Android.Triada.4836

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.1007.origin
Android.Triada.4567
Android.Triada.482.origin
Android.Triada.510.origin
Android.Triada.534.origin
Android.Triada.559.origin
Android.Triada.560.origin
Android.Triada.563.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) shop-####.7####.com:80
TCP(HTTP/1.1) qzones####.g####.cn.####.com:80
TCP(HTTP/1.1) kyy####.wwe####.com:17002
TCP(HTTP/1.1) kyy####.wwe####.com:18001
TCP(HTTP/1.1) c####.7####.com:80
TCP(HTTP/1.1) p####.hfc####.com:80
TCP(HTTP/1.1) kyy####.wwe####.com:17001
TCP(HTTP/1.1) mav.m####.com.####.com:80
TCP(HTTP/1.1) akd####.aog####.com:19001
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) v2.g####.qq.com:80
TCP(HTTP/1.1) jxs####.slj####.com:17002
TCP(HTTP/1.1) p####.ugd####.com.####.com:80
TCP(HTTP/1.1) xh.ma####.com:80
TCP(HTTP/1.1) bbt####.wwe####.com:17001
TCP(HTTP/1.1) ck.j####.top:80
TCP(HTTP/1.1) jp####.njt####.com:10091
TCP(HTTP/1.1) sf1-be-####.pglstat####.com:80
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) www.y####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) x####.jiangj####.top:443
TCP(TLS/1.0) mi.g####.qq.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) p####.x####.com:443
TCP(TLS/1.0) api16-a####.pa####.io.####.net:443
TCP(TLS/1.0) mav.m####.com.####.com:443
TCP(TLS/1.0) aa.birdg####.com:443
TCP(TLS/1.0) 1####.177.14.113:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) tk.anythin####.com:443
TCP(TLS/1.0) api16-l####.pa####.io.####.net:443
TCP(TLS/1.0) to####.ctobsn####.com:443
TCP(TLS/1.0) quickon####.b0.a####.com:443
TCP(TLS/1.0) securit####.sp####.mig.####.net:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) dd.top####.com:443
TCP(TLS/1.0) ssl.zd####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) ga.cp####.net:443
TCP(TLS/1.0) aa.top####.com:443
TCP(TLS/1.0) 64.2####.162.95:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) api.zp####.com:443
TCP(TLS/1.0) da.anythin####.com:443
TCP(TLS/1.0) ck.j####.top:443
TCP(TLS/1.2) 1####.177.14.113:443
TCP(TLS/1.2) 64.2####.163.95:443
TCP(TLS/1.2) 1####.194.222.95:443

DNS requests:

aa.birdg####.com
aa.top####.com
akd####.aog####.com
android####.go####.com
api.zp####.com
api16-a####.pa####.io
api16-l####.pa####.io
bbt####.wwe####.com
bds.sn####.com
c####.7####.com
c####.mm####.com
c####.x####.com
c.c####.com
c.cdn.wa####.xyz
cdn.jiu####.com
ck.j####.top
connect####.gst####.com
cw####.mintl####.cn
da.anythin####.com
dd.top####.com
dig.b####.net
dm.byted####.com
dm.tou####.com
dmg.sybro####.com
ga.cp####.net
instant####.google####.com
jp####.njt####.com
jxs####.slj####.com
kyy####.wwe####.com
l####.tbs.qq.com
lla####.slj####.com
m####.go####.com
mav.m####.com
md####.google####.com
mi.g####.qq.com
now####.pes####.com
orn####.wwe####.com
p####.google####.com
p####.hfc####.com
p####.ugd####.com
p####.x####.com
pang####.sn####.com
qzones####.g####.cn
s####.e.qq.com
s####.sn####.com
sf1-be-####.pglstat####.com
sf3-fe####.pglstat####.com
sf3-ttc####.ps####.com
shop-####.7####.com
ssl.zd####.com
sta####.quic####.cn
t####.m.qq.com
tk.anythin####.com
to####.ctobsn####.com
v1.c####.com
v2.g####.qq.com
www.y####.com
x####.jiangj####.top
xh.ma####.com
ycb####.slj####.com
z6.c####.com

HTTP GET requests:

c####.7####.com/index.php/Sdk/index/GetFunctionListV2?DeviceID=####&Pass...
c####.7####.com/index.php/home/index/getControllDataForGameApp?game_id=#...
ck.j####.top/jssdk/mi0099.js
mav.m####.com.####.com/PScdbJl3
mav.m####.com.####.com/aY9ckedm
mav.m####.com.####.com/img/zz01
mav.m####.com.####.com/static/channel/news02.js
p####.hfc####.com/c/alskdjdjjf.zip
p####.hfc####.com/c/dyonTuo.zip
p####.hfc####.com/c/iuhaysdasd.zip
p####.hfc####.com/c/jz/elqsydt.zip
p####.hfc####.com/c/l/11Y24jsbuliang.zip
p####.hfc####.com/c/l/11Y9JUHEKOULING.zip
p####.hfc####.com/two/SOI349RED8EO35RE98FE359E844T9R.zip
p####.hfc####.com/u/qwertyuasj.zip
p####.ugd####.com.####.com/gdt/0/EAAat8uAIAAIAAAACrABeJRYOArSYdONx.jpg/0...
p####.ugd####.com.####.com/gdt/0/EAAgaqlAEsAEsAAABVzBeC0iaCd6hGN6v.jpg/0...
p####.ugd####.com.####.com/gdt/0/EAAgaqlAIAAIAAAACrABeJRZjDTbhpjmG.jpg/0...
p####.ugd####.com.####.com/gdt/0/EAApCZtAQ4AeAAAAgf_BfpX2SAVnEBSTJ.jpg/0...
p####.ugd####.com.####.com/gdt/0/EABAMm9AEsAEsAAADfZBfM55YDuTxvStm.jpg/0...
qzones####.g####.cn.####.com/qzone/biz/gdt/mob/sdk/v2/android03/js-relea...
sf1-be-####.pglstat####.com/img/ad.union.api/05d3f47e0a2bb901401bb7d580e...
shop-####.7####.com/index.php/home/index/getControllDataForGameApp?game_...
v2.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####&mu_p=####
xh.ma####.com/
xh.ma####.com/Template/default/img/bg.jpg
xh.ma####.com/Template/default/img/new_mark.png
xh.ma####.com/css/common.css
xh.ma####.com/css/default.css
xh.ma####.com/favicon.ico
xh.ma####.com/img/fenlei.gif
xh.ma####.com/img/logo.gif
xh.ma####.com/js/common.js
xh.ma####.com/js/jquery.min.js

HTTP POST requests:

akd####.aog####.com:19001/tchvohfkyf/
bbt####.wwe####.com:17001/cbcvu9/
bbt####.wwe####.com:17001/karawc/
c####.7####.com/index.php/sdk/CollectRequest?
jp####.njt####.com:10091/wisdom/marking
jxs####.slj####.com:17002/5rhxg/
jxs####.slj####.com:17002/jw1pw/
kyy####.wwe####.com:17001/an2y3z/
kyy####.wwe####.com:17001/karawc/
kyy####.wwe####.com:17002/6a4it/
kyy####.wwe####.com:17002/jw1pw/
kyy####.wwe####.com:18001/begzf1/
kyy####.wwe####.com:18001/w0619s/
l####.tbs.qq.com/ajax?c=####&k=####

File system changes:

Creates the following files:

/data/data/####/-572666645-44032679
/data/data/####/.appInfo
/data/data/####/.bak
/data/data/####/.cl
/data/data/####/.hptc.cache_dolls.wdj.zhiqu
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.turing.dat
/data/data/####/0f507ced0029123a47157647ef3ed413
/data/data/####/0f507ced0029123a47157647ef3ed413#header
/data/data/####/105498_auMini_1
/data/data/####/1606529103477_3495
/data/data/####/1606529103854_3495
/data/data/####/1606529103917_3495
/data/data/####/1606529104693_3495
/data/data/####/1606529107327_3495
/data/data/####/1606529108893_3495
/data/data/####/1606529109813_3495
/data/data/####/1606529110235_3495
/data/data/####/1606529159292_3495
/data/data/####/1606529159563_3495
/data/data/####/1606529161248_3495
/data/data/####/1606529164447_3495
/data/data/####/1606529168007_3495
/data/data/####/1606529168544_3495
/data/data/####/1606529169228_3495
/data/data/####/1606529171980_3495
/data/data/####/16fe05b494fc3a28_0
/data/data/####/16fe05b494fc3a28_1
/data/data/####/1c12f0f394f55fe7_0
/data/data/####/29849020bcb109c9_0
/data/data/####/29d464eb875cbd17_0
/data/data/####/2EC68123E317AA1FD3F2E11EBECF4D88.xml
/data/data/####/303aebf349b6725a_0
/data/data/####/313339953a55c4a7_0
/data/data/####/33f7331df8330773c2b6d59fb101a836;account_file.xml
/data/data/####/3495.yaqcookie
/data/data/####/36da744bde2532c2_0
/data/data/####/3A0BC3C0D4BC531841993226451CFE45.xml
/data/data/####/3ea59a5329011dee_0
/data/data/####/5f05caf1b04b10be_0
/data/data/####/638b873a05f91d24_0
/data/data/####/6E749A00C83682F9F04C8C90619C26F1.dex
/data/data/####/6E749A00C83682F9F04C8C90619C26F1.dex.flock (deleted)
/data/data/####/6edd08f93efe6e13_0
/data/data/####/6f243f353b206ede_0
/data/data/####/6f6066df80316c5c_0
/data/data/####/6f6066df80316c5c_1
/data/data/####/7b4258c4328b3b69_0
/data/data/####/7b4258c4328b3b69_1
/data/data/####/8E7DF91940E3B1D1B86A9498DD67BEB4.dex
/data/data/####/8E7DF91940E3B1D1B86A9498DD67BEB4.dex.flock (deleted)
/data/data/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex
/data/data/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex.flock (deleted)
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/9838696cd8872bbc_0
/data/data/####/99EED97C18B17D15C0D7E3A2C717B385.dex
/data/data/####/99EED97C18B17D15C0D7E3A2C717B385.dex.flock (deleted)
/data/data/####/9e1611af32d0412a_0
/data/data/####/9f7a7d01e592e9b0_0
/data/data/####/ADA15C06CDB669FEAA94E957FB80039F.dex
/data/data/####/ADA15C06CDB669FEAA94E957FB80039F.dex.flock (deleted)
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/BuglySdkInfos.xml
/data/data/####/CCCC5B8911BBCB224E5317F7FB929A12.dex
/data/data/####/CCCC5B8911BBCB224E5317F7FB929A12.dex.flock (deleted)
/data/data/####/Cookies-journal
/data/data/####/D967A959D8E39AF63D48D9EACAEC1F70.dex
/data/data/####/D967A959D8E39AF63D48D9EACAEC1F70.dex.flock (deleted)
/data/data/####/Databases.db-journal
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/GameDataCache
/data/data/####/QuotaManager-journal
/data/data/####/TD_IP_CACHE.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol3.xml
/data/data/####/TDpref_cloudcontrol3.xml.bak
/data/data/####/TDpref_game.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime3.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime3.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__zad_uuid__
/data/data/####/_db_zad_.xml
/data/data/####/_p.xml
/data/data/####/_sh.xml
/data/data/####/_shn
/data/data/####/a7b98e10c2278e2d_0
/data/data/####/ae60d848c917ef10_0
/data/data/####/anythink.db-journal
/data/data/####/anythink_agent_log
/data/data/####/anythink_myoffer-journal
/data/data/####/anythink_placement_strategy_update_check.xml
/data/data/####/anythink_sdk.xml
/data/data/####/anythink_sdk.xml.bak
/data/data/####/anythink_temp_log
/data/data/####/applog_stats.xml
/data/data/####/b22cd9ea01fd56e5_0
/data/data/####/b22cd9ea01fd56e5_1
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bd_tea_agent.db-journal
/data/data/####/bjss_at_banner.xml
/data/data/####/bjss_at_banner_down.xml
/data/data/####/bjss_at_inter.xml
/data/data/####/bjss_at_video.xml
/data/data/####/c27f73e0dafe71ce_0
/data/data/####/c27f73e0dafe71ce_1
/data/data/####/c9063ae965ca0964_0
/data/data/####/cid
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/com.qq.e.sdkconfig.xml
/data/data/####/com.zhangdong.dolls.wdj.zhiqu_preferences.xml
/data/data/####/commsdoisfkf.xml
/data/data/####/commsdoisfkf.xml.bak
/data/data/####/comwroteogigeoig.xml
/data/data/####/config
/data/data/####/core_info
/data/data/####/d67f0c1bd77059cc_0
/data/data/####/d67f0c1bd77059cc_1
/data/data/####/d752669222c7b013_0
/data/data/####/d752669222c7b013_1
/data/data/####/da6a127c5ce696bb_0
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/ebamof.png
/data/data/####/ebe09cfd93953349_0
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/embed_header_custom.xml.bak
/data/data/####/embed_last_sp_session.xml
/data/data/####/f8b53a8acdcecac4_0
/data/data/####/f9bd0b0b69a7172d_0
/data/data/####/fas.xml
/data/data/####/fas.xml.bak
/data/data/####/fea4ae58f23635258d10a2d5a0dcf82c#header
/data/data/####/fea4ae58f23635258d10a2d5a0dcf82c#temp
/data/data/####/fedc09357c078dbe_0
/data/data/####/ff72475676d555cb_0
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/gdt_plugin.dex
/data/data/####/gdt_plugin.dex.flock (deleted)
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/http_xh.manyji.com_0.localstorage-journal
/data/data/####/index
/data/data/####/iv
/data/data/####/journal.tmp
/data/data/####/kdtxnvkv.dex (deleted)
/data/data/####/kdtxnvkv.dex.flock (deleted)
/data/data/####/kdtxnvkv.jar
/data/data/####/kk_datas_info.xml
/data/data/####/last_sp_session.xml
/data/data/####/libMMANDKSignature.eb42346a.so
/data/data/####/libjiagu.so
/data/data/####/libturingau.eb42346a.so
/data/data/####/libvqbtwl.so
/data/data/####/libvqbtwl.so-32
/data/data/####/libvqbtwl.so-64
/data/data/####/libyaqbasic.eb42346a.so
/data/data/####/libyaqpro.eb42346a.so
/data/data/####/metrics_guid
/data/data/####/mpdc_105498_1
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/proc_auxv
/data/data/####/runtime-dex.dex
/data/data/####/runtime-dex.dex.flock (deleted)
/data/data/####/runtime-dex.jar_temp
/data/data/####/salt
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_multi_ttadnet_config.xml
/data/data/####/sp_name.xml
/data/data/####/sp_push_time.xml
/data/data/####/sp_reward_video_adslot.xml
/data/data/####/ss_app_config.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_config.xml.bak (deleted)
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdid.xml
/data/data/####/the-real-index
/data/data/####/tool.egret-labs.org.xml
/data/data/####/tool.egret-labs.org.xml.bak
/data/data/####/tramini.xml
/data/data/####/tt_ad_sdk_sp.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/tt_sp_app_list.xml
/data/data/####/ttnet_tnc_config.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/turingfd_conf_105498_auMini.xml
/data/data/####/turingfd_conf_105498_auMini.xml.bak
/data/data/####/turingfd_protect_105498_45_auMini.xml
/data/data/####/update_lc
/data/data/####/yaq.eb42346a.sec
/data/data/####/yaq2.eb42346a.sec
/data/data/####/yaq3_0.eb42346a.sec
/data/data/####/yaqsdkcookie
/data/data/####/yd_config_c.xml
/data/media/####/.did
/data/media/####/.kkid
/data/media/####/.turing.dat
/data/media/####/.usdis
/data/media/####/65E5B2734BC1CE3FC75BF675A390E88E
/data/media/####/6E749A00C83682F9F04C8C90619C26F1
/data/media/####/6E749A00C83682F9F04C8C90619C26F1.temp
/data/media/####/6E749A00C83682F9F04C8C90619C26F1.zip
/data/media/####/7256A17995AA65F989B6622B9B448418
/data/media/####/8E7DF91940E3B1D1B86A9498DD67BEB4
/data/media/####/8E7DF91940E3B1D1B86A9498DD67BEB4.temp
/data/media/####/8E7DF91940E3B1D1B86A9498DD67BEB4.zip
/data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE
/data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.temp
/data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.zip
/data/media/####/99EED97C18B17D15C0D7E3A2C717B385
/data/media/####/99EED97C18B17D15C0D7E3A2C717B385.jar
/data/media/####/99EED97C18B17D15C0D7E3A2C717B385.temp
/data/media/####/A2B147E1CEFFE94412C486F9706132C3
/data/media/####/A2B147E1CEFFE94412C486F9706132C3.temp
/data/media/####/A2B147E1CEFFE94412C486F9706132C3.zip
/data/media/####/ADA15C06CDB669FEAA94E957FB80039F
/data/media/####/ADA15C06CDB669FEAA94E957FB80039F.temp
/data/media/####/ADA15C06CDB669FEAA94E957FB80039F.zip
/data/media/####/C428E4BC6FBA4CC143BD8F028EF43452
/data/media/####/CA7D898961228BF9A6EBC717E0F19DCE
/data/media/####/CCCC5B8911BBCB224E5317F7FB929A12
/data/media/####/CCCC5B8911BBCB224E5317F7FB929A12.jar
/data/media/####/CCCC5B8911BBCB224E5317F7FB929A12.temp
/data/media/####/D967A959D8E39AF63D48D9EACAEC1F70.temp
/data/media/####/D967A959D8E39AF63D48D9EACAEC1F70.zip
/data/media/####/DE90C826B19E14EEEB385DD0F7C756EF
/data/media/####/_pn
/data/media/####/a2c1956086bbb7b80ca1512858c072f8
/data/media/####/a2c1956086bbb7b80ca1512858c072f8.tmp
/data/media/####/tbslog.txt
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/data/user/0/<Package>/files/cid
/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.edifa/kdtxnvkv.jar --oat-fd=69 --oat-location=/data/user/0/<Package>/.edifa/kdtxnvkv.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_e_qq_com_plugin_74304d2fb6be1d11e99f8bb9d1b6ad1e/gdt_plugin.jar --oat-fd=76 --oat-location=/data/user/0/<Package>/app_e_qq_com_dex_74304d2fb6be1d11e99f8bb9d1b6ad1e/gdt_plugin.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/runtime-dex.jar --oat-fd=128 --oat-location=/data/user/0/<Package>/files/runtime-dex.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/6E749A00C83682F9F04C8C90619C26F1.zip --oat-fd=102 --oat-location=/data/user/0/<Package>/files/6E749A00C83682F9F04C8C90619C26F1.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/8E7DF91940E3B1D1B86A9498DD67BEB4.zip --oat-fd=186 --oat-location=/data/user/0/<Package>/files/8E7DF91940E3B1D1B86A9498DD67BEB4.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.zip --oat-fd=78 --oat-location=/data/user/0/<Package>/files/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/99EED97C18B17D15C0D7E3A2C717B385.jar --oat-fd=59 --oat-location=/data/user/0/<Package>/files/99EED97C18B17D15C0D7E3A2C717B385.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/A2B147E1CEFFE94412C486F9706132C3.zip --oat-fd=294 --oat-location=/data/user/0/<Package>/files/A2B147E1CEFFE94412C486F9706132C3.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/ADA15C06CDB669FEAA94E957FB80039F.zip --oat-fd=293 --oat-location=/data/user/0/<Package>/files/ADA15C06CDB669FEAA94E957FB80039F.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/CCCC5B8911BBCB224E5317F7FB929A12.jar --oat-fd=163 --oat-location=/data/user/0/<Package>/files/CCCC5B8911BBCB224E5317F7FB929A12.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/D967A959D8E39AF63D48D9EACAEC1F70.zip --oat-fd=270 --oat-location=/data/user/0/<Package>/files/D967A959D8E39AF63D48D9EACAEC1F70.dex --compiler-filter=speed
/system/bin/df
/system/bin/getprop
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/cache/Download
chmod 777 /data/user/0/<Package>/files/cid
getprop
getprop ro.board.platform
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.sv.version
getprop ro.lenovo.lvp.version
getprop ro.letv.release.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
getprop ro.yunos.build.version
mount
sh

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES
RC4-ECB-NoPadding
RSA-ECB-NoPadding
RSA-ECB-PKCS1PADDING
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
RSA-None-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about accounts associated with the device (Google, Facebook, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial