Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- a####.####.com
- d####.####.cn
- p####.####.com
- y####.####.cn
Запросы HTTP GET:
- a####.####.com/avatar/food/000/00/02/94.jpg
- d####.####.cn/jarFile/SDKAutoUpdate/wet4.jar
- p####.####.com/cityjson?ie=####
Запросы HTTP POST:
- y####.####.cn/k2?protocol=####&version=####&cid=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_database/####/contents__0.localstorage-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/UzAppStorage.xml
- <Package Folder>/shared_prefs/UzAppStorage.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/analytics_run_info.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/widget/####/all_searchicon.png
- <Package Folder>/widget/####/api.css
- <Package Folder>/widget/####/api.js
- <Package Folder>/widget/####/bmi_ico_ds.png
- <Package Folder>/widget/####/bmi_ico_fd.png
- <Package Folder>/widget/####/bmi_ico_gj.png
- <Package Folder>/widget/####/bmi_ico_gz.png
- <Package Folder>/widget/####/bmi_ico_jw.png
- <Package Folder>/widget/####/bmi_ico_ko.png
- <Package Folder>/widget/####/bmi_ico_kp.png
- <Package Folder>/widget/####/bmi_ico_kz.png
- <Package Folder>/widget/####/bmi_ico_mp.png
- <Package Folder>/widget/####/bmi_ico_pz.png
- <Package Folder>/widget/####/bmi_ico_qc.png
- <Package Folder>/widget/####/bmi_ico_sb.png
- <Package Folder>/widget/####/bmi_ico_sj.png
- <Package Folder>/widget/####/bmi_ico_yy.png
- <Package Folder>/widget/####/common.css
- <Package Folder>/widget/####/common.js
- <Package Folder>/widget/####/ezapp.css
- <Package Folder>/widget/####/ezapp.js
- <Package Folder>/widget/####/food.html
- <Package Folder>/widget/####/food_con.html
- <Package Folder>/widget/####/ic_food_light_green.png
- <Package Folder>/widget/####/ic_food_light_red.png
- <Package Folder>/widget/####/ic_food_light_yellow.png
- <Package Folder>/widget/####/ic_huabian_down.png
- <Package Folder>/widget/####/icon150x150.png
- <Package Folder>/widget/####/index.html
- <Package Folder>/widget/####/index_bg_0.jpg
- <Package Folder>/widget/####/index_bg_1.jpg
- <Package Folder>/widget/####/index_bg_2.jpg
- <Package Folder>/widget/####/index_bg_3.jpg
- <Package Folder>/widget/####/index_bg_4.jpg
- <Package Folder>/widget/####/index_bg_5.jpg
- <Package Folder>/widget/####/index_bg_6.jpg
- <Package Folder>/widget/####/index_bg_7.jpg
- <Package Folder>/widget/####/index_bg_8.jpg
- <Package Folder>/widget/####/index_bg_9.jpg
- <Package Folder>/widget/####/launch1080x1920.png
- <Package Folder>/widget/####/loading.gif
- <Package Folder>/widget/####/loading_more.gif
- <Package Folder>/widget/####/nocache.js
- <Package Folder>/widget/####/plus_ad.js
- <Package Folder>/widget/####/plus_ajax.js
- <Package Folder>/widget/####/plus_apiTouch.js
- <Package Folder>/widget/####/plus_fixedwidth.js
- <Package Folder>/widget/####/plus_icache.js
- <Package Folder>/widget/####/plus_sqlite.js
- <Package Folder>/widget/####/plus_tmpl.js
- <Package Folder>/widget/####/plus_touch.js
- <Package Folder>/widget/####/search.html
- <Package Folder>/widget/####/search_close.png
- <Package Folder>/widget/####/search_con.html
- <Package Folder>/widget/####/search_normal.png
- <Package Folder>/widget/####/sso_grant.png
- <Package Folder>/widget/####/style.css
- <Package Folder>/widget/####/zepto.min.js
- <Package Folder>/widget/####/zhifang.jpg
- <Package Folder>/widget/####/zhifang_add.png
- <Package Folder>/widget/.APIcloud
- <Package Folder>/widget/config.xml
- <SD-Card>/Download/####/4.8_wet4.jar.tmp
- <SD-Card>/UZMap/####/httpwww.shoushenriji.comavatarfood000000294.jpg
- <SD-Card>/UZMap/.nomedia
- <SD-Card>/dt/restime.dat
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
