Android.Xiny.5647

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.207
Android.Xiny.221.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) h####.xiey####.com:8090
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(TLS/1.0) 1####.217.168.238:443
TCP(TLS/1.0) 1####.217.168.202:443
TCP(TLS/1.0) co####.uca.c####.####.com:443
TCP(TLS/1.0) 1####.217.168.234:443
TCP(TLS/1.0) thind-p####.d####.ie.####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) st-onli####.v####.com.####.com:443
TCP(TLS/1.2) 1####.217.168.234:443
TCP(TLS/1.2) 1####.250.179.163:443
TCP(TLS/1.2) 1####.217.168.202:443
TCP(TLS/1.2) 1####.217.168.238:443
UDP 1####.217.168.202:443

DNS requests:

a.peiz####.cn
and####.b####.qq.com
api.uca.c####.####.com
b.yunj####.cn
cdp.c####.uni####.com
co####.uca.c####.####.com
h####.xiey####.com
m####.go####.com
md####.google####.com
st-onli####.v####.com.cn

HTTP GET requests:

h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/AppInfo.html
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Data.lib
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Notice.html
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/Res
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/model/agr...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/model/ill...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/model/pri...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/mainui
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/part/b...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/sprite...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/startui
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/window...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/versionMd...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/l.bytes

HTTP HEAD requests:

h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/Res
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/model/agr...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/model/ill...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/model/pri...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/mainui
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/part/b...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/sprite...
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/startui
h####.xiey####.com:8090/GameRes/Android/1.51/OtherHardcore/Res/ui/window...

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####

File system changes:

Creates the following files:

/data/data/####/.hptc.cache_etImmortal.vivo
/data/data/####/1004
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/bugly_db_-journal
/data/data/####/classes.dex
/data/data/####/classes.dex.flock (deleted)
/data/data/####/classes.jar
/data/data/####/com.flashcat.PocketImmortal.vivo.v2.playerprefs.xml
/data/data/####/com.flashcat.PocketImmortal.vivo_preferences.xml
/data/data/####/com.flashcat.PocketImmortal.vivo_preferences.xml.bak
/data/data/####/crashrecord.xml
/data/data/####/kb_st_database.db
/data/data/####/kb_st_database.db-journal
/data/data/####/local_crash_lock
/data/data/####/metrics_guid
/data/data/####/mm_nw_app.xml
/data/data/####/mm_nw_app.xml.bak
/data/data/####/mmnwgame.dex
/data/data/####/mmnwgame.dex.flock (deleted)
/data/data/####/mmnwgame_data_s.xml
/data/data/####/mmnwgame_duration
/data/data/####/native_record_lock
/data/data/####/prefs_vivounionsdk.xml
/data/data/####/proc_auxv
/data/data/####/security_info
/data/data/####/trackevents.db-journal
/data/data/####/unionuserinfo.db-journal
/data/data/####/vivounionapk_v4.2.0.0_130e63a_201805051638_sign...ed.vua
/data/media/####/0037893650450fb40d045959c43ab90b
/data/media/####/004baddb98757f509c6c526c0835e4a5
/data/media/####/0161e9ead663ab2552670add2b781f83
/data/media/####/02100810239e7fd58c71aaa2e885b37d
/data/media/####/058390e6f702fa569cb0fa79bbeca447
/data/media/####/091d384ee883e41b03261c728a778283
/data/media/####/095fbb64a807dfeebcb7c4ceae56f20c
/data/media/####/0adda8396f99ff132f11900d74939b6f
/data/media/####/0b151c32e9c4921c561ca68eaf597d53
/data/media/####/0fd2be6a7d1a348e77d914088316ccad
/data/media/####/10adeb27da47082b280f0bbdd4d96361
/data/media/####/1B3A2967E5FD862EFD957606C65C8122
/data/media/####/1b269dd00f1343b608ebf58b9f88d5a7
/data/media/####/1b4fc585fd4de903411f9c031d38a14d
/data/media/####/1bdde91e933116034329f157a0e6508b
/data/media/####/1f0e20d0535d894d1bb561816bbe46a7
/data/media/####/1f58c8a8f4b66277468b507af21418fd
/data/media/####/236e3ea6e3755488ba87df24de9fe1de
/data/media/####/28446c1c7748614b05ebb39e83ce9f0b
/data/media/####/2d9a0309510e8506c83a269b2a63a073
/data/media/####/2f1614a8d7ca580747211d6d74f0cb59
/data/media/####/2f2fdfb6b8cea038fd1a3892619e7f5f
/data/media/####/30592A6B8B0C769E3F7FDE6E1A033DF5
/data/media/####/30f67e0490edb8d27ad5a156d25453ac
/data/media/####/32631f051ad9bda42039fd6a1bb7c464
/data/media/####/350482db1959bbee0ec19044f75c4a67
/data/media/####/3d33f3aab0b59b4f41d42a532f62e40f
/data/media/####/40c4327f3c29c27aaceb65865226bed7
/data/media/####/50142016cfddd1a495671524186c6917
/data/media/####/5b6cc262b0e869dc34abac85ceb9c034
/data/media/####/5e3065ee1c9ab50a0580c490a5ade0a6
/data/media/####/6200d1f3102441c472083cfb227ae409
/data/media/####/627f9513bc8cc99887211d3faf102052
/data/media/####/640d4633ca77ec850b0ebdef5ccab716
/data/media/####/646d01234f8e3ff26b46098d8989a99e
/data/media/####/651670254aac21207b4eeabbb164d4b0
/data/media/####/69becdfa9b9b580f15c8be8edf17fc2b
/data/media/####/6c924d480bfada720592bfc5dbeba00b
/data/media/####/7114a3f798fadc587087d39d0bc0735b
/data/media/####/7123853e181c5d22de22dfd53d97cc64
/data/media/####/742931ace7908b91da0fc7e6f2d2fd27
/data/media/####/778398ca268eec3f78c5e48a269172c7
/data/media/####/7a3510ce88b37929d46abe68178ad127
/data/media/####/7aac7db93b98aeb904a4e69c3ed8282d
/data/media/####/7bee9f088f92b6e7dba139165fad5e51
/data/media/####/84500d0549a71085c32790e06859a148
/data/media/####/84bf0097069d54acd413a68bee4e34e4
/data/media/####/851d49f877b02e9519b11904aba70651
/data/media/####/8a7e7a3e4a8ea0ea00ede6357a328503
/data/media/####/8bde51efaeb338c6e9e43f31207d8008
/data/media/####/8c78ecb3bb5f7ddff232847eb43b8ec8
/data/media/####/9549fe1cfcb94b164d164b2424901acd
/data/media/####/96f7b00dc9cf47aa072a5a341fbc5ce1
/data/media/####/9710824be224a6fd63fa073676386ceb
/data/media/####/985506bdcd1127969a59b976f031374e
/data/media/####/99c3aa449fcab22b25c214e4d6a28db7
/data/media/####/Res
/data/media/####/a2c55746ace0a12e1f5c07df70882968
/data/media/####/a438c20c44c6114fdfc18687922e9fde
/data/media/####/af92601cc8b7f4ffe4619a7eb0bec569
/data/media/####/agreement
/data/media/####/applog.txt
/data/media/####/b2f1eb8322687c0690dba1fed034cd22
/data/media/####/b42678fe1c9d667f18ad94b3c7c78145
/data/media/####/b530cd57ad1fe2d2b9efdacf1ccade13
/data/media/####/b66ac4dc629a820b2fce1494b6482778
/data/media/####/bcf041995019ab843f138137fe9c9a52
/data/media/####/beb1dfdb5282f0d0fa34c81527aafe1e
/data/media/####/body_15
/data/media/####/body_16
/data/media/####/body_17
/data/media/####/body_18
/data/media/####/body_19
/data/media/####/body_20
/data/media/####/c118fdf656ecaa1cb98a2143d8cc0a10
/data/media/####/c2c8283092620d1e921c1a1062cb51b2
/data/media/####/cb81c25973dceb18b483387c0fec3803
/data/media/####/cj_zmzbg
/data/media/####/commonatlas
/data/media/####/config
/data/media/####/d0a0f3bc330f6c9e388b4251769957f1
/data/media/####/d295e096ca1da4d9aaf3357762b8ebe7
/data/media/####/d4f139effc6b489c3cfce3dfa5c41b24
/data/media/####/d5a04eb4b8967a172656839a69667e54
/data/media/####/d72b6553f8c2ffb055c6a139b84d2a10
/data/media/####/d8052dc58d5c2a5906b71b6ab1f080ce
/data/media/####/daff6cd0c12ebfeddeb8d0a3464b7454
/data/media/####/e
/data/media/####/e141b554d7240af7bed8369115e2ea36
/data/media/####/e1861d1d2a2b01c57d2c9514a67301a5
/data/media/####/e3fdae9a25be703b263b05b3cc2a8c30
/data/media/####/e7dbf520d9a0c359b9f71ab9f06983d1
/data/media/####/e9dcc201f992e9ef51ebc7f866f8cee2
/data/media/####/ec5bc33c4316ebaa5349fe80b66ee5c6
/data/media/####/ecfa84ce983746ea9522a779cd246c4d
/data/media/####/f0ad79bac40b2128763dabfa51224eb8
/data/media/####/f5345cd159347b2118258bae400f58e2
/data/media/####/f68bd77958d7a1da23993087f5f3cf13
/data/media/####/f783ea980bf77b2a104c500d7470ed67
/data/media/####/fe8dfa270aec096f5099906e480932a5
/data/media/####/feb96eff7cfd433b30b059583690fc51
/data/media/####/g
/data/media/####/head_15b
/data/media/####/head_16b
/data/media/####/head_17b
/data/media/####/head_18b
/data/media/####/head_19b
/data/media/####/head_20b
/data/media/####/headiconatlas
/data/media/####/illegaltext
/data/media/####/l
/data/media/####/mainui
/data/media/####/mmnwgame.jaru
/data/media/####/npc_019
/data/media/####/npc_040
/data/media/####/npc_061
/data/media/####/npc_150
/data/media/####/npc_155
/data/media/####/npc_157
/data/media/####/npc_158
/data/media/####/npc_159
/data/media/####/npc_160
/data/media/####/npc_161
/data/media/####/npc_162
/data/media/####/npc_163
/data/media/####/npc_164
/data/media/####/npc_165
/data/media/####/npc_166
/data/media/####/npc_167
/data/media/####/npc_168
/data/media/####/npc_169
/data/media/####/npc_170
/data/media/####/npc_171
/data/media/####/npc_172
/data/media/####/npc_173
/data/media/####/npc_174
/data/media/####/npc_175
/data/media/####/npc_176
/data/media/####/npc_177
/data/media/####/npc_178
/data/media/####/npc_179
/data/media/####/npc_180
/data/media/####/npc_181
/data/media/####/npc_182
/data/media/####/privacy
/data/media/####/s
/data/media/####/sagemapatlas
/data/media/####/sdkaccountinfo.db
/data/media/####/sdkaccountinfo.db-journal
/data/media/####/startui
/data/media/####/values
/data/media/####/vivounionapk_v4.2.0.0_130e63a_201805051638_sig...ed.vua
/data/media/####/window_assemequip
/data/media/####/window_assemequipmini
/data/media/####/window_assempet
/data/media/####/window_assempetmini
/data/media/####/window_assemspell
/data/media/####/windowbig_activity
/data/media/####/windowbig_assem
/data/media/####/windowbig_cavechoose
/data/media/####/windowbig_compensate
/data/media/####/windowbig_crosscity
/data/media/####/windowbig_crossrace
/data/media/####/windowbig_crossstore
/data/media/####/windowbig_kingrace
/data/media/####/windowbig_rein
/data/media/####/windowbig_sect
/data/media/####/windowbig_setting
/data/media/####/windowbig_store
/data/media/####/windowbig_worldchoose
/data/media/####/windowbig_worldcreator

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c type su
cat /sys/block/mmcblk0/device/cid
chmod 755 <Package Folder>/.cache
getprop
getprop ro.product.cpu.abi

Uses the following algorithms to encrypt data:

AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-GCM-NoPadding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial