Technical information
Malicious functions:
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- c####.####.com
- a####.####.cn
- uf####.####.com
- b####.####.cn
- m####.####.com
- a####.####.com
HTTP GET requests:
- a####.####.cn/jarFile/SDKAutoUpdate/giantt.jar
HTTP POST requests:
- c####.####.com/batsdk/api_int/newsync2
- uf####.####.com/?m=####&a=####
- m####.####.com/api?action=####&from=####&token=####&type=####&index=####
- b####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.com/app_logs
- b####.####.cn/cw/cp.action?requestId=####&g=####
- m####.####.com/api?from=####&token=####&type=####&index=####
Modified file system:
Creates the following files:
- /data/data/####/files/proguard
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- /data/data/####/shared_prefs/batsdk_user_info.xml
- /sdcard/.userReturn
- /sdcard/backups/system/.timestamp
- /data/data/####/shared_prefs/re_po_rt.xml
- /data/data/####/databases/z-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/leroadcfg.xml
- /data/data/####/databases/smart_priv.db
- /data/data/####/databases/bw.db
- /data/data/####/databases/app_launch_cache.db-journal
- /data/data/####/databases/perm.db-journal
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/d.xml
- /data/data/####/shared_prefs/ye_db_configs.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/__local_stat_cache.json
- /data/data/####/files/__local_ap_info_cache.json
- /data/data/####/files/zyi/loadr9
- /data/data/####/files/smartpriv-679428383.out
- /data/data/####/files/bp10
- /data/data/####/files/su
- /data/data/####/databases/bw.db-journal
- /data/data/####/databases/downloadswc
- /sdcard/backups/system/.confd
- /data/data/####/files/libcuid.so
- /data/data/####/databases/download_table-journal
- /data/data/####/cache/install-recovery.sh
- /sdcard/Download/hou/4.5_giantt.jar.tmp
- /data/data/####/files/zyi/sptool
- /data/data/####/files/smartpriv-912724023.out
- /data/data/####/files/chattr
- /data/data/####/files/zyi/libr9-56ab088r9.ad.so
- /sdcard/dt/restime.dat
- /data/data/####/databases/download_table
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/files/insdog
- /data/data/####/shared_prefs/re_po_rt.xml.bak
- /data/data/####/cache/chattr
- /data/data/####/shared_prefs/rt.xml.bak
- /data/data/####/databases/sk-journal
- /data/data/####/shared_prefs/i.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/smartpriv-97624417.out
- /data/data/####/shared_prefs/app-update-prefs.xml
- /data/data/####/files/authrate.dat
- /data/data/####/shared_prefs/utils.xml
- /sdcard/AndroidOptimizer/space/.trash_common_path_data
- /data/data/####/files/smartpriv-1662236432.out
- /data/data/####/shared_prefs/superrootcfg.xml
- /data/data/####/databases/i-journal
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/databases/jp.db
- /data/data/####/shared_prefs/superrootcfg.xml.bak
- /data/data/####/databases/d
- /data/data/####/files/permdata.dat
- /data/data/####/files/__send_data_1485418028758
- /data/data/####/databases/i
- /data/data/####/databases/ye_largedirs.db
- /data/data/####/shared_prefs/leroadcfg.xml.bak
- /data/data/####/files/bp-4.0-arm.src
- /data/data/####/databases/z
- /data/data/####/shared_prefs/rt.xml
- /data/data/####/files/.tmp/flg
- /data/data/####/databases/smart_priv.db-journal
- /data/data/####/databases/jp.db-journal
- /data/data/####/files/zyi/libr9um.so
- /data/data/####/shared_prefs/st.xml
- /data/data/####/cache/su
- /data/data/####/files/__local_last_session.json
- /data/data/####/shared_prefs/batsdk_crash_switch.xml
- /data/data/####/databases/d.db-journal
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/h.xml
- /data/data/####/databases/ye_app_trash.db-journal
- /data/data/####/databases/sk
- /data/data/####/files/zyi/r9-295a441r9.ad.odex
- /sdcard/backups/system/.confd-journal
- /data/data/####/shared_prefs/a.xml
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/shared_prefs/DianxinDXB.xml
- /data/data/####/shared_prefs/batsdk_app_life.xml
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/databases/d-journal
- /data/data/####/databases/ye_app_trash.db
- /data/data/####/shared_prefs/ye_trash.xml
- /data/data/####/files/smartpriv-917804670.out
- /data/data/####/shared_prefs/config_update.xml
- /data/data/####/files/smartpriv-1460551592.out
- /sdcard/backups/.SystemConfig/.cuid
- /data/data/####/shared_prefs/config_update.xml.bak
- /data/data/####/files/zyi/r9-295a441r9.ad.jar
Sets the 'executable' attribute to the following files:
- /data/data/####/cache/chattr
- /data/data/####/files/proguard
- /data/data/####/files/chattr
- /data/data/####/files/bp10
- /data/data/####/files/su
- /data/data/####/files/insdog
Miscellaneous:
Executes next shell scripts:
- ps
- /system/xbin/su
- su
- /system/bin/su
- su -v
- /system/xbin/su -v
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
