Android.DownLoader.2014

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

7x####.####.com
m####.####.com
a####.####.cn
m####.####.com:8757
e####.####.cn

HTTP GET requests:

7x####.####.com/scene/argentina/p_s2.jpg
7x####.####.com/scene/lake/p_l.jpg
a####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
7x####.####.com/scene/fireplace/p_l.jpg
7x####.####.com/scene/fireplace/p_s.jpg
m####.####.com/sdk.html
7x####.####.com/scene/amazon/p_s.jpg
7x####.####.com/scene/train/p_s3.jpg
7x####.####.com/scene/rain/p_s4.jpg
7x####.####.com/scene/lake/p_s.jpg
7x####.####.com/scene/cat/p_s.jpg

HTTP POST requests:

e####.####.cn/cw/cp.action?requestId=####&g=####
e####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
m####.####.com:8757/sdk.html

Modified file system:

Creates the following files:

/data/data/####/cache/image_cache/v2.ols100.1/83/b36NRTqaywHeA9Rz2aBGAun_f3Y.-1311473125.tmp
/data/data/####/databases/cc/cc.db
/data/data/####/shared_prefs/com.avos.avoscloud.RequestStatisticsUtil.data.xml
/sdcard/dt/restime.dat
/data/data/####/shared_prefs/setting.xml
/data/data/####/cache/image_cache/v2.ols100.1/48/SB-LoF-TW6XCZJad-dI2VCgz6tk.-75369994.tmp
/data/data/####/cache/image_cache/v2.ols100.1/87/hTMU4qMZut42g5XzVk0YKvmFgO0.-623416624.tmp
/data/data/####/app_Paas/currentUser
/data/data/####/cache/image_cache/v2.ols100.1/40/q9VYtMkE2Q5-wLiRPDiE5XjVODk.-114115934.tmp
/data/data/####/shared_prefs/a.xml.bak
/data/data/####/databases/cc/cc.db-journal
/data/data/####/cache/image_cache/v2.ols100.1/31/kEvBP-BRKS_cpU0MN5rgNDOPxVE.1144749112.tmp
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/cache/image_cache/v2.ols100.1/93/IEsp3Mr2Fw5C4waMzIY7garwnok.-10999069.tmp
/data/data/####/files/cache/download.db-journal
/data/data/####/shared_prefs/a.xml
/data/data/####/shared_prefs/first.xml
/data/data/####/cache/PaasKeyValueCache/a2ca897a31a5d2a384b49c7a37af3209
/data/data/####/shared_prefs/W_Key.xml
/data/data/####/databases/downloadswc-journal
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/cache/image_cache/v2.ols100.1/97/wDWV_ZRS9TsKeHfYa66P0RY6g0Q.2134527209.tmp
/data/data/####/shared_prefs/st.xml
/data/data/####/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
/data/data/####/shared_prefs/com.avos.avoscloud.approuter.fxulg13bkmnxzi4zhbojmr3fbiqar28fmqtclv4zqgif0vi2.xml
/data/data/####/cache/image_cache/v2.ols100.1/2/jen2BlpIDKeZIMilzoj3QniMf5U.790856786.tmp
/data/data/####/files/cache/download.db
/data/data/####/cache/image_cache/v2.ols100.1/4/N9M2KoBC7AwfRqkcIhjKO4gwdqk.-1038410367.tmp
/sdcard/Download/hou/4.6_lvs.jar.tmp
/data/data/####/databases/downloadswc