Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- r####.####.cn
- s####.####.com
- d####.####.cn
- u####.com
- d####.####.com
HTTP GET requests:
- d####.####.com/exp/w=500/sign=1795ae9a103853438ccf8721a312b01f/8435e5dde...
- d####.####.com/exp/pic/item/9345d688d43f87945805aef5d31b0ef41ad53a77.jpg
- d####.####.com/exp/pic/item/a1ec08fa513d26970729ee8654fbb2fb4216d877.jpg
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- d####.####.com/exp/pic/item/0e2442a7d933c895c7b47ea0d01373f083020026.jpg
- d####.####.com/exp/w=500/sign=fb6839fb269759ee4a5060cb82fa434e/14ce36d3d...
- d####.####.com/exp/pic/item/5d6034a85edf8db101e49abf0823dd54574e7427.jpg
- d####.####.com/exp/pic/item/2fdda3cc7cd98d10a71eeaea203fb80e7aec9027.jpg
- d####.####.com/exp/pic/item/4034970a304e251f763d0223a686c9177e3e5327.jpg
- d####.####.com/exp/pic/item/9a504fc2d5628535561a34fa91ef76c6a6ef6377.jpg
- d####.####.com/exp/pic/item/3b87e950352ac65c9ccf80a8faf2b21192138a27.jpg
- d####.####.com/exp/pic/item/79f0f736afc379312f9d60f2eac4b74542a91177.jpg
- d####.####.com/exp/w=500/sign=a799405159ee3d6d22c687cb73176d41/37d3d539b...
- d####.####.com/exp/pic/item/bd315c6034a85edf444718f848540923dc547526.jpg
HTTP POST requests:
- u####.com/app_logs
- s####.####.com/cw/cp.action?requestId=####&g=####
- r####.####.cn/a/
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/SYSTEM_SETTING.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/SYSTEM_SETTING.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/domob_config.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_0
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/files/mobclick_agent_cached_<Package>
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
