Technical information
Malicious functions:
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- h####.####.com
- i####.####.com
- 7j####.####.com
- c-h####.####.com
- d####.####.com
- a####.####.cn
- dce####.####.com
- a####.####.com
HTTP GET requests:
- s####.####.com/config/hz-hzv3.conf
- dce####.####.com/api/clients/releases/latest
- dce####.####.com/api/popup
- dce####.####.com/api/index?pagesize=####&page=####
- i####.####.com/uploads/icons/d/3/d39e2967828d238b508019b7bcfd345b.png
- i####.####.com/uploads/icons/c/7/c770a7c530b302068a6714dcdb41dc35.png
- dce####.####.com/api/cats
- i####.####.com/uploads/icons/7/3/73f37877ebb4f98a028fb2026d9bf94b.png
- dce####.####.com/api/start
- i####.####.com/launch/5/e/5e9311333f7e80b5174ae8ea91e8651a.jpg
- 7j####.####.com/tdata_Hhd935
- i####.####.com/gcenter.json
- dce####.####.com/api/feedbacks
- 7j####.####.com/tdata_Oxl942
- dce####.####.com/api/ranking?type=####&page=####
- a####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- i####.####.com/uploads/icons/c/1/c1f575973047a7c529e7f88638059b49.png
HTTP POST requests:
- a####.####.cn/cw/cp.action?requestId=####&g=####
- dce####.####.com/api/games/manage
- a####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- h####.####.com/app.gif
- s####.####.com/api.php?format=####&t=####
- d####.####.com/api/sdk/reportactive?cuid=####&svr=####&ovr=####&device=####&app_id=####&channel_id=####&sdk=####
- a####.####.com/app_logs
- d####.####.com/api/sdk/activate?cuid=####&svr=####&ovr=####&device=####&app_id=####&channel_id=####&sdk=####
- c-h####.####.com/api.php?format=####&t=####
- dce####.####.com/
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/TrineaAndroidCommon.xml
- /sdcard/backups/system/.confd
- /data/data/####/files/push.pid
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/TrineaAndroidCommon.xml.bak
- /data/data/####/files/libcuid.so
- /data/data/####/databases/pushsdk.db-journal
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/databases/wakeup_silence_user.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Android/data/####/cache/diskCache/cc7132ca43aeee82738d1e410f9e8156.0
- /data/data/####/databases/favorite-journal
- /sdcard/Download/fts/4.3_hyjwan.jar
- /data/data/####/cache/image_manager_disk_cache/5120e8e6930b1a70ed6f34257f088f913c0ee20e41fd055ac2b47b607822043d.0.tmp
- /data/data/####/files/tdata_Oxl942
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/cache/image_manager_disk_cache/319df768c60f6214877913b86456bd26612bd3779b98a676d687d17f0c8d2069.0.tmp
- /sdcard/Android/data/####/cache/diskCache/journal.tmp
- /data/data/####/databases/Staistics
- /data/data/####/shared_prefs/tbs_download_config.xml.bak
- /sdcard/Android/data/####/cache/diskCache/journal
- /data/data/####/app_tbs/share/core_info
- /data/data/####/databases/pushext.db-journal
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/setting.xml.bak
- /data/data/####/shared_prefs/packverson.xml
- /sdcard/Android/data/.nomedia
- /sdcard/Android/data/####/cache/diskCache/97530b3690b83fef7e92d350d4ec43fe.0
- /sdcard/backups/system/.timestamp
- /data/data/####/databases/download.db
- /data/data/####/files/init.pid
- /data/data/####/shared_prefs/version.xml
- /data/data/####/files/__local_stat_cache.json
- /data/data/####/files/run.pid
- /sdcard/dt/restime.dat
- /data/data/####/files/tdata_Hhd935.jar
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/shared_prefs/versionUpdate.xml
- /data/data/####/cache/image_manager_disk_cache/ccc9d713502fe2cc20f5aa353210b94b0f6d344efeda685af8f82565ba84bad6.0.tmp
- /data/data/####/files/__local_last_session.json
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/databases/Staistics-journal
- /sdcard/backups/system/.confd-journal
- /data/data/####/shared_prefs/a.xml
- /data/data/####/databases/favorite
- /sdcard/backups/.SystemConfig/.cuid
- /data/data/####/databases/pushg.db-journal
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/databases/download.db-journal
- /data/data/####/shared_prefs/requisite.xml
- /data/data/####/files/__local_ap_info_cache.json
- /data/data/####/shared_prefs/loadingImg.xml
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/app_tbs/core_private/tbslock.txt
- /data/data/####/files/.imprint
- /data/data/####/cache/image_manager_disk_cache/journal.tmp
- /sdcard/libs/####.db
- /data/data/####/shared_prefs/configs.xml
- /data/data/####/shared_prefs/loadingImg.xml.bak
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/shared_prefs/st.xml
- /sdcard/libs/app.db
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- /sdcard/huanju/data/config.properties
- /sdcard/TiantianGame/cachePic/5ce3dd5ff3c894982824812a3ddd0de0
- /data/data/####/cache/image_manager_disk_cache/47e2671d2ea7adcedead4da4b39da6bad279266e540db0d0e10eeb790c47bb9b.0.tmp
- /sdcard/.xy
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/hj_datasdk_settings.xml.bak
- /data/data/####/shared_prefs/LTBL_Game.xml
- /data/data/####/files/__send_data_1485417831315
- /data/data/####/files/tdata_Hhd935
- /data/data/####/files/init_c.pid
- /data/data/####/databases/increment.db-journal
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/app_tbs/core_private/tbscoreinstall.txt
- /sdcard/system/tmp/local/tdata_Oxl942
- /data/data/####/files/tdata_Oxl942.jar
- /sdcard/system/tmp/local/tdata_Hhd935
- /data/data/####/databases/downloadswc
- /sdcard/huanju/.cuid
- /data/data/####/shared_prefs/hj_datasdk_settings.xml
- /data/data/####/files/gdaemon_20161017
- /data/data/####/shared_prefs/tbs_download_config.xml
Sets the 'executable' attribute to the following files:
- /data/data/####/files/gdaemon_20161017
Miscellaneous:
Executes next shell scripts:
- chmod 700 /data/data/####/files/gdaemon_20161017
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24914 300 0
Contains functionality to send SMS messages automatically.
