Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- d####.####.cn
- y####.####.cn
- f####.####.com
- y####.####.com
- su####.####.com
- l####.####.com
- a####.####.com
HTTP GET requests:
- a####.####.com/api/data/2/
- su####.####.com/adpserver/GetVIByPN?PackName=####&SDKVer=####&dauuid=###...
- y####.####.com/hao/json/template/version.v2.json
- y####.####.com/hao/json/smartnews/smartnews.md5
- y####.####.cn/k2?protocol=####&version=####&cid=####
- a####.####.com/api/v1/search/hotword?channel=####
- a####.####.com/api/data/4/
- l####.####.com/addr/1.0/query?sid=####&appkey=####&didt=####&did=####&dm...
- y####.####.com/hao/json/template/version.v2.md5
- d####.####.cn/jarFile/SDKAutoUpdate/bit.jar
- a####.####.com/api/v1/search/rewrite
HTTP POST requests:
- f####.####.com/reaper/server/report2
- f####.####.com/reaper/server/didsync
- f####.####.com/reaper/server/config2
- f####.####.com/reaper/server/appparams?appkey=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/AppsSettings.xml
- /sdcard/Android/data/####/cache/uil-images/1613067270
- /data/data/####/databases/cc.db-journal
- /data/data/####/databases/downloadswc-journal
- /data/data/####/databases/cardModel.db-journal
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/modelJson/naviNews_f095ac2bdf70a5226933dbe95a7ad59d.json
- /data/data/####/databases/cc.db
- /sdcard/Android/data/####/cache/uil-images/283187021
- /sdcard/Android/data/####/cache/uil-images/250334916
- /data/data/####/files/dataJson/naviNews_f095ac2bdf70a5226933dbe95a7ad59d.json
- /sdcard/Android/data/####/cache/uil-images/-784306505
- /data/data/####/databases/ua.db-journal
- /sdcard/Android/data/####/cache/uil-images/-928400465
- /data/data/####/shared_prefs/a.xml.bak
- /data/data/####/shared_prefs/traffic.xml
- /data/data/####/shared_prefs/ConfigUpdate.xml
- /sdcard/LenovoReaper/did
- /sdcard/Android/data/####/cache/uil-images/1891413264
- /sdcard/dt/restime.dat
- /sdcard/Android/data/####/cache/uil-images/1791428264
- /data/data/####/shared_prefs/SearchSettings.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/cache/uil-images/371567889
- /sdcard/Android/data/####/cache/uil-images/-996161162
- /sdcard/Download/bu/4.8_bit.jar.tmp
- /data/data/####/shared_prefs/a.xml
- /data/data/####/files/modelJson/hotSite_42807b694567c8fba4066d638a8ca2c3.json
- /sdcard/Android/data/####/cache/uil-images/370407553
- /data/data/####/shared_prefs/ServerUrl.xml
- /data/data/####/shared_prefs/SUS_PATCHUPDATE.xml
- /data/data/####/shared_prefs/W_Key.xml
- /sdcard/Android/data/####/cache/uil-images/-2131738164
- /sdcard/Android/data/####/cache/uil-images/2142823522
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/traffic.xml.bak
- /data/data/####/shared_prefs/st.xml
- /data/data/####/shared_prefs/ReaperAppConfig.xml
- /data/data/####/shared_prefs/reaper.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/umeng_it.cache
- /sdcard/Android/data/####/cache/uil-images/-811006935
- /data/data/####/files/dataJson/hotSite_42807b694567c8fba4066d638a8ca2c3.json
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/Android/data/####/cache/uil-images/-964640483
- /sdcard/Android/data/####/cache/uil-images/1617182449
- /data/data/####/shared_prefs/ConfigUpdate.xml.bak
- /sdcard/Android/data/####/cache/uil-images/-1900417509
- /data/data/####/databases/downloadswc
Miscellaneous:
Executes next shell scripts:
- getprop net.dns1
Contains functionality to send SMS messages automatically.
