Android.Siggen.7882

Technical information

Malicious functions:

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) tcms-a####.wan####.ta####.com:443
TCP(HTTP/1.1) haowa####.oss.aliy####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) m.d####.mob.com:80
TCP(HTTP/1.1) w####.q####.dn.####.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) c.d####.mob.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) tcms-op####.wan####.ta####.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) hotp####.wan####.ta####.com:80
TCP(HTTP/1.1) w####.ta####.com:80
TCP(HTTP/1.1) s.haowa####.com:8900
TCP(TLS/1.0) a####.m.ta####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) s.haowa####.com:8008
TCP 2####.204.101.107:80
TCP umengj####.m.ta####.com:443
TCP ope####.m.ta####.com:443
TCP zhizhi####.com:5222

DNS requests:

_ja####._####.zhizhi####.com
_xmpp-c####._####.zhizhi####.com
a####.exc.mob.com
a####.m.ta####.com
a####.m.ta####.com
a####.u####.com
ag####.m.ta####.com
c.d####.mob.com
haowa####.oss.aliy####.com
haowa####.qin####.com
hotp####.wan####.ta####.com
m.d####.mob.com
msg.umengc####.com
s.haowa####.com
tcms-a####.wan####.ta####.com
tcms-op####.wan####.ta####.com
umen####.m.ta####.com
umengj####.m.ta####.com
w####.ta####.com
zhizhi####.com

HTTP GET requests:

haowa####.oss.aliy####.com/0601bbfe2e62f0463f5fa1fda7ae9894
haowa####.oss.aliy####.com/1d093e1d75dc46c8f726acc35bd5af93
haowa####.oss.aliy####.com/1d331774749ea5913cd1e2fd302dfaba
haowa####.oss.aliy####.com/31e632acfc0a4418ed760af09d5e308b
haowa####.oss.aliy####.com/3c8ea007bbad58ca044d33146e303b66
haowa####.oss.aliy####.com/44bf5fe6ad3d8f9bbb37c0f04e373e6f
haowa####.oss.aliy####.com/5769688695d9b0c84ac07e4269258a44
haowa####.oss.aliy####.com/5a6635f356cddc8e1b6adf1282cd4861
haowa####.oss.aliy####.com/81272a3dc04db08c92dcd2b8866c6e1c
haowa####.oss.aliy####.com/8cb7cd5df9ebcb4cd03510819e4e60e9
haowa####.oss.aliy####.com/9752d3c436d284be48e346df7f86fce8
haowa####.oss.aliy####.com/9888b649b25ee812c7228947bf1d0325
haowa####.oss.aliy####.com/9d2d12f851578c0620e47c7d8ed80afc
haowa####.oss.aliy####.com/a03205c89d444582315559fd80f738b2
haowa####.oss.aliy####.com/a3c4f1305dd6f31c41a6e6ca532eae57
haowa####.oss.aliy####.com/a53ec17aaa264f6215e89c47111d51f7
haowa####.oss.aliy####.com/a8d5b31da1e3a12768d1e524de5e7a5e
haowa####.oss.aliy####.com/b27011e017c6ac47f65a26d331dfae78
haowa####.oss.aliy####.com/b6dbc7ac1d41034e6e705e292dbc5db4
haowa####.oss.aliy####.com/b723e028d45e4494dde26eec3032d5ec
haowa####.oss.aliy####.com/b8b5b6865f26e11e2e7f99f6bb62cacc
haowa####.oss.aliy####.com/bbc42029f445db670f66c4dbeda67cab
haowa####.oss.aliy####.com/d16be67f80ee7bf63ccc17b203261477
haowa####.oss.aliy####.com/d62a9291c8a6b9df8179a6bac68a6dc5
haowa####.oss.aliy####.com/e0662d6461a950fa61ebedbc728074b9
haowa####.oss.aliy####.com/e5a3d3cb7b23a4386ef085c9e10c1f9f
haowa####.oss.aliy####.com/eb523e331c97bc1a2025be7184afbdec
haowa####.oss.aliy####.com/fb8da619a3bd66fb3867ead7e12f696d
haowa####.oss.aliy####.com/fc42f11a63a3da35f1f8406639c0d0ce
hotp####.wan####.ta####.com/patch?version=####&patchver=####&platform=##...
m.d####.mob.com/v3/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
s.haowa####.com:8900/RegisterDemo1/servlet/GetAppreClassInfo?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/GetAppreciation?jid=####&acti...
s.haowa####.com:8900/RegisterDemo1/servlet/GetComList?noteid=####&visid=...
s.haowa####.com:8900/RegisterDemo1/servlet/GetForumInfo?forumid=####
s.haowa####.com:8900/RegisterDemo1/servlet/GetInvcode?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/GetNewsList?jid=####&newsid=#...
s.haowa####.com:8900/RegisterDemo1/servlet/GetNoteInfo?noteid=####&jid=#...
s.haowa####.com:8900/RegisterDemo1/servlet/GetPostList?jid=####&forumid=...
s.haowa####.com:8900/RegisterDemo1/servlet/GetRecomUser?page=####&subtyp...
s.haowa####.com:8900/RegisterDemo1/servlet/GetReplyList?jid=####&forumid...
s.haowa####.com:8900/RegisterDemo1/servlet/GetUserInfo?jid=####&vsjid=####
s.haowa####.com:8900/RegisterDemo1/servlet/HuabarMarket?type=####&warety...
s.haowa####.com:8900/RegisterDemo1/servlet/SyncSp?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/UpLoadUmToken?jid=####&passwd...
tcms-a####.wan####.ta####.com:443/imlogingw/tcp60login?devid=####&ver=####
tcms-op####.wan####.ta####.com/getapprule?appkey=####&appId=####
w####.q####.dn.####.com/04bf30fb84cb4247d51894adca54ca20
w####.q####.dn.####.com/0f24ac1a0a4097ee4bbc6af7341a7d2d
w####.q####.dn.####.com/1091af2c40cc8a4ef619e593531117bd
w####.q####.dn.####.com/1de810b9c4cf77f9a0c0cf7082640602
w####.q####.dn.####.com/2017-11-18-19-08-34o901onco-0.png
w####.q####.dn.####.com/378eb96b4551d35ffa9568b3c83812ee
w####.q####.dn.####.com/3afabe71174f4fab5c0dad4f4c2186d7
w####.q####.dn.####.com/46eae98f85ced1442eb56e27e4c82a6c
w####.q####.dn.####.com/58089e31c090a413928eeab1e8efd6b0
w####.q####.dn.####.com/5a3cfaff50b41166d30cafd94473fb97
w####.q####.dn.####.com/6bfa3d5b0f13422a10f2a5952b908e3e
w####.q####.dn.####.com/7124b9553a61aeb87cb3bd43b82aa52e
w####.q####.dn.####.com/71253c8c7747047f19e6ad77475b58e6
w####.q####.dn.####.com/b4375896185f9257fdd1426620ac2ff2
w####.q####.dn.####.com/b7c123c729f8e44ff04f5bc719dba43e
w####.q####.dn.####.com/c0e3767580b2164ab6337bd3782f9705
w####.q####.dn.####.com/dde2c7c1b90191ef667c19594b502cc1
w####.q####.dn.####.com/df50f81e6ba0a19a2d5163508d1c7fdd
w####.q####.dn.####.com/e4f13bba1b3724f9968755912a127c09
w####.q####.dn.####.com/e736831305a64eea60c42a707eecb883
w####.q####.dn.####.com/f66a5a8531d4ca91cbcda88cd0cc3fb0
w####.q####.dn.####.com/f9a7e9bea1ce048ca3b21735e19f7d12

HTTP POST requests:

a####.exc.mob.com/errconf
a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
c.d####.mob.com/v2/cdata
msg.umengc####.com/register
s.haowa####.com:8900/RegisterDemo1/servlet/Collecting
w####.ta####.com/api/user/getUser.json

Modified file system:

Creates the following files:

<Package Folder>/app_KeyStore/KeyStore.bks
<Package Folder>/cache/####/-r-5sH0LbE5lzgaOFmM_SmUZy5M.-1398855055.tmp
<Package Folder>/cache/####/0117a47313c36b47f0869cb1243c287d.0.tmp
<Package Folder>/cache/####/0117a47313c36b47f0869cb1243c287d.1.tmp
<Package Folder>/cache/####/04f3dcc0a03d6a2a357e578d0c671200.0.tmp
<Package Folder>/cache/####/04f3dcc0a03d6a2a357e578d0c671200.1.tmp
<Package Folder>/cache/####/0PPs2kIlc7CAhaNVWw3minEw5_s.1233674353.tmp
<Package Folder>/cache/####/0SlCdIrB1IHZ-jHPMNoyxmUr-Wk.-890710478.tmp
<Package Folder>/cache/####/0acc60aa2236a0810d19c5e98c5a1b53.0.tmp
<Package Folder>/cache/####/0acc60aa2236a0810d19c5e98c5a1b53.1.tmp
<Package Folder>/cache/####/1552f87a3380c25478f7d553f8277034.0.tmp
<Package Folder>/cache/####/1552f87a3380c25478f7d553f8277034.1.tmp
<Package Folder>/cache/####/1606a441792604e91b8ba4525d3d0b04.0.tmp
<Package Folder>/cache/####/1606a441792604e91b8ba4525d3d0b04.1.tmp
<Package Folder>/cache/####/1714d01d4b32de328b0bbcafd55fd284.0.tmp
<Package Folder>/cache/####/1714d01d4b32de328b0bbcafd55fd284.1.tmp
<Package Folder>/cache/####/1d788cb34b8e103489e51511466da3ce.0.tmp
<Package Folder>/cache/####/1d788cb34b8e103489e51511466da3ce.1.tmp
<Package Folder>/cache/####/1efe1ddbce8af9e3183bf10ab69484cf.0.tmp
<Package Folder>/cache/####/1efe1ddbce8af9e3183bf10ab69484cf.1.tmp
<Package Folder>/cache/####/284352fbbde80b86f08a241d49e1a945.0.tmp
<Package Folder>/cache/####/284352fbbde80b86f08a241d49e1a945.1.tmp
<Package Folder>/cache/####/2b7ed9a459cb204596c40349c2153919.0.tmp
<Package Folder>/cache/####/2b7ed9a459cb204596c40349c2153919.1
<Package Folder>/cache/####/2bbb3e896de2f8d3d0bd9f8a2553edbc.0.tmp
<Package Folder>/cache/####/2bbb3e896de2f8d3d0bd9f8a2553edbc.1.tmp
<Package Folder>/cache/####/2c57ebe3265fe9b36b37c726be83b248.0.tmp
<Package Folder>/cache/####/2c57ebe3265fe9b36b37c726be83b248.1.tmp
<Package Folder>/cache/####/2lgLX01K3BSBnknwb8SU_BbCNAc.-1707489269.tmp
<Package Folder>/cache/####/348384ea02691facd453ed9a347d4697.0.tmp
<Package Folder>/cache/####/348384ea02691facd453ed9a347d4697.1.tmp
<Package Folder>/cache/####/387ec46b6c7608e70865e5a83a5227c3.0.tmp
<Package Folder>/cache/####/387ec46b6c7608e70865e5a83a5227c3.1.tmp
<Package Folder>/cache/####/3YQc3XgglzklMWAaLW3Tj4UirHg.-499750337.tmp
<Package Folder>/cache/####/3ZKx-7Ri5-G-AmAhJ0EVqehv4ww.-1969633489.tmp
<Package Folder>/cache/####/3a7d5d7b4ab9a6ebd710e58bdc2dedae.0.tmp
<Package Folder>/cache/####/3a7d5d7b4ab9a6ebd710e58bdc2dedae.1.tmp
<Package Folder>/cache/####/4351a1cc5fff94468d30f58e2afe5227.0.tmp
<Package Folder>/cache/####/4351a1cc5fff94468d30f58e2afe5227.1.tmp
<Package Folder>/cache/####/4a7e96debe6dcefbdd9989e7b8cd7e38.0.tmp
<Package Folder>/cache/####/4a7e96debe6dcefbdd9989e7b8cd7e38.1.tmp
<Package Folder>/cache/####/59efdeee6b34b5f9e6553fd54fae3b89.0.tmp
<Package Folder>/cache/####/59efdeee6b34b5f9e6553fd54fae3b89.1.tmp
<Package Folder>/cache/####/5b86b5d3e5bea2e3e12b5d8fb21e48f3.0.tmp
<Package Folder>/cache/####/5b86b5d3e5bea2e3e12b5d8fb21e48f3.1.tmp
<Package Folder>/cache/####/619c3965c435a089955a985c13dc8d01.0.tmp
<Package Folder>/cache/####/619c3965c435a089955a985c13dc8d01.1.tmp
<Package Folder>/cache/####/620bbe57062ee24b0f15f2c3ea95de74.0.tmp
<Package Folder>/cache/####/620bbe57062ee24b0f15f2c3ea95de74.1.tmp
<Package Folder>/cache/####/6885514e876d5b08c19d77c0a5c56deb.0.tmp
<Package Folder>/cache/####/6885514e876d5b08c19d77c0a5c56deb.1.tmp
<Package Folder>/cache/####/6c8aeb8d3c69392f08dfcaaed5ca0e6b.0.tmp
<Package Folder>/cache/####/6c8aeb8d3c69392f08dfcaaed5ca0e6b.1.tmp
<Package Folder>/cache/####/6e75f7543d1ff43d8d12fb46a2ae5b4c.0.tmp
<Package Folder>/cache/####/6e75f7543d1ff43d8d12fb46a2ae5b4c.1.tmp
<Package Folder>/cache/####/6oJTPtWl1HlQSs33lDaZ_iZqCr8.-1428367183.tmp
<Package Folder>/cache/####/7443b47a7ccd11f86fe4f73b46b1dc8c.0.tmp
<Package Folder>/cache/####/7443b47a7ccd11f86fe4f73b46b1dc8c.1.tmp
<Package Folder>/cache/####/75faacc6d47ddb0a6f16f0a452637368.0.tmp
<Package Folder>/cache/####/75faacc6d47ddb0a6f16f0a452637368.1.tmp
<Package Folder>/cache/####/78fdca77794ab47bc62c3c392dc7b967.0.tmp
<Package Folder>/cache/####/78fdca77794ab47bc62c3c392dc7b967.1.tmp
<Package Folder>/cache/####/7RrZMDv-sRaDOGIty760j1a_Vzo.1633213880.tmp
<Package Folder>/cache/####/7ed7d9733eb7f34b60534d1a45068365.0.tmp
<Package Folder>/cache/####/7ed7d9733eb7f34b60534d1a45068365.1.tmp
<Package Folder>/cache/####/8a0gz_44bj5w3Km1BQZsWs-Xo68.-1141370277.tmp
<Package Folder>/cache/####/8dab3c9b7533c9d975e6abe459b9b391.0.tmp
<Package Folder>/cache/####/8dab3c9b7533c9d975e6abe459b9b391.1.tmp
<Package Folder>/cache/####/9F4JaJDCPY6WqcdoeFKVGAWIXnw.1794473443.tmp
<Package Folder>/cache/####/9lmDVNEbPEYjmtopFaKrp4Pg5IE.cnt
<Package Folder>/cache/####/<Package>_2084
<Package Folder>/cache/####/<Package>_TcmsService_2133
<Package Folder>/cache/####/Bgzlc9ZonVHNNCE85O5Of_KMntw.-1475223461.tmp
<Package Folder>/cache/####/BmZGRMPfqyJaCSA2e289KYyLiMc.-273269198.tmp
<Package Folder>/cache/####/DMqNa5nfv5aUbewolqqGiHc9EBU.-1612360523.tmp
<Package Folder>/cache/####/FPdqebpdeNiheD_hQjstnAoRpEo.-434975401.tmp
<Package Folder>/cache/####/J9AdqC4O3GO6ziYHMEGCxqYsTmc.-1325650252.tmp
<Package Folder>/cache/####/L40rgOY83yNvYjSf2mPG8LttQ6A.1119786722.tmp
<Package Folder>/cache/####/LJeiV6sgIhzTi5s4hxdnzDNtrcg.1842331962.tmp
<Package Folder>/cache/####/NbshjiMLs8fq9dGZI4wdh6V5-yM.1252907968.tmp
<Package Folder>/cache/####/Q-EbmGE_ociA-WoRCbwZFX_aiRI.640859121.tmp
<Package Folder>/cache/####/SYS5M7TpYPdERi3lbDrtCwAseGs.213314328.tmp
<Package Folder>/cache/####/TwRyKE3TrVQAcE07JyCA1PlMk6k.-1482123541.tmp
<Package Folder>/cache/####/UU8PZU20XCpme7FqQ76v2-eG4s0.-607559509.tmp
<Package Folder>/cache/####/UmgTK72EfJ6unE5FtEiXultBM30.-1128437809.tmp
<Package Folder>/cache/####/VPcCrtodC4muVKyuXBKcCexVmy4.1463818838.tmp
<Package Folder>/cache/####/Ws3A_j1TyQatpyjNTvmdETQymB8.1114768660.tmp
<Package Folder>/cache/####/X40Hp3SXXVLd8Ue1_J91KyPjJL8.-1841594590.tmp
<Package Folder>/cache/####/XFiHsekkOCmwUWwoEYgD6MJ6TBM.-1826417983.tmp
<Package Folder>/cache/####/XuOjQUKT08B-jjQ8MaqfRhznrgg.1335188020.tmp
<Package Folder>/cache/####/YNd1_MsTmRjte2AqTII_TJNZS5Q.-1353829254.tmp
<Package Folder>/cache/####/_cMwevLwoLFnyAZWnTHF2-8lVaU.-1541225739.tmp
<Package Folder>/cache/####/ad8dd7285de3e1a0a0345831003d7520.0.tmp
<Package Folder>/cache/####/ad8dd7285de3e1a0a0345831003d7520.1.tmp
<Package Folder>/cache/####/b68a036a867d83e5adfdff0d4b92e382.0.tmp
<Package Folder>/cache/####/b68a036a867d83e5adfdff0d4b92e382.1.tmp
<Package Folder>/cache/####/b6f01cc5b9335716d65f6ba325cf338b.0.tmp
<Package Folder>/cache/####/b6f01cc5b9335716d65f6ba325cf338b.1.tmp
<Package Folder>/cache/####/c29bbe3a00a75ea6599b7350a8c6c9bc.0.tmp
<Package Folder>/cache/####/c29bbe3a00a75ea6599b7350a8c6c9bc.1.tmp
<Package Folder>/cache/####/c4f1c50366bb416d920a03ed6af47735.0.tmp
<Package Folder>/cache/####/c4f1c50366bb416d920a03ed6af47735.1.tmp
<Package Folder>/cache/####/cppVuE4iOnbT7gXiIhIk1Rx7VSI.-1361505731.tmp
<Package Folder>/cache/####/d3d0eb3930a0f5e78d617e6a74a52d53.0.tmp
<Package Folder>/cache/####/d3d0eb3930a0f5e78d617e6a74a52d53.1.tmp
<Package Folder>/cache/####/d9526ba18eb6d461026d0f71befa17de.0.tmp
<Package Folder>/cache/####/d9526ba18eb6d461026d0f71befa17de.1.tmp
<Package Folder>/cache/####/de2b8a25bb315f979d73b85e8957f91a.0.tmp
<Package Folder>/cache/####/de2b8a25bb315f979d73b85e8957f91a.1.tmp
<Package Folder>/cache/####/e4abee55d1a4642e05debddbb7168a38.0.tmp
<Package Folder>/cache/####/e4abee55d1a4642e05debddbb7168a38.1.tmp
<Package Folder>/cache/####/e6-yTl5wJ14qQ_xvhxN7jEY05Lo.-1335617964.tmp
<Package Folder>/cache/####/e6eef042e3041e0a42d9ccfd8d752f43.0.tmp
<Package Folder>/cache/####/e6eef042e3041e0a42d9ccfd8d752f43.1.tmp
<Package Folder>/cache/####/ea6c5f716c5716c7d1ee2eddca1418d4.0.tmp
<Package Folder>/cache/####/ea6c5f716c5716c7d1ee2eddca1418d4.1.tmp
<Package Folder>/cache/####/eaeb397e53f49e577664ea02c9f9370e.0.tmp
<Package Folder>/cache/####/eaeb397e53f49e577664ea02c9f9370e.1.tmp
<Package Folder>/cache/####/ede3beae9f4f88fbfe01352dc0ffc717.0.tmp
<Package Folder>/cache/####/ede3beae9f4f88fbfe01352dc0ffc717.1.tmp
<Package Folder>/cache/####/f26e2f709b364a56d3dc381a34de4aaf.0.tmp
<Package Folder>/cache/####/f26e2f709b364a56d3dc381a34de4aaf.1.tmp
<Package Folder>/cache/####/f2fa1954250dd5de067754aa16e55707.0.tmp
<Package Folder>/cache/####/f2fa1954250dd5de067754aa16e55707.1.tmp
<Package Folder>/cache/####/ff314f2d1677b551898f0120a59527f4.0.tmp
<Package Folder>/cache/####/ff314f2d1677b551898f0120a59527f4.1.tmp
<Package Folder>/cache/####/gpFES4Z_Vw2b1o7ISRa6HtK11Yo.-2077126237.tmp
<Package Folder>/cache/####/hfbu5AqV8PuVDTyi7Zm3b60wJLU.1123531960.tmp
<Package Folder>/cache/####/hgSxJmwHQvX_vmJrzV-ymZq_z5I.-728905279.tmp
<Package Folder>/cache/####/jG9jrplKPTDRcHNmr941wWIIiY0.-1277465200.tmp
<Package Folder>/cache/####/jHFwrMHmWPm-qcCh682YPh73xYo.-376929100.tmp
<Package Folder>/cache/####/jSWRQ8M6aupZP0NicpzYua6hUvQ.1539416963.tmp
<Package Folder>/cache/####/jYLLNlkaM8S87Zh3lvd6DDTKYH0.-744706187.tmp
<Package Folder>/cache/####/jbcmnvPVU58myteDgZtF3qEcn1E.-441823389.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/####/mCJf708yX6ZmGw589vXV5PF1nZM.-1631597736.tmp
<Package Folder>/cache/####/meRjMCGs6hHOZTtMVOoHEWff2Lw.43183300.tmp
<Package Folder>/cache/####/nuj7zNqoMH7QPE3dsfJfVuunLxo.-1809409340.tmp
<Package Folder>/cache/####/oPDmIBmOOvmHp3qejtCjY4ZaYLU.802699850.tmp
<Package Folder>/cache/####/sY4nx_gzWueSUiGBzCzw7JqsyHg.-625977604.tmp
<Package Folder>/cache/####/suj_lm_ApnlY6lXQAqzhHjY-BBI.125280744.tmp
<Package Folder>/cache/####/tT0yUCyIW3L8eeqrkEObmKdveQM.2095706111.tmp
<Package Folder>/cache/####/u4UpLUhPC1ayW_x6AOQ2o0PGj7w.-134397807.tmp
<Package Folder>/cache/####/wBpLtbZnYjMqt2CQj24b29DOvJU.-1151105731.tmp
<Package Folder>/cache/####/yea_JGevMukAVi6jcz2ZwiRBZjA.1037976250.tmp
<Package Folder>/code_cache/####/<Package>-1.apk.classes-1773876492.zip
<Package Folder>/code_cache/####/<Package>-1.apk.classes1185262357.zip
<Package Folder>/databases/19cd1998e0eb75df377aa0259323ae26-journal
<Package Folder>/databases/MessageStore.db-journal
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/ThrowalbeLog.db-journal
<Package Folder>/databases/accs.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/hmdb
<Package Folder>/databases/hmdb-journal
<Package Folder>/databases/logdb.db
<Package Folder>/databases/logdb.db-journal
<Package Folder>/databases/message_accs_db
<Package Folder>/databases/message_accs_db-journal
<Package Folder>/databases/paintgame.db
<Package Folder>/databases/paintgame.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/eudemon
<Package Folder>/files/####/1d2b904cbeadfb72ed9546111a231c85.0
<Package Folder>/files/####/24c110e1f76093b35c3c2df1927aab79.0
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/journal
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/.imprint
<Package Folder>/files/.lock
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/exid.dat
<Package Folder>/files/sp.lock
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ACCS_BINDumeng;52a0242156240b5b4a0104f9.xml
<Package Folder>/shared_prefs/ACCS_SDK.xml
<Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml
<Package Folder>/shared_prefs/AGOO_BIND.xml
<Package Folder>/shared_prefs/Agoo_AppStore.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/UTCommon.xml
<Package Folder>/shared_prefs/UTMCConf-818791854.xml
<Package Folder>/shared_prefs/UTMCLog-818791854.xml
<Package Folder>/shared_prefs/channel_pre.xml
<Package Folder>/shared_prefs/cn_feng_skin_pref.xml
<Package Folder>/shared_prefs/mob_commons_1.xml
<Package Folder>/shared_prefs/mob_commons_1.xml.bak
<Package Folder>/shared_prefs/mob_sdk_exception_1.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/tcms_setting_sp.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/ywAccount.xml
<Package Folder>/shared_prefs/ywPrefsTools.xml
<Package Folder>/shared_prefs/ywPrefsTools.xml.bak
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.bar
<SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
<SD-Card>/.com.taobao.dp/dd7893586a493dc3
<SD-Card>/.serveruuid
<SD-Card>/<Package>/####/2_20171116_r
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/bd142a6fb74d40d5baacd407e63594ca
<SD-Card>/Android/####/deviceToken
<SD-Card>/Mob/####/.al
<SD-Card>/Mob/####/.dh-journal
<SD-Card>/Mob/####/.dhlock
<SD-Card>/Mob/####/.dic_lock
<SD-Card>/Mob/####/.duid
<SD-Card>/Mob/####/.globalLock
<SD-Card>/Mob/####/.nulal
<SD-Card>/Mob/####/.nulplt
<SD-Card>/Mob/####/.pkg_lock
<SD-Card>/Mob/####/.plst
<SD-Card>/Mob/####/.rcTag
<SD-Card>/Mob/####/.rc_lock
<SD-Card>/amap/####/1510835129594.db
<SD-Card>/amap/####/1510835130574.db
<SD-Card>/amap/####/1510835140209.db
<SD-Card>/amap/####/1510835180935.db
<SD-Card>/amap/####/alsn20170807.db
<SD-Card>/amap/####/alsn20170807.db-journal

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:52a0242156240b5b4a0104f9","utdid":"Wg2DuIOcKmgDAGdzx1FZlJLg","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
app_process /system/bin com.android.commands.pm.Pm list packages
cat /proc/cpuinfo | grep Serial
chmod 500 <Package Folder>/files/DaemonServer
getprop
getprop ro.product.cpu.abi
grep -E -v root|shell|system
ls -l /system/xbin/su
pm list packages
sh
top -d 0 -n 1

Loads the following dynamic libraries:

fb_jpegturbo
imagepipeline
inet.2.0
neh
securitysdk-3.1
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding
RSA-NONE-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial