Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- beau####.####.com:8008
- beau####.####.com
- d####.####.cn
- t####.####.com:16070
- mes####.####.com:16080
- mes####.####.com
- bala####.####.cn
- a####.####.com
HTTP GET requests:
- beau####.####.com/beautify/banner/cover/19e4d9cd5e4641ffbcbfc205a15ec9f8...
- beau####.####.com/beautify/lockscreen/preview/2b3db3a9981d467ab36f6e6d95...
- beau####.####.com/beautify/lockscreen/preview/e7b2ef17e40b48f6843ad72739...
- mes####.####.com:16080/home
- beau####.####.com/beautify/lockscreen/preview/7c372b3e3e094f10a12bdec3d3...
- beau####.####.com:8008/beautify/banner/cover/d86b83796be844c99f71c18f06f...
- beau####.####.com/beautify/lockscreen/preview/0b95c2feba9941b288d9635f44...
- t####.####.com:16070/themes?simCIso=####&localC=####&market=####
- beau####.####.com/beautify/lockscreen/preview/c22080f8942a49fa825b8c6d7e...
- beau####.####.com/beautify/lockscreen/preview/ffaf6a4fde654adfb73471a0fb...
- mes####.####.com/js/idotools/idotoolsjs.server.min.js?3####
- beau####.####.com/beautify/banner/cover/37aef4f8498f4d19ade5e1785fceefee...
- mes####.####.com/img/icons.png?1####
- bala####.####.cn/com.dotools.flashlockscreen_beauty.apk
- beau####.####.com/beautify/lockscreen/preview/b0885afd778c4760a8a5f7ee60...
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- beau####.####.com/beautify/lockscreen/preview/7c09032bcc624a8ba2d6ed202c...
HTTP POST requests:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.com/app_logs
- s####.####.com/cw/cp.action?requestId=####&g=####
- mes####.####.com/_statH5ShareDownload
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/files/mobclick_agent_cached_<Package>2
- <Package Folder>/shared_prefs/<Package>_pref.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
