Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Prompts to install third-party applications.
Network activity:
Connecting to:
- xiba####.####.com
- i####.####.com
- wdj-qn####.####.com
- wdj-uc1####.####.com
- o####.####.com
- up####.####.com
- c####.####.com
- a####.####.com
- b####.####.cn
- l####.####.com
- d####.####.cn
- nc-up####.####.com
HTTP GET requests:
- c####.####.com/3/i/cmccwm.mobilemusic/46494/1829044.gif?ast=####
- wdj-qn####.####.com/4/50/7afb84f389004b937819fd44da2fa504.apk
- a####.####.com/redirect?signature=####&url=####&dlType=####&ast=####&pn=...
- i####.####.com/mms/icon/v1/9/07/84f334ce6f74ef4ee173e2051c719079_256_256...
- c####.####.com/3/i/com.yue.ai.yuanfen/19925/272465.gif?ast=####
- nc-up####.####.com/tools/fastclean/FastCleanSectionConfig0901.txt
- c####.####.com/3/i/com.netease.newsreader.activity/46268/1824472.gif?ast...
- i####.####.com/mms/icon/v1/4/97/4b8356b706e0048b4ca9677c426c3974_256_256...
- i####.####.com/mms/icon/v1/d/94/5376636ffa1519c77e1c330ef70fc94d_256_256...
- i####.####.com/mms/icon/v1/0/2c/845d52cf360cf67b8aeb3d429429f2c0_256_256...
- i####.####.com/mms/icon/v1/e/00/f6769c7b8ffa3dd62dc7147cd5fc900e_256_256...
- c####.####.com/3/i/com.ximalaya.ting.android/46496/1829080.gif?ast=####
- i####.####.com/mms/icon/v1/3/1d/84e229a37c1f31c05f699313fd1811d3_256_256...
- d####.####.cn/jarFile/SDKAutoUpdate/giantt.jar
- b####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- i####.####.com/mms/icon/v1/2/84/eaa2bb5975b54d57f5e60b9325c72842_256_256...
- c####.####.com/3/i/com.youyuan.yyhl/45704/1803298.gif?ast=####
- c####.####.com/3/i/com.tencent.news/46110/1816876.gif?ast=####
- up####.####.com/tools/fastclean/FastCleanSectionConfig0901.txt
- wdj-uc1####.####.com/1/d9/4bd5cc907f0dfed629d17301ba06bd91.apk
- xiba####.####.com/five/v3/tabs/clean?&forcePageName=####&f=####&v=####&u...
- c####.####.com/3/i/com.longzhu.tga/46506/1829226.gif?ast=####
- c####.####.com/3/i/com.tencent.qqpimsecure/46596/1831072.gif?ast=####
- c####.####.com/static/uploads/i/com.zhimahu/25031/630685.gif?bid=####&ud...
- a####.####.com/api/v1/ads?path=####&pos=####&adsPadding=####&f=####&v=##...
- i####.####.com/mms/icon/v1/4/89/fe7330e6ca2f2312425c8c57e7dc8894_256_256...
- xiba####.####.com/api/v1/meta/list/?f=####&v=####&u=####&vc=####&ch=####
- c####.####.com/3/i/com.ss.android.article.news/1032/187977.gif?ast=####
- i####.####.com/mms/icon/v1/1/b6/ad0ee1f69c22cd10d0a3a50c2056ab61_256_256...
- i####.####.com/mms/icon/v1/1/62/3848afed6c763f46f03b5311408a3621_256_256...
HTTP POST requests:
- l####.####.com/muce/data/proxy?profile=####&vc=####&vn=####&gzip=####&en...
- xiba####.####.com/api/v1/storage/list/?f=####&v=####&u=####&vc=####&ch=#...
- b####.####.cn/cw/cp.action?requestId=####&g=####
- o####.####.com/v2/get_update_time
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/AppStore.xml
- /data/data/####/shared_prefs/umeng_feedback_user_info.xml
- /data/data/####/files/diagnosis/last_crash_log.txt
- /data/data/####/cache/cache_file6ab663a218769c26e4ebacea446b4d58
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/databases/fastclean-log.db-journal
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/UmengLocalNotificationStore.db-journal
- /data/data/####/cache/cache_file65841d6cee215cdb237f5c871d4aea1a
- /sdcard/Download/hou/4.5_giantt.jar.tmp
- /sdcard/wandoujia/.config/.udid
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/databases/fastclean.db-journal
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/umeng_message_state.xml
- /sdcard/dt/restime.dat
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/onlineconfig_agent_online_setting_####.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/muce.xml
- /data/data/####/files/.imprint
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/shared_prefs/a.xml
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/shared_prefs/LogMonitor_####.xml
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/cache/cache_filee7b6865b854aca9c41f9ce265547f282
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/files/mobclick_agent_cached_####323
- /data/data/####/shared_prefs/cache-policy.xml
- /data/data/####/shared_prefs/com.wandoujia.phoenix2.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/cache_file76a3ffa6070f66b8e1ed159cfb753214
- /data/data/####/cache/cache_filec495791b0848f470b8181e2ef7f71656
- /data/data/####/shared_prefs/st.xml
- /data/data/####/shared_prefs/ni.xml
- /data/data/####/shared_prefs/log_modulev3.xml.bak
- /data/data/####/shared_prefs/ni.xml.bak
- /data/data/####/cache/cache_filee7ea96718297ed5b510726d06af3c7f1
- /data/data/####/cache/cache_file2044866a7372393e9eca2d2425e7cb73
- /data/data/####/shared_prefs/feedback_push.xml
- /data/data/####/cache/cache_fileb223bcbffa13f3ef5086f173965e60a6
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/cache/cache_file0724a919b75496abc58b715fd37baf8b
- /data/data/####/shared_prefs/log_modulev3.xml
- /data/data/####/cache/cache_file43374e9e1f40956971732570019e079f
- /data/data/####/shared_prefs/cache-policy.xml.bak
- /data/data/####/cache/cache_file5ad1ce37de479934dc1cb6d022955a16
- /data/data/####/databases/downloadswc
- /data/data/####/shared_prefs/log_crash.xml
Miscellaneous:
Executes next shell scripts:
- chmod 777 /data/local/tmp
Contains functionality to send SMS messages automatically.
