Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- 2####.####.31
- 3####.####.com
- a####.####.com
- d####.####.cn
- fc####.####.com
- k####.####.com
- s####.####.cn
- s####.####.com
Запросы HTTP GET:
- 2####.####.31/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/hyjwan.jar?wsiph...
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- fc####.####.com/store_raw_download?buid=####&uuid=####&key=####
- s####.####.cn/bb_small/DhduwiaBa7lcEqdU4ORvs00KdxT10wSsOAiaKlKHiaMfgtIhs...
- s####.####.com/store_raw_download?buid=####&uuid=####
Запросы HTTP POST:
- 3####.####.com/BabyTingPicAudio/changwei/changwei_config.txt
- a####.####.com/app_logs
- k####.####.com/
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/babyting_shared.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.xy
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/14h92xt5tc9m028phg9p47idt
- <SD-Card>/Android/####/1d86i1z0a73eilvaq0mlvv1jn
- <SD-Card>/Android/####/1exykit7f0w8oa0ct1p0k4p08
- <SD-Card>/Android/####/1fpz63zvtlc7e9s2uug0utpe1
- <SD-Card>/Android/####/1hzjwxk9cffb0fc7btqvrteuv
- <SD-Card>/Android/####/1sjsjfddkegvg3e5djwkt2jjo
- <SD-Card>/Android/####/1vl8y4gg4niqyv2lgimpbrnkr
- <SD-Card>/Android/####/1xgfer2ykgtqrasdio0av3lt8
- <SD-Card>/Android/####/28j8lxccypdbp9if2g9ejspb
- <SD-Card>/Android/####/2ak960fq5zwvy61wvq6utnjwz
- <SD-Card>/Android/####/2efy1qplhsvdpmlvi9jk8aq20
- <SD-Card>/Android/####/2g1clireje2ywjfu1ufhykwa0
- <SD-Card>/Android/####/2khmlhyjuidxn69zbvtmaz95n
- <SD-Card>/Android/####/2oxi37g4qy8wjngi44g5tnp6z
- <SD-Card>/Android/####/2pibso8es8vvc0dd2y9bt5slp
- <SD-Card>/Android/####/2xi2431i93se0ivs4ugs9d9kn
- <SD-Card>/Android/####/3dh4lfw0xrv99tp96yj8lgi4m
- <SD-Card>/Android/####/3ds83ewezcxhohetf7779nqjj
- <SD-Card>/Android/####/3sgo09lwasp2wowfy1o8q68ro
- <SD-Card>/Android/####/45amcwt5tpn4d8z04o2auzxku
- <SD-Card>/Android/####/49pwdtke60a3vz3d6j5werb5m
- <SD-Card>/Android/####/49sog1ctjqxq2w8ml6ijejjk6
- <SD-Card>/Android/####/4cyxxta83b71cvvchhmxkyt72
- <SD-Card>/Android/####/4mto6py1y5ttvfi2lh6qmq10c
- <SD-Card>/Android/####/4sy6xut2idw9td3b932vug6kf
- <SD-Card>/Android/####/4sym7m0qbtief7re6vp1q0tfg
- <SD-Card>/Android/####/5ibaprd2cno0j6aaf4vyoaoeq
- <SD-Card>/Android/####/5nekyfrnt0o8p7tr2p5idaxky
- <SD-Card>/Android/####/614dcz9e6ffco292bpik0l55u
- <SD-Card>/Android/####/667fklu5bik06ho1hxvazomxy
- <SD-Card>/Android/####/69zena65i1evo0vo5ig0q2hwd
- <SD-Card>/Android/####/6hsbilt1lkfi7ip54jzcoi3jn
- <SD-Card>/Android/####/6pn0wz6ts2awf474wznaise6e
- <SD-Card>/Android/####/70ojix0hoigyyee0jefs6xeh2
- <SD-Card>/Android/####/72sz8swkd18e6ojwf0yvmqq82
- <SD-Card>/Android/####/79hv7sgonpokgdxoau8a0513q
- <SD-Card>/Android/####/7if4fj3atup3nqjyxqbjh6ok7
- <SD-Card>/Android/####/czib528vozltecgzznw56r8v
- <SD-Card>/Download/####/4.3_hyjwan.jar.tmp
- <SD-Card>/dt/restime.dat
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
