Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- h####.####.com
- i####.####.com
- d####.####.cn
- o####.####.com
- m####.####.com
- f####.####.cn
- a####.####.com
HTTP GET requests:
- a####.####.com/Website/contents/comments?platform=####&appid=####&docid=...
- i####.####.com/image.php?url=####
- a####.####.com/Website/ads/upload-appx-log?template=####&platform=####&e...
- a####.####.com/Website/contents/content?bottom_comments=####&platform=##...
- i####.####.com/avatar/h3rd/group2/M08/AE/9B/CmcRJ1hE21mAbryPAAAWk0mrYV43...
- i####.####.com/media/34bd975921e4d1083c07eca4a93e49db.jpg
- a####.####.com/Website/config/abtest?platform=####&appid=####&cv=####&ty...
- f####.####.cn/userImg/080/522/051/150225080.jpg?2017042####
- m####.####.com/cfg/appkey-b1df5f8e490a62cc
- i####.####.com/a/thead_neza.png
- f####.####.cn/userImg/846/371/962/269173648.jpg
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- i####.####.com/avatar/h3rd/group2/M04/47/AF/CmcRJlilUPaAFqWtAAAWk0mrYV44...
- i####.####.com/media/e6d94062626347dc770afab31f034320.jpg
- i####.####.com/image.php?type=####&url=####&net=####
- a####.####.com/Website/push/get-push?platform=####&appid=####&cv=####&co...
- i####.####.com/image.php?url=####&type=####&net=####
- a####.####.com/Website/push/binding-token-for-android?platform=####&time...
- a####.####.com/Website/proxy/open-app-log?fid=####&platform=####&sid=###...
- i####.####.com/a/thead_bajie.png
- a####.####.com/Website/user/get-info?platform=####&appid=####&cv=####&ve...
- i####.####.com/media/594bdc06076fffeacfa1010816604c37.jpg
- a####.####.com/Website/user/login-as-guest?platform=####&username=####&t...
HTTP POST requests:
- o####.####.com/v2/check_config_update
- a####.####.com/Website/proxy/real-time-log?platform=####&appid=####&cv=#...
- a####.####.com/Website/channel/news-list-for-channel?platform=####&infin...
- o####.####.com/v2/get_update_time
- m####.####.com/rec/se?_iwt_t=####&sv=####
- s####.####.com/cw/cp.action?requestId=####&g=####
- a####.####.com/Website/channel/best-news?platform=####&infinite=####&cst...
- h####.####.com/android/
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.com/app_logs
- a####.####.com/Website/contents/recommend-ads?platform=####&appid=####&d...
Modified file system:
Creates the following files:
- <Package Folder>/files/mobclick_agent_cached_<Package>45
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/databases/city.db
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/MATSharedPreferences.xml
- <Package Folder>/shared_prefs/hipu_account.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/files/userData
- <Package Folder>/files/report.log-1495005848452
- <Package Folder>/shared_prefs/hipu.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/key_ftue_file.xml.bak
- <Package Folder>/files/report.log-1495005877249
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/report.log-1495005906620
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/databases/hipu.db-journal
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/shared_prefs/mipush_extra.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/shared_prefs/MATSharedPreferences.xml.bak
- <Package Folder>/files/users/557552370/13566000210
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/_ire-journal
- <Package Folder>/files/users/557552370/13566000178
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/shared_prefs/settings.xml.bak
- <Package Folder>/databases/city.db-journal
- <Package Folder>/shared_prefs/guest_name.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/files/shuzilm.db
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/mipush_extra.xml.bak
- <Package Folder>/shared_prefs/hipu.xml
- <Package Folder>/shared_prefs/channel_search_hint.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/shared_prefs/cookie.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/mipush.xml
- <Package Folder>/shared_prefs/mipush.xml.bak
- <Package Folder>/files/report.log-1495005847594
- <Package Folder>/files/report.log-1495005847595
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/bestNewsList
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/users/557552370/13566000162
- <Package Folder>/shared_prefs/<Package>_prefs.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/key_ftue_file.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- netstat
- ls /dev/socket
- sh -c cat /proc/cpuinfo
- <error:2>
- logcat -v time -r1024 -n5 -f /storage/emulated/0/.lrst/logs/log.txt *:D
- sh -c cat /proc/net/arp
- <dexopt>
Contains functionality to send SMS messages automatically.
