Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- d####.####.cn
- m####.####.com
Запросы HTTP GET:
- m####.####.com/static/up/2017/0513/af1a95bf-6838-4d06-aebc-1607a3ccb8e4....
- m####.####.com/static/up/2017/0520/0246bfb6-036e-43d6-9474-72aa8a90260f....
- m####.####.com/static/up/2016/0905/83b39399-254f-4fa3-9f5d-5b6e59f4e2df....
- m####.####.com/static/up/2017/0519/d9ff3694-5a7d-4573-9970-c54d6deaf087....
- m####.####.com/static/up/2017/0519/5a6f36b8-892a-4c4d-bdf0-f4aa526885f5....
- m####.####.com/static/up/2017/0513/5433bd1f-3bb8-4555-bab3-d2b8395c3398....
- m####.####.com/static/up/2017/0519/89635546-8032-431a-a419-19c822c60bb1....
- m####.####.com/static/up/2017/0519/0f74bfa7-99f9-483b-8862-053b6797434d....
- m####.####.com/static/up/2017/0513/5578eeb6-9606-435f-a786-3adca3fc1008....
- m####.####.com/static/up/2017/0520/96e08ed5-072c-4785-bb2f-716c19dcf186....
- m####.####.com/static/up/2017/0508/ccfe8d17-5d74-4ebb-a960-6d9f1b1f0a10....
- m####.####.com/static/up/2017/0519/76d43e2d-de61-4946-bd50-e2c621b64628....
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- m####.####.com/static/up/2017/0513/2de9933d-9939-47b2-9e1d-957e1d01d1dd....
- m####.####.com/static/up/2017/0520/a35c87a1-ffd8-4d80-9eb1-54e1eb77f26e....
- m####.####.com/static/up/2017/0513/967b9c15-3d1b-44b5-af8b-09ee96138b19....
- m####.####.com/static/up/2017/0519/064cea16-c9c4-4375-a967-d64d858444da....
- m####.####.com/static/up/2017/0519/23248835-d992-4eb3-92e4-f587aa57102d....
- m####.####.com/static/up/2017/0513/b59a01fe-646f-4878-9064-b66a47a5be22....
- m####.####.com/static/up/2017/0513/a62a8a14-391d-422f-bbde-c5c31fbd51a2....
- m####.####.com/static/up/2017/0324/694384b8-772c-4508-8604-8001fefbecef....
- m####.####.com/static/app/zixuewushu/update.html?1495016####
- m####.####.com/static/up/2017/0519/2468b9cc-a8fb-4744-970e-6b48af646362....
- m####.####.com/static/up/2017/0403/e61bcca1-156b-4f38-aa1a-02ecfb2197e2....
- m####.####.com/static/up/2017/0519/d872e7bd-2316-4edb-a813-0d68ed012899....
- m####.####.com/static/up/2017/0513/f7ec0aaf-9b1b-4a70-8c62-7a02f92ab7d0....
- m####.####.com/static/up/2017/0517/6a38d819-dc52-468f-9abd-d5623a5af3d5....
- m####.####.com/static/up/2017/0324/04a30a0e-5b9e-409e-a8f7-bd084a60d271....
- m####.####.com/static/up/2017/0519/1443e834-5933-4a28-9a85-12c2a69d7578....
- m####.####.com/static/up/2017/0519/7744d17c-a0ed-4b90-8bce-966813f94f62....
- m####.####.com/Home/IndexForAPP
- m####.####.com/static/up/2017/0302/2777499f-3f91-4216-b986-c239e8fdb3ca....
- m####.####.com/static/up/2017/0407/cb069a06-04c0-4823-ac17-e9dc7b73c4cf....
- m####.####.com/static/up/2017/0420/50494815-51f0-440b-8f3a-19efb424c385....
- m####.####.com/static/up/2017/0419/76df5d89-a924-4f1f-b3fc-5a413e7a9dbe....
- m####.####.com/static/up/2017/0511/4ecc5c20-df0e-46b7-9a0f-feac06e60d01....
- m####.####.com/static/up/2017/0513/c9c71e82-4176-4aa3-8fc7-d4b727b99cd3....
- m####.####.com/static/up/2017/0520/6c8920d6-62c5-4adc-a1a6-ba72b34bc854....
- m####.####.com/static/up/2017/0414/1c7c1770-2fec-433c-8b75-aec37ad8000f....
- m####.####.com/static/up/2017/0508/65e2e0e1-5ae1-4ef5-bbad-f4757d90eefb....
Запросы HTTP POST:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/H5ED6FF72.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/cc/cc.db-journal
- <Package Folder>/shared_prefs/pdr.xml
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/cc/cc.db
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.imei.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
