Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- d####.####.cn
- o####.####.com
- p####.####.com
- l####.####.com
- a####.####.com
HTTP GET requests:
- p####.####.com//dc7759eaf0cb762e755f77196e9288c7.jpg
- l####.####.com/package/50916/
- p####.####.com//f8a449f4aec5821963114914ab2a87dd.jpg
- p####.####.com/a4c0527e910e07b5c807afa08b3173f0.jpg
- p####.####.com//6d9594092423d0e093dee91df56ce2f8.jpg
- p####.####.com//c505accb343eb8edc1fca49dbf08d223.jpeg
- p####.####.com/2419d21ec68285d65842ffef82472afc.gif@0e_100w_100h_0c_0i_1...
- l####.####.com/search/hot_word
- p####.####.com/56cc95c957241d6d29b9d0e6797e7a2f.png
- p####.####.com/734cdffecbd50c5f3bd8605928d771b9.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//7c9fd7efb297bb59e008bc680fe8d549.jpg
- p####.####.com/ab2ec47b7f0cade927c9f6672c82b0e8.jpg@0e_100w_100h_0c_0i_1...
- l####.####.com/package/50838/
- l####.####.com/package/50893/
- p####.####.com//87b4dc1523000340fb3ade4802861527.jpg
- p####.####.com//ef0b7834d7f0e3de5aa38deaf7512139.jpg
- p####.####.com/703d70ccd79011c1ea294a5dd316f5de.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/7b946b1a3292e0c39b3d6e322251cbb7.jpg
- p####.####.com//ec6005a8740099027229c631661f4682.jpeg
- p####.####.com//6a2a1b9f181d8acebd6a05931cdb360b.jpg
- p####.####.com/46f90117e90a3cffe77b87e637c66128.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/0413354b20741c75828460b0b808a03f.jpg
- p####.####.com//f376e3406e12e9ad73bc38fd88b8ec0a.jpg
- p####.####.com//fe40f446badf5fa40846dd31266ce7dd.jpg
- p####.####.com//8ab1271ee9b91e331a6fd1e7bb5a9516.jpg
- p####.####.com/04940d3ffad5cc7ec4cbd7b58dca34f4.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/8d83075a04e5d13a75b294856cda9a5f.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/8e516008a999fc5b876f49d8947f1334.gif@0e_100w_100h_0c_0i_1...
- p####.####.com//908342f76cfefbb77cedbc4bad36a734.jpg
- p####.####.com//c2ce3cc92a9910fd425c21baa3dc3fd4.jpg
- p####.####.com//aa2a1ba29c19a2f53a36c8dd1cbfd649.jpg
- l####.####.com/chosen/recommend
- p####.####.com/f0a4eb1900fbb4df9178cd664211e69b.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/7f5623efd50775e1ea31d6838f8f2ed5.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/22a0badf2d63a96db0d86ef599084b92.png@0e_100w_100h_0c_0i_1...
- p####.####.com//0b7b9d1b1f4dcd763d91130e5fe80fb3.gif
- l####.####.com/package/50908/
- p####.####.com//f5d35e466ef213f03cb1355ed1b0e938.jpeg
- p####.####.com//0a49cd2752458281f702b83b0d3dc167.gif
- p####.####.com//b07fe65a9b95a2b3659817db47e7451b.jpg
- p####.####.com/77dd11e8f8b21a366650c51d84258013.png
- p####.####.com/b25af5da8f4edec2621e6e1652235ec8.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//0ea5382c29bbfc33fa6465cd2e113839.gif
- d####.####.cn/jarFile/SDKAutoUpdate/rio.jar
- p####.####.com//8a17b96930f624b48ca2a42c100c4ba1.jpg
- p####.####.com/b9d2871e62358ca481eddd15825078ee.png
- p####.####.com/b74fb03864291d8abf9efea2bd7f814c.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//6c92c792ddb15e91dd2d9d4c460ecd00.jpg
- p####.####.com//1be1641f98e45de6db6bf34898440ff7.jpg
- l####.####.com/chosen/home
- l####.####.com/package/48553/
- p####.####.com/a9fdd856a48e2a3ed24f315b1c8cadd5.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//2a8ebe550cdd20f7a5d95b1c2ac0df34.jpg
- p####.####.com/1567fe086c282ff959dafa88ea06a3cf.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//912f9d79cea7872445428a3279642528.jpeg
- p####.####.com/fbe5b0c952092d50f47272195e9e02a9.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//af2ed3bb6bf6196eb52dea351b20f721.jpg
- l####.####.com/collect/
- p####.####.com//f1930bcefc973d831eca424f931247c7.jpg
- p####.####.com//716032213cc56e33e810762c04edc621.gif
- p####.####.com//3c8a440d4da545170f535bacf8be67bc.jpg
- p####.####.com/a1ef496a2aac608a50d18a110dc601fb.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/44aef24e4239a600a7c82816e1f08305.gif
- p####.####.com//e4067ff7f8b3ebde639407d730e62d41.jpg
- p####.####.com//7d9521842f99db620dd94cf22c4ed6d2.jpg
- p####.####.com//34bc7eb43525ed58998f14a50006cbe6.gif
- p####.####.com//39793e75f4c7d6d73372159ddb3f25a4.jpg
- p####.####.com/c29a5112bfab1e77f73f723951f0f9f9.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/1af251a5e3f208240f021bb0cc323852.jpg
- p####.####.com/9c3ac85414abe29da4e8664699cb6454.gif@0e_100w_100h_0c_0i_1...
- p####.####.com//3077a049f1aee0dafb92ff331c5b5db5.jpeg
- p####.####.com/dfbfca3c556d309cfe230fd7ba968467.png
- p####.####.com/65e9aa601c1f2dca0d5d470ec06bac6f.jpg
- p####.####.com//213cd75dc1634e1d783fe1934313cf4d.gif
- p####.####.com/1ce4906919a15dd86856f8237add90fa.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//9df528552107f58070ddc6d0b4f44d21.jpg
- p####.####.com/68fe0e621548bdb7e2c31a7e0176ab91.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/6c5db973c78d5c3a236561621e674303.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/9ad3c816e7cd30567a6b45a997e646bf.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/87bf6e36df98643b4274d9cadf128ef8.jpg
- l####.####.com/package/49981/
- p####.####.com//5d21a11a7fe8bc7fc57dc246d0e689c8.jpg
- p####.####.com//ead16ec985b65ab91be2d44459671628.jpeg
- p####.####.com/e8d83cb85f6a6db7c2ba29d9b28f9ac6.jpg
- l####.####.com/package/49961/
- p####.####.com//a29d6bfd2e88dfc2a5f4d8f66b4e33ce.jpg
- p####.####.com//259e1549e20d826264e76fc8a6b1cf85.jpg
- p####.####.com//c8f79e89542c38768dab7c43a5fd5251.jpg
- l####.####.com/package/49984/
- p####.####.com//84ef31c1070fbd44e8eeaaa52a45a72d.jpg
- p####.####.com/998d1c9c0541825af6e6825dc35e5e9c.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/23349ac8495eaa5ec1024c963cc9088e.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/0475d3392cd8cef6d61c1f0013c3f92d.gif@0e_100w_100h_0c_0i_1...
- p####.####.com//d6734049c21e4c65ed008eb985849371.jpg
- p####.####.com/8514fca75ba9a0fccbfa85d11b4acb80.jpg
- p####.####.com//e721351f3d04a3dca640f5291ba24601.jpg
- p####.####.com/74c1b377b144aa47c12f3f44bd08c322.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/76aace01b0a5b8d7821a292d1403e9fe.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//0c072e1fe81edb89117f4e150e11737a.jpg
- p####.####.com//f4cf00523aad4d514e1738e823e783ac.gif
- p####.####.com//32a23255b278268f42074c8ca69d72d2.jpeg
- p####.####.com/69d5e70caa19c36b063b916c2138b86c.jpg
- p####.####.com/06cd4cfa325278a146bfed88c34317d2.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/51d0d87075dd4e0edc2a4bef59259085.png@0e_100w_100h_0c_0i_1...
- l####.####.com/user/message_num
- l####.####.com/skin
- l####.####.com/package/50911/
- p####.####.com/10377e8a85396e73f7b19f386a09c456.gif
- p####.####.com//d8b4b55b6897470d8bbc4815328f1fbc.gif
- l####.####.com/package_count
- p####.####.com//ac99374f442788abfdb5142f791d2fb8.jpg
- l####.####.com/package/49840/
- p####.####.com/05447ebd2fbc44abce4f5c45b7ca4f51.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//ba52c02a75313dd0aa946e6e99d61e20.jpg
- p####.####.com/d2f9ce6410b13066aa0a94861fb5b0da.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//d70cb65d4f79918b9b31e92d32dd32f4.jpeg
- p####.####.com//f3151a14d2fea1624cbe2a98cbd4e507.gif
- p####.####.com/11caafc95787f307cb42bd974d399362.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/58f94094358af25b739133b5539271e7.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/e4daba9c5514118d7caaf85bd7ed4905.jpg
- l####.####.com/package/50728/
- l####.####.com/package/48948/
- l####.####.com/page/
- p####.####.com//592b7ea183db9cb48be272b535bb4b70.gif
- p####.####.com/e8d83cb85f6a6db7c2ba29d9b28f9ac6.jpg@0e_100w_100h_0c_0i_1...
- l####.####.com/page/home
- p####.####.com//d638e30ed6f49ee80809a37d3b85af40.gif
- p####.####.com/a01d443bea4318e24c3e1c3d29a83c70.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com//5afe88dbbaa68691ffb7d075beb177ac.jpg
- p####.####.com/386585657d656881be4b501d98728616.jpg
- p####.####.com//b95a548d6a516aa573d4dd2b255fc928.jpeg
- p####.####.com/885de82243b348c6b32df18b2c24cd4a.png
- p####.####.com//5912c1c3b48e7373fd5e7d8c80da8a5d.jpg
- p####.####.com//fa71e2017894b0f648d7a4ba2f83e4c1.jpg
- p####.####.com//c29a5112bfab1e77f73f723951f0f9f9.gif
- l####.####.com/bbs/home
- p####.####.com//c16e86b4e1878b1b4c3d078aa89f58c6.jpg
- p####.####.com//7f40aa8ca4da7c7b40b2d767e1916429.jpg
- p####.####.com/d300c72635616ac6b66140e9d7d75b1e.gif@0e_100w_100h_0c_0i_1...
- p####.####.com//8372e5dbb9023ef95e16a9aa6bd8ca63.jpg
- p####.####.com/5cb90777959e13ec920da671127c5369.jpg
- p####.####.com//d52b7475184928c71166886ad9d7ccfe.gif
- p####.####.com/4b25dd0d1bce9655369be88a5adf1fad.jpg@0e_100w_100h_0c_0i_1...
- p####.####.com/dc9b45fd1e162ca262dc16ac3024a26c.gif@0e_100w_100h_0c_0i_1...
- p####.####.com//bb3735471ace9790aa35901aa7a34440.gif
- p####.####.com/e8f6f8df929e7ea92762d9082bb16e25.gif@0e_100w_100h_0c_0i_1...
- p####.####.com/2b02ecb48ee146c628875d0f68fdc7da.jpg@0e_100w_100h_0c_0i_1...
- l####.####.com/package/50882/
- p####.####.com//5f2be88f57d53ed27ae006c376f86848.jpg
HTTP POST requests:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####
- l####.####.com/package/watch
- o####.####.com/v2/get_update_time
- l####.####.com/collect/action
- s####.####.com/cw/cp.action?requestId=####&g=####
- o####.####.com/v2/check_config_update
- l####.####.com/sign_in
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /sdcard/Download/mapp/3.6_rio.jar.tmp
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/topic.xml
- /data/data/####/app_emot/0b7b9d1b1f4dcd763d91130e5fe80fb3.gif
- /data/data/####/app_emot/d638e30ed6f49ee80809a37d3b85af40.gif
- /data/data/####/app_emot/c29a5112bfab1e77f73f723951f0f9f9.gif
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/shared_prefs/umeng_feedback_conversations.xml
- /data/data/####/shared_prefs/rec_data.xml
- /data/data/####/shared_prefs/classifyTab.xml
- /data/data/####/app_emot/213cd75dc1634e1d783fe1934313cf4d.gif.tmp
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/cache/afinalCache.1
- /data/data/####/cache/afinalCache.0
- /data/data/####/app_emot/213cd75dc1634e1d783fe1934313cf4d.gif
- /data/data/####/shared_prefs/concern_data.xml
- /data/data/####/app_emot/d638e30ed6f49ee80809a37d3b85af40.gif.tmp
- /data/data/####/shared_prefs/RunInFixTimeUtil.xml
- /data/data/####/shared_prefs/umeng_message_state.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/afinalCache.idx
- /data/data/####/shared_prefs/AppStore.xml
- /data/data/####/files/mobclick_agent_cached_####189
- /data/data/####/shared_prefs/spTopicDepartment.xml
- /data/data/####/files/.imprint
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/shared_prefs/com.yuelian.qqemotion.LOCAL_USER.xml
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/shared_prefs/handpickdata.xml
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/databases/search_dictionary.db
- /sdcard/cw/assetstime.dat
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/app_emot/c29a5112bfab1e77f73f723951f0f9f9.gif.tmp
- /data/data/####/shared_prefs/st.xml
- /data/data/####/databases/qqemot.db-journal
- /data/data/####/shared_prefs/DEFAULT_EMOTIONS.xml
- /data/data/####/shared_prefs/suggest_data.xml
- /data/data/####/shared_prefs/hotSearchSp.xml
- /data/data/####/shared_prefs/account.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/starToBeCommitted.xml
- /data/data/####/shared_prefs/runEveryDay.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/app_emot/0a49cd2752458281f702b83b0d3dc167.gif
- /data/data/####/app_emot/0a49cd2752458281f702b83b0d3dc167.gif.tmp
- /data/data/####/shared_prefs/lastPullSP.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/shared_prefs/requested.xml
- /data/data/####/databases/search_dictionary.db-journal
- /data/data/####/app_emot/0b7b9d1b1f4dcd763d91130e5fe80fb3.gif.tmp
- /data/data/####/databases/downloadswc
- /data/data/####/shared_prefs/com.yuelian.qqemotion.SP_MY_TOPIC_INFO.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 45 40 95276 /storage/emulated/0/download/mapp/3.6_rio.jar 1225940834 1257871353 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
Contains functionality to send SMS messages automatically.
