Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Prompts to install third-party applications.
Network activity:
Connecting to:
- s####.####.com
- h5####.####.com
- i####.####.net
- d####.####.cn
- 7x####.####.com
- a####.####.net
- p####.####.com
- s####.####.cn
- apps####.####.com
- i####.####.cn
- c####.####.cn
- a####.####.com
HTTP GET requests:
- i####.####.net/userfiles/images/2017-04-18/8241d6c411dd42a8910df993b6108...
- i####.####.net/upfiles/image/20170518/20170518154051_9215.jpg
- s####.####.cn/ma_icon/0/icon_42318014_1469610894/96
- i####.####.net/userfiles/images/2017-05-03/6862ca21d6684514883ffbdc72905...
- s####.####.cn/ma_icon/0/icon_42287337_1492694545/96
- i####.####.net/userfiles/images/class/2015-05-12/58d0bb356e08427aae30d2e...
- i####.####.net/userfiles/images/2016-12-09/2e90320703ac40e48ab2e7742605e...
- i####.####.net/Uploads/image/20150421/20150421152108_8756.png
- s####.####.cn/ma_icon/0/icon_42268939_1484906569/96
- i####.####.net/userfiles/images/class/2015-05-12/162223a735d54a4388f38b4...
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- i####.####.net/userfiles/images/2015-02-27/f0e60c42-c722-4915-a480-99164...
- i####.####.net/upfiles/image/20170330/20170330140942_2600.png
- i####.####.net/upfiles/image/20170511/20170511180030_6871.jpg
- s####.####.cn/ma_icon/0/icon_42350811_1494918269/96
- i####.####.net/userfiles/images/class/2015-05-12/8e83d3329edd47279358373...
- i####.####.net/userfiles/images/class/2015-05-12/71a32f03d4bb4cce8b15392...
- i####.####.net/userfiles/images/class/2015-05-12/535298e8653440d091ed7fb...
- i####.####.net/userfiles/images/class/2015-05-12/0de428904ed144538490c8d...
- i####.####.net/userfiles/images/class/2015-05-12/4db87e9aace846cc91d5127...
- i####.####.net/Uploads/image/20150421/20150421152056_0784.png
- i####.####.net/userfiles/images/2016-10-21/884f5a0e5b134015b64b13201567f...
- i####.####.net/userfiles/images/2015-12-15/d3d095d0f69547c6a9fb11ff907e8...
- p####.####.com/ma_pic2/0/shot_42287337_2_1492694543/0
- p####.####.com/ma_pic2/0/shot_42287337_4_1492694543/0
- i####.####.net/userfiles/images/2017-05-03/794d1130a82b4c8982e02c450d3d1...
- i####.####.net/upfiles/image/20170330/20170330141005_3948.png
- i####.####.net/userfiles/images/class/2015-05-12/ca4b4fd8ea49406b98b1bbe...
- i####.####.cn/2014/6/18/9766895.jpg
- i####.####.net/userfiles/images/class/2015-05-12/22bdb6f003c246fbb5399d3...
- p####.####.com/ma_pic2/0/shot_42287337_1_1492694543/0
- i####.####.net/Uploads/image/20150421/20150421152113_4539.png
- i####.####.net/upfiles/image/20170520/20170520085624_1771.jpg
- i####.####.net/userfiles/images/2016-09-20/28a3d09e47414023a76ecd1a095f6...
- i####.####.net/userfiles/images/class/2015-05-12/eb524ed41c194130b168a0b...
- i####.####.net/upfiles/image/20170330/20170330140914_0551.png
- i####.####.net/userfiles/images/2017-05-03/46688eb03d00442db53ec1ea937b2...
- i####.####.net/userfiles/images/class/2015-05-12/9bed4b6208884c3fb3ee4ba...
- i####.####.net/Uploads/image/20150421/20150421152102_7505.png
- i####.####.net/userfiles/images/2017-04-27/0428ae6c829b421ab12a955bf25f3...
- i####.####.net/userfiles/images/class/2015-05-12/cba1d55598424aeaac3018b...
- i####.####.net/userfiles/images/2016-12-09/d616e5535e864a53bfa8d66d061ed...
- i####.####.net/userfiles/images/class/2015-05-12/1c1d4469893c4d619e0d634...
- s####.####.cn/ma_icon/0/icon_42288264_1484873292/96
- i####.####.net/upfiles/image/20170417/20170417094051_6945.png
- s####.####.cn/ma_icon/0/icon_12209367_1450252143/96
- i####.####.net/userfiles/images/2017-05-03/0e01021ddd974a8788bf2076f7b83...
- i####.####.net/userfiles/images/class/2015-05-12/5c136c3ed763411a9a6c051...
- i####.####.net/userfiles/images/2017-05-04/a199f44805664dc5a3c2135b995e5...
- i####.####.net/userfiles/images/class/2015-05-12/f52b8a1c4488419693c90b9...
- i####.####.net/Uploads/image/20150421/20150421152131_0637.png
- i####.####.net/upfiles/image/20170515/20170515095238_3985.jpg
- s####.####.cn/ma_icon/0/icon_42287236_1467953454/96
- i####.####.net/userfiles/images/2017-05-02/b9aec80937d8470c9e6b40beb37b5...
- i####.####.net/userfiles/images/class/2015-05-12/71a191a6fad64592bbd06e0...
- i####.####.net/userfiles/images/class/2015-05-12/170676b39cf2448a9889751...
- i####.####.net/userfiles/images/2017-05-03/c57b0cd649204456878bbe2fd80fa...
- i####.####.net/userfiles/images/2016-06-30/e997483a676345c4b8b9a075487b9...
- s####.####.cn/ma_icon/0/icon_42391449_1480988645/96
- i####.####.net/userfiles/images/2017-05-03/d5f19f9d6abc4f14bf9a93b245a87...
- i####.####.net/upfiles/image/20170330/20170330140834_8991.png
- s####.####.cn/ma_icon/0/icon_42302559_1482138134/96
- i####.####.net/userfiles/images/2017-04-12/2f1a0a5c06d9461288fe4a7032a3b...
- p####.####.com/ma_pic2/0/shot_42287337_3_1492694543/0
- i####.####.net/Uploads/image/20150421/20150421152141_1732.png
- i####.####.net/userfiles/images/class/2015-05-12/45846cb2b5a0416ea8557b3...
- i####.####.net/upfiles/image/20170330/20170330193555_6456.png
- i####.####.net/userfiles/images/class/2015-05-12/ff2203a9b27c4f54ae23b23...
- s####.####.cn/ma_icon/0/icon_12225770_1450933109/96
- i####.####.net/userfiles/images/2016-12-09/bffc9e19858246788d1be034d24f1...
- i####.####.net/upfiles/image/20170519/20170519102634_5308.jpg
- i####.####.net/userfiles/images/2017-04-17/3c058e66fbc2453da02d6b54d93ad...
- i####.####.net/userfiles/images/2016-02-26/01c1bcb44b204f34942391eb4c6f1...
- i####.####.net/userfiles/images/2017-05-12/065415970303497e84ba22cfa6f74...
- i####.####.net/userfiles/images/class/2015-05-12/e6795b2616cc49769b77b6d...
- i####.####.net/userfiles/images/class/2015-05-12/6c25c6ebde15461f8387155...
- i####.####.net/userfiles/images/2015-02-28/255c2cbc44504b41a8864135f229d...
- i####.####.net/userfiles/images/class/2015-05-12/3ae21a9ed217470680095bf...
- i####.####.net/userfiles/images/2016-12-09/f03198854f104392bb2cb1640e825...
- 7x####.####.com/o_1b95melld9tv1qud1e9dd011s2d860.jpg
- i####.####.net/userfiles/images/2015-11-24/0e09cf0840ce4610bd6ee2d212a92...
- i####.####.net/Uploads/image/20150421/20150421152118_1259.png
- i####.####.net/upfiles/image/20170330/20170330193540_4980.png
- i####.####.net/userfiles/images/2016-06-24/600e34e99fa64d019bd6d25992d2e...
- i####.####.net/userfiles/images/class/2015-05-12/6ae3ff49405f439e87fa390...
- c####.####.cn/timg?v####&size=####&quality=####&imgtype=####&e####&sec=#...
- a####.####.net/files//2017-05-15/ffc1a197d3854095ba0bac42d67f9175.apk
- i####.####.net/userfiles/images/class/2015-05-12/319225e649c744cc818c8da...
- s####.####.cn/ma_icon/0/icon_7267_1494633796/96
- h5####.####.com/ThridApp/GetAppDetailGroup?imei=####&sourcePackTupleGrou...
- i####.####.cn/2016/6/30/13663716.png
- i####.####.net/userfiles/images/2016-12-09/e7db4006f3434160a98dbdf64afbc...
- i####.####.net/upfiles/image/20170508/20170508093759_1629.jpg
- i####.####.net/userfiles/images/class/2015-05-12/412a49f0723941b6a61df1d...
- i####.####.net/Uploads/image/20150421/20150421152123_0634.png
- h5####.####.com/900market/ad/line/ad.html?specUrl=####&imgUrl=####
- i####.####.net/userfiles/images/class/2015-05-12/6d0656bb87f34171a6afb60...
- i####.####.net/userfiles/images/2017-04-11/cb44507965334a6e83515ba7e3cda...
- i####.####.net/Uploads/image/20150421/20150421152136_3450.png
- s####.####.cn/ma_icon/0/icon_42333028_1478397311/96
- i####.####.net/userfiles/images/class/2015-05-12/be5e9d68226941f1948c336...
HTTP POST requests:
- h5####.####.com/Stat/WapStatistics
- apps####.####.com/AppMarket/GetApkUpgradeList
- apps####.####.com/AppMarket/GetClassNameList
- apps####.####.com/AppMarket/GetClassApkList?classCode=####&currPage=####...
- apps####.####.com/Package/GetCommentsList?currPage=####&pageSize=####&pa...
- apps####.####.com/appmarket/GetTopHitSearchList?currPage=####&pageSize=#...
- apps####.####.com/Report/ActiveStat
- apps####.####.com/AppMarket/GetHomeBottomList
- apps####.####.com/Report/GetVerUp?packName=####&verCode=####
- apps####.####.com/appmarket/GetBootPage
- s####.####.com/cw/cp.action?requestId=####&g=####
- apps####.####.com/Package/ApkDetails?source=####&package=####&coid=####&...
- a####.####.com/app_logs
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- apps####.####.com/Push/GetPushApp
- apps####.####.com/AppMarket/GetApkDetails?source=####&package=####&coid=...
- apps####.####.com/Package/SearchApkList?currPage=####&pageSize=####&keyw...
- apps####.####.com/AppMarket/GetHomeTopList
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preference.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/databases/xUtils.db-journal
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/files/mobclick_agent_cached_<Package>23029
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- getprop
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <dexopt>
- /system/bin/sh -c type su
Contains functionality to send SMS messages automatically.
