Android.DownLoader.2019

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

googl####.####.net
m####.####.com:8757
a####.####.cn
e####.####.cn
m####.####.com
a####.####.com
pag####.####.com

HTTP GET requests:

googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.appcache
a####.####.com/my2/corea.jsp?banner=####&ver=####
googl####.####.net/mads/static/mad/sdk/native/canary/sdk-core-v40-impl.js
googl####.####.net/mads/static/mad/sdk/native/production/sdk-core-v40-im...
googl####.####.net/mads/static/sdk/native/sdk-core-v40.html
pag####.####.com/activeview?avi=####&id=####&mtos=####&tos=####&p=####&r...
a####.####.com/ajax/libs/jquery/1.7.2/jquery.min.js?&ver=####
m####.####.com/sdk.html
a####.####.com/ext/files/classes.dex.zip
googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.html
googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.js
a####.####.com/bi.adl?name=####&ver=####
a####.####.com/my2/images/r.png?&ver=####
a####.####.cn/jarFile/SDKAutoUpdate/giantt.jar

HTTP POST requests:

m####.####.com:8757/sdk.html
a####.####.com/my2/parta.jsp
a####.####.com/rsch3.jsp
e####.####.cn/cw/cp.action?requestId=####&g=####
a####.####.com/report3.jsp
a####.####.com/ext/rm.jsp
e####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####

Modified file system:

Creates the following files:

/data/data/####/cache/Adlib-data/50275fa70cf220394aba09e3/m.html
/data/data/####/databases/PedometerDatabase-journal
/data/data/####/databases/downloadswc-journal
/data/data/####/shared_prefs/####_preferences.xml
/sdcard/Download/hou/4.5_giantt.jar.tmp
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/shared_prefs/a.xml.bak
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/shared_prefs/adlibr.xml.bak
/sdcard/dt/restime.dat
/data/data/####/cache/Adlib-data/50275fa70cf220394aba09e3/ok
/data/data/####/cache/Adlib-data/50275fa70cf220394aba09e3/i2
/data/data/####/shared_prefs/a.xml
/data/data/####/ADLIBr/rm.apk
/data/data/####/shared_prefs/W_Key.xml
/data/data/####/cache/ads1154093537.jar
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/cache/Adlib-data/50275fa70cf220394aba09e3/i0
/data/data/####/cache/Adlib-data/50275fa70cf220394aba09e3/i1
/data/data/####/shared_prefs/st.xml
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/databases/webview.db-journal
/data/data/####/databases/com.google.android.gms.ads.db/localstorage/http_googleads.g.doubleclick.net_0.localstorage-journal
/data/data/####/shared_prefs/adlibr.xml
/data/data/####/cache/ApplicationCache.db-journal
/data/data/####/shared_prefs/openudid_prefs.xml
/data/data/####/databases/downloadswc
/data/data/####/cache/webviewCacheChromium/index