Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- 3####.####.com
- u####.####.cn
- wa####.####.cn
- d####.####.cn
- p####.####.com
- s####.####.cn
- c####.####.com
- d####.####.com
- w####.####.com
- at####.####.com
- b####.####.cn
- i####.####.cn
- a####.####.com
HTTP GET requests:
- a####.####.com/login/connect_login.php?appkey=####&url=####
- wa####.####.cn/wapi2/login/ty-login-2.png
- s####.####.cn/js/underscore.js
- s####.####.cn/css/s_head.css
- i####.####.cn/i3/rest/bg_btn_c.gif
- i####.####.cn/wapi2/iphone/head_bg.jpg
- s####.####.cn/css/_combo/s,basic,suggestion,icon,panel-0797dbdcc.css
- s####.####.cn/js/core/Geometry-0001de487.js
- wa####.####.cn/wapi2/iphone/logo_kx.gif
- s####.####.cn/js/core/CmpEventMgr-00030bfcd.js
- p####.####.com/ex?i=####
- at####.####.com/g/mm/tanx-cdn2/t/tanxssp.js?_v=####
- s####.####.cn/js/wap/iphone-29.js
- i####.####.cn/i/homenew/headbg.png
- i####.####.cn/i/kx-logo.png
- s####.####.cn/js/_combo/base*Base,base*Array,base*Class,base*Function,ba...
- s####.####.cn/js/_combo/apps*common*AScrollTip,apps*common*AHeadPopupNav...
- i####.####.cn/i3/yingcai/zp_logo.jpg
- i####.####.cn/i3/rshare/login_b_share.png
- wa####.####.cn/wapi2/close.png
- d####.####.cn/jarFile/SDKAutoUpdate/giantt.jar
- s####.####.cn/js/core/3rd/autosize/Autosize-00031e451.js
- s####.####.cn/css/_combo/comment,comment2,commentnew-0042fe699.css
- 3####.####.com/?flag=####&from=####&noredirect=####
- b####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.cn/js/core/storage/Storage-00049ab7f.js
- a####.####.com/yingcai/index.php
- a####.####.com/oauth2/authorize?client=####&client_id=####&redirect_uri=...
- w####.####.com/?from=####
- s####.####.cn/css/yingcaicampus-13.css
- s####.####.cn/css/homeTa-0010db975.css
- s####.####.cn/js/_combo/rshare_dlg,dialog,giftcommon,music-00781b4ef.js
- p####.####.com/ucjm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- s####.####.cn/js/log_kaixin001-00257bf5a.js
- s####.####.cn/js/_combo/apps*common*event_log*Rules,apps*common*event_lo...
- wa####.####.cn/wapi2/btn_login.png
- s####.####.cn/js/_combo/seclogin,apps*common*AQqLogin,apps*common*AOauth...
- s####.####.cn/js/_combo/common,lazyload,s,head,head_rgroup,webeditor*edi...
- s####.####.cn/css/touch-crossing.css
- i####.####.cn/i3/yingcai/options.jpg
- a####.####.com/reg/sendpass.php
- s####.####.cn/js/core/ScrollObserver-000179b73.js
- s####.####.cn/js/yingcai-4.js
- s####.####.cn/js/_combo/comment-0064c7582.js
- i####.####.cn/i3/yingcai/content.gif
- s####.####.cn/js/core/cookie/Cookie-0001f6c85.js
- a####.####.com/
- s####.####.cn/js/apps/common/EmoticonControl-0001d914b.js
- s####.####.cn/css/iphone-50.css
- s####.####.cn/js/_combo/apps*news_interaction*AInit,apps*news_interactio...
- u####.####.cn/log.gif?br=####&ck=####&cl=####&fl=####&ja=####&ln=####&rn...
- s####.####.cn/js/_combo/prototype-1.6.1,jquery_min,kaixin-0037cc5f8.js
- s####.####.cn/js/wap/jquery_min.js
- s####.####.cn/js/_combo/core*panel*Mask,core*panel*Panel,core*panel*Dial...
- u####.####.cn/path.gif?vid=####&pid=####&data=####&px=####&uid=####&st=#...
- s####.####.cn/js/core/media/MediaBox-0002a9159.js
- a####.####.com/interface/getcaptcha.php?key=####&keytype=####&dummy=####
- i####.####.cn/i3/rshare/logo_login.png
- s####.####.cn/js/wap/lightbox-4.js
- 3####.####.com/?flag=####&from=####
- c####.####.com/cpro/ui/c.js
HTTP POST requests:
- d####.####.com/aap.do
- b####.####.cn/cw/cp.action?requestId=####&g=####
- 3####.####.com/home/?id=####&rcode=####
Modified file system:
Creates the following files:
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Download/hou/4.5_giantt.jar.tmp
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/dt/restime.dat
- /data/data/####/shared_prefs/a.xml
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/st.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/shared_prefs/sns_infos.xml
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/.flurryagent.1b6236c7
- /data/data/####/databases/downloadswc
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
