Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.78.origin
Network activity:
Connecting to:
- a####.####.cn
- a####.####.com
- c####.####.mobi
HTTP GET requests:
- a####.####.cn/ad/20161215/201612151630985.png
- a####.####.com/is/init.jsp?appid=####
HTTP POST requests:
- c####.####.mobi/pop/gc
- c####.####.mobi/pop/gd
- a####.####.com/is/info.jsp
- c####.####.mobi/pop/up
- a####.####.com/is/init.jsp
Modified file system:
Creates the following files:
- /sdcard/ddad/oslog/####.txt
- /data/data/####/databases/eca.db-journal
- /data/data/####/files/X406yctest.zip
- /data/data/####/shared_prefs/unssp.xml
- /data/data/####/shared_prefs/unssp.xml.bak
- /sdcard/Download/.cache/http@@apk@d@ad@youday@cn@ad@20161215@201612151630985@png
- /data/data/####/databases/unlock.db-journal
- /data/data/####/databases/abuseself_alarms.db-journal
- /data/data/####/shared_prefs/appshare.xml
- /data/data/####/databases/unlock.db
- /sdcard/Download/.cache/http@@apk@d@ad@youday@cn@ad@20161215@201612151630985@png.tmp
- /data/data/####/files/X406yc
- /data/data/####/.cache/cznnz.jar
- /data/data/####/files/tX406yctest.zip
- /data/data/####/app_r/c.jar
- /data/data/####/shared_prefs/appshare.xml.bak
- /data/data/####/files/X406ca
- /data/data/####/shared_prefs/eck.xml
- /data/data/####/shared_prefs/frame_pre.xml
- /sdcard/ddad/runing.properties
- /data/data/####/files/vcom
- /data/data/####/databases/frame.db-journal
- /data/data/####/shared_prefs/unkit.xml
- /data/data/####/databases/ecd.db-journal
- /sdcard/Android/data/xxh/XH.txt
- /data/data/####/shared_prefs/dtnum.xml
- /data/data/####/shared_prefs/frame_pre.xml.bak
Miscellaneous:
Contains functionality to send SMS messages automatically.
