder>/app_process_lock/1122154109945.7
<Package Folder>/app_process_lock/1122154109945.7 (deleted)
<Package Folder>/app_process_lock/1122154109969.66
<Package Folder>/app_process_lock/1122154109969.66 (deleted)
<Package Folder>/app_process_lock/1122154109998.21
<Package Folder>/app_process_lock/1122154109998.21 (deleted)
<Package Folder>/app_process_lock/1122154110041.04
<Package Folder>/app_process_lock/1122154110041.04 (deleted)
<Package Folder>/app_process_lock/1122154110104.9
<Package Folder>/app_process_lock/1122154110104.9 (deleted)
<Package Folder>/app_process_lock/1132.30089999093
<Package Folder>/app_process_lock/1132.30089999093 (deleted)
<Package Folder>/app_process_lock/1132.34542065845
<Package Folder>/app_process_lock/1132.34542065845 (deleted)
<Package Folder>/app_process_lock/1132.38994132597
<Package Folder>/app_process_lock/1132.38994132597 (deleted)
<Package Folder>/app_process_lock/1132.43446199348
<Package Folder>/app_process_lock/1132.43446199348 (deleted)
<Package Folder>/app_process_lock/1132.478982661
<Package Folder>/app_process_lock/1132.478982661 (deleted)
<Package Folder>/app_process_lock/1132.52350332852
<Package Folder>/app_process_lock/1132.52350332852 (deleted)
<Package Folder>/app_process_lock/1132.56802399603
<Package Folder>/app_process_lock/1132.56802399603 (deleted)
<Package Folder>/app_process_lock/161.918512514603
<Package Folder>/app_process_lock/161.918512514603 (deleted)
<Package Folder>/app_process_lock/2325857242004.14
<Package Folder>/app_process_lock/2325857242004.14 (deleted)
<Package Folder>/app_process_lock/2325857242889.12
<Package Folder>/app_process_lock/2325857242889.12 (deleted)
<Package Folder>/app_process_lock/2325857243370.62
<Package Folder>/app_process_lock/2325857243370.62 (deleted)
<Package Folder>/app_process_lock/2325857243889.23
<Package Folder>/app_process_lock/2325857243889.23 (deleted)
<Package Folder>/app_process_lock/2325857244065.38
<Package Folder>/app_process_lock/2325857244065.38 (deleted)
<Package Folder>/app_process_lock/2325857244495.6
<Package Folder>/app_process_lock/2325857244495.6 (deleted)
<Package Folder>/app_process_lock/2325857248615.3
<Package Folder>/app_process_lock/2325857248615.3 (deleted)
<Package Folder>/app_process_lock/261210957936.257
<Package Folder>/app_process_lock/261210957936.257 (deleted)
<Package Folder>/app_process_lock/261210958035.646
<Package Folder>/app_process_lock/261210958035.646 (deleted)
<Package Folder>/app_process_lock/261210958089.722
<Package Folder>/app_process_lock/261210958089.722 (deleted)
<Package Folder>/app_process_lock/261210958147.966
<Package Folder>/app_process_lock/261210958147.966 (deleted)
<Package Folder>/app_process_lock/261210958167.75
<Package Folder>/app_process_lock/261210958167.75 (deleted)
<Package Folder>/app_process_lock/261210958216.066
<Package Folder>/app_process_lock/261210958216.066 (deleted)
<Package Folder>/app_process_lock/261210958678.74
<Package Folder>/app_process_lock/261210958678.74 (deleted)
<Package Folder>/app_process_lock/2965468007486.68
<Package Folder>/app_process_lock/2965468007486.68 (deleted)
<Package Folder>/app_process_lock/2965468007661.24
<Package Folder>/app_process_lock/2965468007661.24 (deleted)
<Package Folder>/app_process_lock/2965468007692.71
<Package Folder>/app_process_lock/2965468007692.71 (deleted)
<Package Folder>/app_process_lock/2965468007717.43
<Package Folder>/app_process_lock/2965468007717.43 (deleted)
<Package Folder>/app_process_lock/2965468007734.09
<Package Folder>/app_process_lock/2965468007734.09 (deleted)
<Package Folder>/app_process_lock/2965468007750.38
<Package Folder>/app_process_lock/2965468007750.38 (deleted)
<Package Folder>/app_process_lock/2965468007781.03
<Package Folder>/app_process_lock/2965468007781.03 (deleted)
<Package Folder>/app_process_lock/2965468008702.22
<Package Folder>/app_process_lock/2965468008702.22 (deleted)
<Package Folder>/app_process_lock/2965468008756.28
<Package Folder>/app_process_lock/2965468008756.28 (deleted)
<Package Folder>/app_process_lock/2965468008820.1
<Package Folder>/app_process_lock/2965468008820.1 (deleted)
<Package Folder>/app_process_lock/2965468008985.49
<Package Folder>/app_process_lock/2965468008985.49 (deleted)
<Package Folder>/app_process_lock/2965468009030.62
<Package Folder>/app_process_lock/2965468009030.62 (deleted)
<Package Folder>/app_process_lock/2965468009083.73
<Package Folder>/app_process_lock/2965468009083.73 (deleted)
<Package Folder>/app_process_lock/2965468009243.86
<Package Folder>/app_process_lock/2965468009243.86 (deleted)
<Package Folder>/app_process_lock/2965468009343.64
<Package Folder>/app_process_lock/2965468009343.64 (deleted)
<Package Folder>/app_process_lock/2965468009786.23
<Package Folder>/app_process_lock/2965468009786.23 (deleted)
<Package Folder>/app_process_lock/2965468009840.39
<Package Folder>/app_process_lock/2965468009840.39 (deleted)
<Package Folder>/app_process_lock/2965468010064.54
<Package Folder>/app_process_lock/2965468010064.54 (deleted)
<Package Folder>/app_process_lock/2965468010075.58
<Package Folder>/app_process_lock/2965468010075.58 (deleted)
<Package Folder>/app_process_lock/2965468010129.89
<Package Folder>/app_process_lock/2965468010129.89 (deleted)
<Package Folder>/app_process_lock/2965468010189.39
<Package Folder>/app_process_lock/2965468010189.39 (deleted)
<Package Folder>/app_process_lock/2965468010361.99
<Package Folder>/app_process_lock/2965468010361.99 (deleted)
<Package Folder>/app_process_lock/2965468010455.32
<Package Folder>/app_process_lock/2965468010455.32 (deleted)
<Package Folder>/app_process_lock/2965468010518.64
<Package Folder>/app_process_lock/2965468010518.64 (deleted)
<Package Folder>/app_process_lock/2965468010594.07
<Package Folder>/app_process_lock/2965468010594.07 (deleted)
<Package Folder>/app_process_lock/2965468010707.26
<Package Folder>/app_process_lock/2965468010707.26 (deleted)
<Package Folder>/app_process_lock/2965468010876.03
<Package Folder>/app_process_lock/2965468010876.03 (deleted)
<Package Folder>/app_process_lock/3660380.04099951
<Package Folder>/app_process_lock/3660380.04099951 (deleted)
<Package Folder>/app_process_lock/3660380.34145408
<Package Folder>/app_process_lock/3660380.34145408 (deleted)
<Package Folder>/app_process_lock/690290872596.942
<Package Folder>/app_process_lock/690290872596.942 (deleted)
<Package Folder>/app_process_lock/690290872859.594
<Package Folder>/app_process_lock/690290872859.594 (deleted)
<Package Folder>/app_process_lock/690290873002.498
<Package Folder>/app_process_lock/690290873002.498 (deleted)
<Package Folder>/app_process_lock/690290873156.417
<Package Folder>/app_process_lock/690290873156.417 (deleted)
<Package Folder>/app_process_lock/690290873208.697
<Package Folder>/app_process_lock/690290873208.697 (deleted)
<Package Folder>/app_process_lock/690290873336.381
<Package Folder>/app_process_lock/690290873336.381 (deleted)
<Package Folder>/app_process_lock/690290874559.068
<Package Folder>/app_process_lock/690290874559.068 (deleted)
<Package Folder>/app_process_lock/889.37042982576
<Package Folder>/app_process_lock/889.37042982576 (deleted)
<Package Folder>/app_process_lock/889.414950493276
<Package Folder>/app_process_lock/889.414950493276 (deleted)
<Package Folder>/app_process_lock/889.459471160793
<Package Folder>/app_process_lock/889.459471160793 (deleted)
<Package Folder>/app_process_lock/889.503991828309
<Package Folder>/app_process_lock/889.503991828309 (deleted)
<Package Folder>/app_process_lock/889.548512495826
<Package Folder>/app_process_lock/889.548512495826 (deleted)
<Package Folder>/app_process_lock/889.593033163343
<Package Folder>/app_process_lock/889.593033163343 (deleted)
<Package Folder>/app_process_lock/889.637553830859
<Package Folder>/app_process_lock/889.637553830859 (deleted)
<Package Folder>/app_process_lock/889.682074498376
<Package Folder>/app_process_lock/889.682074498376 (deleted)
<Package Folder>/app_process_lock/889.726595165892
<Package Folder>/app_process_lock/889.726595165892 (deleted)
<Package Folder>/cache/__gather_impl-1203915196120082879196.jar
<Package Folder>/cache/cache-724078989120082506458
<Package Folder>/cache/cache739436416120082742401
<Package Folder>/databases/a.db
<Package Folder>/databases/a.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/qy_db_pay-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/xUtils_http_cache.db
<Package Folder>/databases/xUtils_http_cache.db-journal
<Package Folder>/databases/xUtils_http_cookie.db
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/files/####/andrcool.jar
<Package Folder>/files/####/copy_alicode_update.jar
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/qy_device_info_sdk_update.jar
<Package Folder>/files/####/qy_video_ad_sdk_update.jar
<Package Folder>/files/####/web_page_sdk_update.jar
<Package Folder>/files/.imprint
<Package Folder>/files/__gather_impl.jar
<Package Folder>/files/exid.dat
<Package Folder>/files/getprop
<Package Folder>/files/pid
<Package Folder>/files/umeng_it.cache
<Package Folder>/libzxvps/####/tmp_so
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/libgather.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/unknown.xml
<Package Folder>/tmp_jar
<SD-Card>/.Systemp/.cfg
<SD-Card>/.Systemp/device
<SD-Card>/Android/####/031f04ef44c86d37888b9206208ab7ff
<SD-Card>/Android/####/064531ba62fad9c616001130ede13e74
<SD-Card>/Android/####/110b6dcd7a403d3581b21c2d9d50f95c
<SD-Card>/Android/####/142646ae6c19c34eda563c27faa08f45
<SD-Card>/Android/####/17791f9384da1204686cd388dbb5f79b
<SD-Card>/Android/####/1f33c3ae1bc6aff7bc3724089856f1f2
<SD-Card>/Android/####/22830f16ca32a6630266af6290e702d6
<SD-Card>/Android/####/236429c196341bccef47fbf117ac1131
<SD-Card>/Android/####/300f50dfb16e035d7ba2ebd4753b36b8
<SD-Card>/Android/####/3bf2bf9fe4bf32e08be552d786c26054
<SD-Card>/Android/####/3bfb612806d6130352b7b5d10c0fb595
<SD-Card>/Android/####/3e643b847c4bb684fc79ad0f8609990a
<SD-Card>/Android/####/50408b406ba68c658caede369f93547c
<SD-Card>/Android/####/54c7ade8800b4248acd86e998327c3b3
<SD-Card>/Android/####/5d186d7c3d5becd2035af81198b18fac
<SD-Card>/Android/####/614b01e4628d6b78f36743a3105948fe
<SD-Card>/Android/####/641396e85bf54468fe7cee3296fab1be
<SD-Card>/Android/####/6c3fe6f8cd77ca46ab18980eecbcca20
<SD-Card>/Android/####/6c66b1638e6334bad3a5be0c4abb7ae5
<SD-Card>/Android/####/7536989b77af9c2e654b3be2ca7cb902
<SD-Card>/Android/####/79c06ef55c39e690f92f88cdbbce58d0
<SD-Card>/Android/####/897f47697ee1e6f740a2bff65a9d1b9e
<SD-Card>/Android/####/8acf08558ad9a62966ddb70b9a7b29a0
<SD-Card>/Android/####/bcaf211789e9633f435ac76264251f60
<SD-Card>/Android/####/c6cf19d74e87a24508787096b49c76e2
<SD-Card>/Android/####/ca439c828e80bf6a443a11ac5161fbee
<SD-Card>/Android/####/cc95fcd2f01d359c1c5a106e3ddcffa9
<SD-Card>/Android/####/ce8b0eeaa4397da89afb4700e510ff60
<SD-Card>/Android/####/d167b3764dad385acf10528ac3d73bf0
<SD-Card>/Android/####/dc22d5fa<SMS Address>e04d52f5d51f5de1c70b2
<SD-Card>/Android/####/dea11f9b758fffdb72797b89185ed38d
<SD-Card>/Android/####/ef309fafbb7b21035a1a84c575654bd7
<SD-Card>/Android/####/f5a5c51ec6cd53b3a47940babe971c0b
<SD-Card>/Android/####/fa76ae951ce98de338157363032a79a6
<SD-Card>/Android/1.txt.tmp
<SD-Card>/Android/10.txt.tmp
<SD-Card>/Android/11.txt.tmp
<SD-Card>/Android/12.txt.tmp
<SD-Card>/Android/13.txt.tmp
<SD-Card>/Android/14.txt.tmp
<SD-Card>/Android/15.txt.tmp
<SD-Card>/Android/16.txt.tmp
<SD-Card>/Android/2.txt.tmp
<SD-Card>/Android/3.txt.tmp
<SD-Card>/Android/4.txt.tmp
<SD-Card>/Android/5.txt.tmp
<SD-Card>/Android/6.txt.tmp
<SD-Card>/Android/7.txt.tmp
<SD-Card>/Android/8.txt.tmp
<SD-Card>/Android/9.txt.tmp
<SD-Card>/Android/com.molove.mobile.sjwwx.apk.tmp
<SD-Card>/Android/com.molove.mobile.sjwwx.png.tmp
<SD-Card>/dp.jar.tmp
<SD-Card>/updateApkDemo/FrameCore.jar

Miscellaneous:

Executes next shell scripts:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
chmod 777 <Package Folder>/lib/helper
df
getprop
ls -l /system/bin/su
ps | grep <Package>
sh

Loads the following dynamic libraries:

libhelper
libsmsmanager
libzxvps

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding
DES-ECB-NoPadding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about sent/received SMS messages.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial