1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Language
Server load
1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
| Safety rating: |
| Behavior list |
| Basic Information |
|---|
| MD5:89c313f28b63ad9ac35cef1112139313 |
| Package names:com.lanyou.andrdesktop |
| Minimum operating environment:Android 2.2.x |
| copyright:Lanyou |
| Key behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | Global\Cor_Private_IPCBlock_v4_416 |
| Global\Cor_SxSPublic_IPCBlock_416 | |
| CiceroSharedMemDefaultS-* | |
| Local\UrlZonesSM_Administrator | |
| Global\Cor_Private_IPCBlock_v4_2140 | |
| Global\Cor_SxSPublic_IPCBlock_2140 | |
| AtlDebugAllocator_FileMappingNameStatic3_fd0 | |
| Behavior description: | 修改注册表_系统防火墙可信进程列表 |
| details: | \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\Local Settings\Temp\Trojan.exe |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 | |
| Process behavior | |
|---|---|
| Behavior description: | 隐藏窗口创建进程 |
| details: | ImagePath = , CmdLine = netsh firewall add allowedprogram "c:\documents and settings\administrator\local settings\temp\trojan.exe" "trojan.exe" enable |
| Behavior description: | 创建进程 |
| details: | ImagePath = C:\WINDOWS\system32\netsh.exe, CmdLine = netsh firewall add allowedprogram "C:\Documents and Settings\Administrator\Local Settings\Temp\Trojan.exe" "Trojan.exe" ENABLE |
| Behavior description: | 创建新文件进程 |
| details: | ImagePath = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Trojan.exe, CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Trojan.exe" |
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | Global\Cor_Private_IPCBlock_v4_416 |
| Global\Cor_SxSPublic_IPCBlock_416 | |
| CiceroSharedMemDefaultS-* | |
| Local\UrlZonesSM_Administrator | |
| Global\Cor_Private_IPCBlock_v4_2140 | |
| Global\Cor_SxSPublic_IPCBlock_2140 | |
| AtlDebugAllocator_FileMappingNameStatic3_fd0 | |
| Behavior description: | 创建可执行文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Temp\Trojan.exe |
| Behavior description: | 查找文件 |
| details: | FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.INI |
| FileName = C:\DOCUME~1 | |
| FileName = C:\DOCUME~1\ADMINI~1 | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1 | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp% | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445021557.161763.exe | |
| FileName = C:\Documents and Settings\ADMINI~1 | |
| FileName = C:\Documents and Settings\Administrator\LOCALS~1 | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\996E.INI | |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.INI | |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.INI | |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI | |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI | |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI | |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Trojan.exe |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\EnableFileTracing | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\EnableConsoleTracing | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\FileTracingMask | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\ConsoleTracingMask | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\MaxFileSize | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\FileDirectory | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\LogSessionName | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Active | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\ControlFlags | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr\Guid | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr\BitNames | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\LogSessionName | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\Active | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\ControlFlags | |
| Behavior description: | 修改注册表_系统环境变量 |
| details: | \REGISTRY\USER\S-*\Environment\SEE_MASK_NOZONECHECKS |
| Behavior description: | 修改注册表_系统防火墙可信进程列表 |
| details: | \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\Local Settings\Temp\Trojan.exe |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 | |
| Other behavior | |
|---|---|
| Behavior description: | 调用Sleep函数 |
| details: | [1]: MilliSeconds = 30000. |
| [2]: MilliSeconds = -1. | |
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| 5cd8f17f4086744065eb0992a09e05a2 | |
| Local\ZonesCounterMutex | |
| Local\ZoneAttributeCacheCounterMutex | |
| Local\ZonesCacheCounterMutex | |
| Local\ZonesLockedCacheCounterMutex | |
| SHIMLIB_LOG_MUTEX | |
| RasPbFile | |
| Behavior description: | 获取系统权限 |
| details: | SE_DEBUG_PRIVILEGE |
| SE_INC_BASE_PRIORITY_PRIVILEGE | |
| SE_LOAD_DRIVER_PRIVILEGE | |
| Behavior description: | 获取TickCount值 |
| details: | TickCount = 516234, SleepMilliseconds = 30000. |
| TickCount = 516312, SleepMilliseconds = 30000. | |
| TickCount = 516515, SleepMilliseconds = 30000. | |
| TickCount = 516578, SleepMilliseconds = 30000. | |
| TickCount = 516593, SleepMilliseconds = 30000. | |
| TickCount = 516687, SleepMilliseconds = 30000. | |
| TickCount = 516703, SleepMilliseconds = 30000. | |
| TickCount = 516718, SleepMilliseconds = 30000. | |
| TickCount = 516953, SleepMilliseconds = 30000. | |
| TickCount = 487218, SleepMilliseconds = 250. | |
| TickCount = 516953, SleepMilliseconds = 250. | |
| TickCount = 487234, SleepMilliseconds = 250. | |
| TickCount = 487004, SleepMilliseconds = 20. | |
| TickCount = 487020, SleepMilliseconds = 20. | |
| TickCount = 487051, SleepMilliseconds = 20. | |
| Dynamic list behavior | |
|---|---|
| Behavior description: | 窗口信息 |
| details: | {"text": "远程桌面连接", "class": "android.widget.TextView"} |
| {"text": "添加远程计算机", "class": "android.widget.TextView"} | |
| {"text": "添加远程计算机", "class": "android.widget.TextView"} | |
| Behavior description: | 添加View |
| details: | [u'com.android.internal.policy.impl.PhoneWindow$DecorView@415573a8', u'WM.LayoutParams{(0,0)(fillxfill) sim=#100 ty=1 fl=#1810100 pfl=0x8 wanim=0x103028f}', u'android.view.CompatibilityInfoHolder@414b8750'] |
| Behavior description: | 获取网络状态信息[*] |
| details: | [NetworkInfo: type: mobile[UMTS], state: DISCONNECTED/DISCONNECTED, reason: dataDisabled, extra: epc.tmobile.com, roaming: false, failover: false, isAvailable: true, NetworkInfo: type: wifi[], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: false, NetworkInfo: type: mobile_mms[UMTS], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: true, NetworkInfo: type: mobile_supl[UMTS], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: true, NetworkInfo: type: mobile_hipri[UMTS], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: true, NetworkInfo: type: mobile_fota[UMTS], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: true, NetworkInfo: type: mobile_ims[UMTS], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: true, NetworkInfo: type: mobile_cbs[UMTS], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: true, NetworkInfo: type: wifi_p2p[], state: UNKNOWN/IDLE, reason: (unspecified), extra: (none), roaming: false, failover: false, isAvailable: false] |
| Behavior description: | 执行SQL查询 |
| details: | [u'SELECT * FROM pcInfo where loginAccount = ? order by date desc', u'[administrator]'] |
| Activities | |
|---|---|
| Activity name | Types of |
| com.lanyou.ui.Activity_Main | android.intent.action.MAIN |
| com.lanyou.ui.Activity_Main | android.intent.category.LAUNCHER |
| Dangerous function | |
|---|---|
| Function name | information |
| getRuntime | 获取命令行环境 |
| java/lang/Runtime;->exec | 执行字符串命令 |
| ContentResolver;->query | 读取联系人、短信等数据库 |
| TelephonyManager;->getDeviceId | 搜集用户手机IMEI码、电话号码、系统版本号等信息 |
| Permission list | |
|---|---|
| License name | information |
| android.permission.READ_SMS | 读取短信 |
| android.permission.GET_TASKS | 获取有关当前或最近运行的任务信息 |
| android.permission.ACCESS_COARSE_LOCATION | 获取粗略的位置（通过wifi、基站） |
| android.permission.WRITE_EXTERNAL_STORAGE | 写外部存储器（如：SD卡） |
| android.permission.INTERNET | 连接网络（2G或3G） |
| android.permission.READ_PHONE_STATE | 读取电话状态 |
| android.permission.WRITE_SETTINGS | 读写系统设置项 |
| android.permission.ACCESS_WIFI_STATE | 读取wifi网络状态 |
| android.permission.MOUNT_UNMOUNT_FILESYSTEMS | 挂载、反挂载外部文件系统 |
| android.permission.READ_EXTERNAL_STORAGE | 读外部存储器（如：SD卡） |
| android.permission.ACCESS_NETWORK_STATE | 读取网络状态（2G或3G） |
| File List | |
|---|---|
| file name | Check code |
| assets/keymaps/ar | 0x41752737 |
| assets/keymaps/da | 0xe63951bb |
| assets/keymaps/de | 0xb2884a4b |
| assets/keymaps/en-gb | 0x18405358 |
| assets/keymaps/en-us | 0x397bb0fc |
| assets/keymaps/es | 0x40761dfd |
| assets/keymaps/fi | 0x6e5412d0 |
| assets/keymaps/fr | 0x7674046e |
| assets/keymaps/fr-be | 0xa08f662b |
| assets/keymaps/hr | 0x1fe342d5 |
| assets/keymaps/it | 0xb43da4e2 |
| assets/keymaps/ja | 0xf75f2b31 |
| assets/keymaps/lt | 0x6afa0967 |
| assets/keymaps/lv | 0xcf497cca |
| assets/keymaps/mk | 0x49c2e186 |
| assets/keymaps/no | 0x3c381f28 |
| assets/keymaps/pl | 0x1bfd426f |
| assets/keymaps/pt | 0x53ecc7b3 |
| assets/keymaps/pt-br | 0xf68d1bdc |
| assets/keymaps/ru | 0x8e3fed3f |
| assets/keymaps/sl | 0x4a2e1b88 |
| assets/keymaps/sv | 0x1013f2d2 |
| assets/keymaps/tk | 0xef3b3d69 |
| assets/keymaps/tr | 0xb53a26bf |
| assets/w | 0x5e381ce8 |
| res/drawable/bg_linux_btn.xml | 0x3a896002 |
| res/drawable/bg_lv.xml | 0xe95e651 |
| res/drawable/bg_on.xml | 0xa5162174 |
| res/drawable/bg_radio_bt.xml | 0xf09fdaaf |
| res/drawable/bg_tab_radio_off.xml | 0xdf84997c |
| res/drawable/bg_tab_radio_on.xml | 0x42de2a42 |
| res/drawable/bg_text_colo.xml | 0xd69df3b8 |
| res/drawable/bg_tm.xml | 0x14015bc2 |
| res/drawable/btn_login.xml | 0x8614f7df |
| res/drawable/btn_white.xml | 0x340d5441 |
| res/drawable/rb_btn_selector.xml | 0xdfca3b0a |
| res/layout/activity_adddevice.xml | 0x3a9f5a |
| res/layout/activity_iphelp.xml | 0xbd744b57 |
| res/layout/activity_linux.xml | 0x39d40344 |
| res/layout/activity_main.xml | 0x459d9bf5 |
| res/layout/activity_pcnamehelp.xml | 0x6ac34c03 |
| res/layout/activity_pcsetting.xml | 0x77771efc |
| res/layout/fragment_win7.xml | 0xf4e56834 |
| res/layout/fragment_winxp.xml | 0x1047686f |
| res/layout/item_linux.xml | 0x397ab94c |
| res/layout/item_pc.xml | 0x4ff72d9f |
| res/layout/lv_foot_et.xml | 0xdb92f458 |
| res/layout/myprogressdialog.xml | 0xe9e4b5b2 |
| res/menu/device_list.xml | 0xd55c6bf7 |
| AndroidManifest.xml | 0x1015cea6 |
| resources.arsc | 0xdbd5ce7d |
| res/drawable-hdpi/add_bg.9.png | 0x222229c6 |
| res/drawable-hdpi/add_icon.png | 0x803401e1 |
| res/drawable-hdpi/back.png | 0x270c8778 |
| res/drawable-hdpi/del.png | 0xe3541440 |
| res/drawable-hdpi/help_pcname.jpg | 0x8ca2449 |
| res/drawable-hdpi/ic_down.png | 0x84bcd3a6 |
| res/drawable-hdpi/ic_help.png | 0xedbb04f2 |
| res/drawable-hdpi/ic_linux.png | 0xad457c87 |
| res/drawable-hdpi/ic_send.png | 0xf81c7036 |
| res/drawable-hdpi/ic_session.png | 0xf1a9e4ff |
| res/drawable-hdpi/ic_up.png | 0xfc10eb82 |
| res/drawable-hdpi/ic_windows.png | 0x4d31f9d0 |
| res/drawable-hdpi/icon.png | 0x7f0d8e1f |
| res/drawable-hdpi/iphelp_1.jpg | 0x979b125a |
| res/drawable-hdpi/iphelp_2.jpg | 0xd2de162 |
| res/drawable-hdpi/iphelp_3.jpg | 0x5589917e |
| res/drawable-hdpi/iphelp_4.jpg | 0x29be2624 |
| res/drawable-hdpi/iphelp_5.jpg | 0x5d11376b |
| res/drawable-hdpi/iphelp_6.jpg | 0x4fafc8af |
| res/drawable-hdpi/item_bg.9.png | 0xb0573edf |
| res/drawable-hdpi/mouse.png | 0x3f397d41 |
| res/drawable-hdpi/offline.png | 0x1d20b6e7 |
| res/drawable-hdpi/online.png | 0x3d57736 |
| res/drawable-hdpi/search_btn.png | 0xffd1591d |
| res/drawable-hdpi/setting_list_bg.9.png | 0xfc9c9b07 |
| res/drawable-hdpi/setting_list_bg_blue.9.png | 0xbefa180f |
| res/drawable-hdpi/tltle_bg.9.png | 0xfb6a594c |
| res/drawable-hdpi/update.png | 0x2ac03b10 |
| res/drawable-hdpi/xila.png | 0xbdef353c |
| res/drawable-hdpi/xp_yindao.jpg | 0x7df0e8c3 |
| res/drawable-xhdpi/ic_launcher.png | 0xa227fc8a |
| res/drawable-xhdpi/icon.png | 0x15588d28 |
| res/drawable-xxhdpi/ic_launcher.png | 0x2a4a99d1 |
| classes.dex | 0x90ed9bcc |
| gnu/getopt/buildx.xml | 0xb76bea6d |
| gnu/getopt/ChangeLog | 0xb62d10a7 |
| gnu/getopt/COPYING.LIB | 0x62d26742 |
| gnu/getopt/gnu.getopt.Getopt.html | 0xd8318782 |
| gnu/getopt/gnu.getopt.LongOpt.html | 0x612f5915 |
| gnu/getopt/LANGUAGES | 0xc58f86e9 |
| gnu/getopt/Makefile | 0x9ef60aba |
| gnu/getopt/MessagesBundle.properties | 0x5671b764 |
| gnu/getopt/MessagesBundle_chs.properties | 0x77203bb8 |
| gnu/getopt/MessagesBundle_cht.properties | 0x954afd61 |
| gnu/getopt/MessagesBundle_cs.properties | 0xfa4e03e5 |
| gnu/getopt/MessagesBundle_de.properties | 0x3a9c1fde |
| gnu/getopt/MessagesBundle_es.properties | 0x9e1b6909 |
| gnu/getopt/MessagesBundle_fr.properties | 0x3fa4d13c |
| gnu/getopt/MessagesBundle_hu.properties | 0x6ce1cf3d |
| gnu/getopt/MessagesBundle_it.properties | 0xa19a5340 |
| gnu/getopt/MessagesBundle_ja.properties | 0x6b2de805 |
| gnu/getopt/MessagesBundle_nl.properties | 0x3de2e8b9 |
| gnu/getopt/MessagesBundle_no.properties | 0x9b1d339a |
| gnu/getopt/MessagesBundle_pl.properties | 0x1bb26b27 |
| gnu/getopt/MessagesBundle_ro.properties | 0x92790c81 |
| gnu/getopt/README | 0x98d49162 |
| META-INF/MANIFEST.MF | 0xba3be92d |
| META-INF/CERT.SF | 0xd8a75325 |
| META-INF/CERT.RSA | 0xae80c9b9 |
| Run screenshot |
|---|
 |
HOME
