Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- 1####.####.210:9999
- 2####.####.31
- a####.####.com
- d####.####.cn
- statson####.####.com
- y####.####.cn
Запросы HTTP GET:
- 2####.####.31/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/wet4.jar?wsiphos...
- d####.####.cn/jarFile/SDKAutoUpdate/wet4.jar
Запросы HTTP POST:
- 1####.####.210:9999/register/
- a####.####.com/app_logs
- a####.####.com/rest/2.0/channel/4026276878358844298
- statson####.####.com/pushlog
- y####.####.cn/k2?protocol=####&version=####&cid=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/system/####/wallpaper
- <Package Folder>/app_icons/<Package>#com.kukool.iosapp.kulauncher.activity.SettingsActivity4Launcher#v2.png
- <Package Folder>/app_icons/<Package>#com.kukool.themestore.activity.ThemeActivity#v2.png
- <Package Folder>/app_icons/<Package>#com.umobi.android.embedbrowser.EmbedBrowserActivity#v2.png
- <Package Folder>/app_icons/com.android.browser#com.android.browser.BrowserActivity#v2.png
- <Package Folder>/app_icons/com.android.calculator2#com.android.calculator2.Calculator#v2.png
- <Package Folder>/app_icons/com.android.contacts#com.android.contacts.activities.PeopleActivity#v2.png
- <Package Folder>/app_icons/com.android.development#com.android.development.Development#v2.png
- <Package Folder>/app_icons/com.android.email#com.android.email.activity.Welcome#v2.png
- <Package Folder>/app_icons/com.android.gallery3d#com.android.camera.CameraLauncher#v2.png
- <Package Folder>/app_icons/com.android.gallery3d#com.android.gallery3d.app.Gallery#v2.png
- <Package Folder>/app_icons/com.android.inputmethod.latin#com.android.inputmethod.latin.setup.SetupActivity#v2.png
- <Package Folder>/app_icons/com.android.music#com.android.music.MusicBrowserActivity#v2.png
- <Package Folder>/app_icons/com.android.providers.downloads.ui#com.android.providers.downloads.ui.DownloadList#v2.png
- <Package Folder>/app_icons/com.android.quicksearchbox#com.android.quicksearchbox.SearchActivity#v2.png
- <Package Folder>/app_icons/com.android.settings#com.android.settings.Settings#v2.png
- <Package Folder>/app_icons/com.android.speechrecorder#com.android.speechrecorder.SpeechRecorderActivity#v2.png
- <Package Folder>/app_icons/com.android.vending#com.android.vending.AssetBrowserActivity#v2.png
- <Package Folder>/app_icons/com.example.android.notepad#com.example.android.notepad.NotesList#v2.png
- <Package Folder>/app_icons/com.example.android.rssreader#com.example.android.rssreader.RssReader#v2.png
- <Package Folder>/app_icons/com.google.android.gms#com.google.android.gms.common.settings.GoogleSettingsActivity#v2.png
- <Package Folder>/app_push_lib_v3_6/plugin-deploy.jar
- <Package Folder>/app_push_lib_v3_6/plugin-deploy.key
- <Package Folder>/databases/aiLauncher
- <Package Folder>/databases/aiLauncher-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/kukool.weather.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/592E6EF300F1-0001-0841-4900E4E90A04BeginSession.cls_temp
- <Package Folder>/files/####/592E6EF300F1-0001-0841-4900E4E90A04SessionApp.cls_temp
- <Package Folder>/files/####/592E6EF300F1-0001-0841-4900E4E90A04SessionDevice.cls_temp
- <Package Folder>/files/####/592E6EF300F1-0001-0841-4900E4E90A04SessionOS.cls_temp
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_8a38e99c-b430-4dbb-a7cc-facffa2d3ff9_1496215285075.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/.imprint
- <Package Folder>/files/mobclick_agent_cached_<Package>6
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;com.c.a.a.a.xml
- <Package Folder>/shared_prefs/control_preferences.xml
- <Package Folder>/shared_prefs/control_preferences.xml.bak
- <Package Folder>/shared_prefs/dbVersion.xml
- <Package Folder>/shared_prefs/guide_preferences_kukool.xml
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.r.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Download/####/4.8_wet4.jar.tmp
- <SD-Card>/baidu/####/apps
- <SD-Card>/baidu/####/lightapp_V4.db
- <SD-Card>/baidu/####/lightapp_V4.db-journal
- <SD-Card>/baidu/####/pushlappv2.db
- <SD-Card>/baidu/####/pushlappv2.db-journal
- <SD-Card>/baidu/####/pushstat_4.1.1.107.db
- <SD-Card>/baidu/####/pushstat_4.1.1.107.db-journal
- <SD-Card>/baidu/.cuid
- <SD-Card>/dt/restime.dat
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
