Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- 2####.####.35
- 3####.####.com
- a####.####.com
- d####.####.cn
- e####.####.cn
- fc####.####.com
- k####.####.com
- m####.####.com
- m####.####.com:8757
- o####.####.com
- s####.####.cn
- s####.####.com
Запросы HTTP GET:
- 2####.####.35/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/lvs.jar?wsiphost...
- d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
- fc####.####.com/store_raw_download?buid=####&uuid=####&key=####
- m####.####.com/sdk.html
- s####.####.cn/bb_small/DhduwiaBa7lcIhHtI4rCcAeoUmGJibJvCW1n8hdyiaONGeefH...
- s####.####.com/store_raw_download?buid=####&uuid=####
Запросы HTTP POST:
- 3####.####.com/BabyTingPicAudio/changwei/changwei_config.txt
- a####.####.com/app_logs
- e####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- k####.####.com/
- m####.####.com:8757/sdk.html
- o####.####.com/v2/get_update_time
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/babyting_shared.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/14h92xt5tc9m028phg9p47idt
- <SD-Card>/Android/####/16puo05t6kj2ivqkiegyea0jp
- <SD-Card>/Android/####/1d86i1z0a73eilvaq0mlvv1jn
- <SD-Card>/Android/####/1fpz63zvtlc7e9s2uug0utpe1
- <SD-Card>/Android/####/1j3ovrq5v4ocjuq0cbxpo320o
- <SD-Card>/Android/####/1ntz4qnk934uh7lep694964ei
- <SD-Card>/Android/####/1sjsjfddkegvg3e5djwkt2jjo
- <SD-Card>/Android/####/1xs08keaiypakk8n78nosn9u8
- <SD-Card>/Android/####/2ak960fq5zwvy61wvq6utnjwz
- <SD-Card>/Android/####/2khmlhyjuidxn69zbvtmaz95n
- <SD-Card>/Android/####/2oxi37g4qy8wjngi44g5tnp6z
- <SD-Card>/Android/####/2pibso8es8vvc0dd2y9bt5slp
- <SD-Card>/Android/####/2xi2431i93se0ivs4ugs9d9kn
- <SD-Card>/Android/####/3b0qloqeezyo3fmmfrz4w2m0i
- <SD-Card>/Android/####/3dh4lfw0xrv99tp96yj8lgi4m
- <SD-Card>/Android/####/3jeihzl5upa08dk2fs384fe3f
- <SD-Card>/Android/####/3sgo09lwasp2wowfy1o8q68ro
- <SD-Card>/Android/####/45amcwt5tpn4d8z04o2auzxku
- <SD-Card>/Android/####/49dzvwfm1hgq3c22elcq3pils
- <SD-Card>/Android/####/49sog1ctjqxq2w8ml6ijejjk6
- <SD-Card>/Android/####/4cyxxta83b71cvvchhmxkyt72
- <SD-Card>/Android/####/4mto6py1y5ttvfi2lh6qmq10c
- <SD-Card>/Android/####/4sym7m0qbtief7re6vp1q0tfg
- <SD-Card>/Android/####/4u7zadslna4tcn23tajuex3sd
- <SD-Card>/Android/####/567b7teynwdwawws9ejpbcvw1
- <SD-Card>/Android/####/5e9uwc9x8ed11g27xiisyhhq5
- <SD-Card>/Android/####/5fj4ciyccngpykopc9ew5j5dm
- <SD-Card>/Android/####/5nekyfrnt0o8p7tr2p5idaxky
- <SD-Card>/Android/####/5yiwu8kg5zhwoy5mcglhsdlx0
- <SD-Card>/Android/####/614dcz9e6ffco292bpik0l55u
- <SD-Card>/Android/####/667fklu5bik06ho1hxvazomxy
- <SD-Card>/Android/####/66bhanba44sot2cfx0s5qz5l5
- <SD-Card>/Android/####/69zena65i1evo0vo5ig0q2hwd
- <SD-Card>/Android/####/6hsbilt1lkfi7ip54jzcoi3jn
- <SD-Card>/Android/####/6ongj7y0ccpm44zev55993fs4
- <SD-Card>/Android/####/6pdvfwh634iuy3obway6jzdv8
- <SD-Card>/Android/####/6pn0wz6ts2awf474wznaise6e
- <SD-Card>/Android/####/77bca8m4kzx2t8u2es66im8qs
- <SD-Card>/Android/####/79hv7sgonpokgdxoau8a0513q
- <SD-Card>/Download/####/4.6_lvs.jar.t
- <SD-Card>/dt/restime.dat
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
