Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- d####.####.cn
- and####.####.com
- a####.####.com
Запросы HTTP GET:
- s####.####.com/2016/pic/344/010010231.png
- s####.####.com/mobile/res/banner/FruitSong.png
- s####.####.com/2016/mp4/test/ad2.mp4
- s####.####.com/2016/pic/344/010010019.png
- s####.####.com/2016/pic/344/010010016.png
- s####.####.com/2016/pic/344/010010111.png
- s####.####.com/2016/pic/344/010010107.png
- s####.####.com/2016/pic/344/010010002.png
- s####.####.com/2016/pic/344/010010014.png
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- s####.####.com/mobile/res/banner/Donkey.png
- s####.####.com/2016/pic/344/010010081.png
- s####.####.com/2016/mp4/test/ad1.mp4
- s####.####.com/2016/pic/344/010010105.png
- s####.####.com/2016/pic/344/010010225.png
- s####.####.com/2016/pic/344/010010226.png
- s####.####.com/2016/pic/344/010010227.png
- a####.####.com/upload/201512/1605/567133dae8251_2015121605.png
- s####.####.com/2016/pic/344/010010222.png
- s####.####.com/2016/pic/344/010010119.png
- s####.####.com/mobile/res/banner/if
- s####.####.com/2016/pic/344/010010114.png
- s####.####.com/2016/pic/344/010010221.png
- a####.####.com/upload/201509/1806/55fbe47b2e34b_2015091806.png
- s####.####.com/2016/pic/344/010010217.png
- s####.####.com/2016/mp4/test/ad3.mp4
Запросы HTTP POST:
- a####.####.com/app/api/1328/api.new?sign=####×tamp=####&v=####&app_...
- and####.####.com/rqd/async
- a####.####.com/app/api/321/api.new?sign=####×tamp=####&v=####&app_k...
- s####.####.com/cw/cp.action?requestId=####&g=####
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/picasso-cache/c0737eae5309010cf3caa8f6987e2233.0.tmp
- <Package Folder>/cache/picasso-cache/069a52ff14e35fd3850ebc7edb0661a2.1.tmp
- <Package Folder>/cache/picasso-cache/069a52ff14e35fd3850ebc7edb0661a2.0.tmp
- <Package Folder>/cache/picasso-cache/79c289cd2203fb8d53f42e9be16cb6e5.0.tmp
- <Package Folder>/cache/picasso-cache/681fffcd7c4817e4c8ec7066f75a3118.0.tmp
- <Package Folder>/cache/picasso-cache/44e677e4f3c5c0fbea543f9bb594a808.0.tmp
- <Package Folder>/cache/picasso-cache/d63a2231e625281d34fc8e822fb4913f.0.tmp
- <Package Folder>/cache/picasso-cache/ed598c5835abd88aadca0d58fa602132.1.tmp
- <Package Folder>/cache/picasso-cache/0bd891dc7a505c678c1708a4ce2dd5b2.1.tmp
- <Package Folder>/cache/picasso-cache/2e096c3653add4fc6f3bd6ae4dbb63c4.1.tmp
- <Package Folder>/cache/picasso-cache/69be43f6b551c2ba9ee3aaa4f76823b4.0.tmp
- <Package Folder>/cache/picasso-cache/97f16f2a6ed445740d3bf1acb99bedba.1.tmp
- <Package Folder>/cache/picasso-cache/ba3af3ac1bc04b2d8e2b4f67e4608438.1.tmp
- <Package Folder>/shared_prefs/umeng_feedback_user_info.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/cache/picasso-cache/254b3a88d95a3aa20ec855f3dfefe60d.1.tmp
- <Package Folder>/databases/afinal.db
- <Package Folder>/cache/picasso-cache/44e677e4f3c5c0fbea543f9bb594a808.1.tmp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/picasso-cache/bd0f63c2b613a8c52c5016b5eb76977a.0.tmp
- <Package Folder>/cache/picasso-cache/7bcc80c3a8ef057075759a943a7639c7.1.tmp
- <Package Folder>/cache/picasso-cache/d298eb14c66e704cbee6aae3ab59d414.0.tmp
- <Package Folder>/cache/picasso-cache/39705ef222be4b44e6ffcab44f2995ad.0.tmp
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/cache/picasso-cache/d63a2231e625281d34fc8e822fb4913f.1.tmp
- <Package Folder>/cache/picasso-cache/54f06af5b1f9a28f103889aae4d51637.0.tmp
- <Package Folder>/cache/picasso-cache/bd0f63c2b613a8c52c5016b5eb76977a.1.tmp
- <Package Folder>/shared_prefs/fb_audio_switch.xml
- <Package Folder>/cache/picasso-cache/2e096c3653add4fc6f3bd6ae4dbb63c4.0.tmp
- <Package Folder>/cache/picasso-cache/6c8cc1a3241a536730d2e499e5ef3a70.1.tmp
- <Package Folder>/cache/picasso-cache/15162b5d97dd47e67d5d408d654c3b82.1.tmp
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/picasso-cache/7bcc80c3a8ef057075759a943a7639c7.0.tmp
- <Package Folder>/databases/bugly_db_-journal
- <Package Folder>/cache/picasso-cache/69be43f6b551c2ba9ee3aaa4f76823b4.1.tmp
- <Package Folder>/databases/afinal.db-journal
- <Package Folder>/cache/picasso-cache/6c8cc1a3241a536730d2e499e5ef3a70.0.tmp
- <Package Folder>/cache/picasso-cache/47cc368153ed79f54f488feaf5cac5f9.1.tmp
- <Package Folder>/shared_prefs/SurfingScene_prefenrences.xml
- <Package Folder>/cache/picasso-cache/050b2b9e77bd3cd2dfe77cc16b753eb0.1.tmp
- <Package Folder>/cache/picasso-cache/db462dc47a1a9e238b664ab8a84cd875.1.tmp
- <Package Folder>/cache/picasso-cache/47cc368153ed79f54f488feaf5cac5f9.0.tmp
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/feedback_push.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/cache/picasso-cache/41fbcaf879de5389c3f09aea90a8e8a8.1.tmp
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/files/.imprint
- <Package Folder>/cache/picasso-cache/ed598c5835abd88aadca0d58fa602132.0.tmp
- <Package Folder>/cache/picasso-cache/79c289cd2203fb8d53f42e9be16cb6e5.1.tmp
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/cache/picasso-cache/050b2b9e77bd3cd2dfe77cc16b753eb0.0.tmp
- <Package Folder>/cache/picasso-cache/a6ed282995c2de79913ce8f864b82e9b.0.tmp
- <Package Folder>/cache/picasso-cache/15162b5d97dd47e67d5d408d654c3b82.0.tmp
- <Package Folder>/cache/picasso-cache/d298eb14c66e704cbee6aae3ab59d414.1.tmp
- <Package Folder>/files/security_info
- <Package Folder>/cache/picasso-cache/39705ef222be4b44e6ffcab44f2995ad.1.tmp
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/picasso-cache/41fbcaf879de5389c3f09aea90a8e8a8.0.tmp
- <Package Folder>/cache/picasso-cache/c0737eae5309010cf3caa8f6987e2233.1.tmp
- <Package Folder>/cache/picasso-cache/97f16f2a6ed445740d3bf1acb99bedba.0.tmp
- <Package Folder>/cache/picasso-cache/0bd891dc7a505c678c1708a4ce2dd5b2.0.tmp
- <Package Folder>/cache/picasso-cache/db462dc47a1a9e238b664ab8a84cd875.0.tmp
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/databases/downloadswc
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/cache/picasso-cache/54f06af5b1f9a28f103889aae4d51637.1.tmp
- <Package Folder>/cache/picasso-cache/journal.tmp
- <Package Folder>/cache/picasso-cache/681fffcd7c4817e4c8ec7066f75a3118.1.tmp
- <Package Folder>/cache/picasso-cache/a6ed282995c2de79913ce8f864b82e9b.1.tmp
- <Package Folder>/cache/picasso-cache/254b3a88d95a3aa20ec855f3dfefe60d.0.tmp
- <Package Folder>/cache/picasso-cache/ba3af3ac1bc04b2d8e2b4f67e4608438.0.tmp
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
Другие:
Запускает следующие shell-скрипты:
- getprop ro.board.platform
- <dexopt>
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.board.platform
Может автоматически отправлять СМС-сообщения.
