Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- h####.####.com
- d####.####.cn
- p####.####.com
- f####.####.com
- a####.####.com
HTTP GET requests:
- f####.####.com/2016/08/17/57b416c197f25.png
- f####.####.com/Wfulihezi/Tpl/Public/images/bonn-center-icon_16.png
- a####.####.com/t/font_1453431835_9247143.ttf
- p####.####.com/2017/03/06/58bccdbc89765.png
- p####.####.com/2017/03/23/58d3917355605.png
- f####.####.com/index.php/index/usershop1?nbm=1?from=####&tgid=####&asklo...
- f####.####.com/Wfulihezi/Tpl/Public/images/boon-bj_21.png
- f####.####.com/Wfulihezi/Tpl/Public/images/boon-bj_17.png
- f####.####.com/Wfulihezi/Tpl/Public/images/btm_game.png
- f####.####.com/Wfulihezi/Tpl/Public/images/guanbi.png
- f####.####.com/Wfulihezi/Tpl/Public/images/boon-bj_13.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- f####.####.com/usershop.html
- a####.####.com/t/font_1453431835_9998188.css
- f####.####.com/Wfulihezi/Tpl/Public/images/icon-kefu.png?t=####
- f####.####.com/Wfulihezi/Tpl/Public/images/btm_user.png
- p####.####.com/2017/03/29/58db21161cb2a.gif
- p####.####.com/2017/05/11/5914278bc1a0a.png
- f####.####.com/Wfulihezi/Tpl/Public/images/level4.png
- p####.####.com/2017/04/01/58df778370051.png
- f####.####.com/Wfulihezi/Tpl/Public/images/btm_store.png
- f####.####.com/Wfulihezi/Tpl/Public/images/indexIcon4.png
- f####.####.com/Wfulihezi/Tpl/Public/images/boon-bj_11.png
- p####.####.com/2017/04/06/58e5e768c6a97.png
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- f####.####.com/Wfulihezi/Tpl/Public/css/swiper.min.css
- f####.####.com/2016/08/18/57b50e5d3ae30.jpg
- f####.####.com/Wfulihezi/Tpl/Public/images/btm_store_on.png
- f####.####.com/index.php/index/fuli_list
- f####.####.com/Wfulihezi/Tpl/Public/js/jquery-1.9.1.min.js
- f####.####.com/2016/01/05/568b8ac047527.jpg
- f####.####.com/Wfulihezi/Tpl/Public/images/btm_user_on.png
- f####.####.com/index.php
- f####.####.com/Wfulihezi/Tpl/Public/images/tk-img02.png
- f####.####.com/Wfulihezi/Tpl/Public/images/bonn-center-icon_13.png
- a####.####.com/t/font_1471333596_8428915.ttf
- f####.####.com/Wfulihezi/Tpl/Public/images/btm_activation.png
- f####.####.com/Wfulihezi/Tpl/Public/images/icon-h5.png?t=####
- a####.####.com/t/font_1471333597_2879353.css
- f####.####.com/Wfulihezi/Tpl/Public/images/help.png
- f####.####.com/index.php/index/usershop1
- f####.####.com/Wfulihezi/Tpl/Public/images/bonn-center-icon_23.png
- f####.####.com/Wfulihezi/Tpl/Public/images/me.png
- f####.####.com/Wfulihezi/Tpl/Public/images/level5.png
- p####.####.com/2017/04/07/58e745fe4fd0c.png
- f####.####.com/Wfulihezi/Tpl/Public/css/animation.css
- f####.####.com/Wfulihezi/Tpl/Public/images/indexIcon1.png
- p####.####.com/2017/02/24/58afc7fac818e.png
- f####.####.com/Wfulihezi/Tpl/Public/images/sench_btn.png
- p####.####.com/2017/05/09/591129c78e8a5.gif
- p####.####.com/2016/10/15/58019d572e063.png
- f####.####.com/Wfulihezi/Tpl/Public/images/back.png
- f####.####.com/Wfulihezi/Tpl/Public/css/base.css
- f####.####.com/usergameh5.html?type=####&page=####
- f####.####.com/Wfulihezi/Tpl/Public/images/bonn-center-icon_05.png
- f####.####.com/usergameh5.html
- f####.####.com/
- f####.####.com/Wfulihezi/Tpl/Public/js/banner.js
- f####.####.com/Wfulihezi/Tpl/Public/images/boon-bj_19.png
- f####.####.com/Wfulihezi/Tpl/Public/css/style.css?t=####
- f####.####.com/Wfulihezi/Tpl/Public/images/indexIcon2.png
- f####.####.com/Wfulihezi/Tpl/Public/css/style.css
- f####.####.com/Wfulihezi/Tpl/Public/images/btm_home.png
- f####.####.com/index.php/index/userlogin
- f####.####.com/Wfulihezi/Tpl/Public/js/index.js
- f####.####.com/Wfulihezi/Tpl/Public/js/loadMore.js
- f####.####.com/Wfulihezi/Tpl/Public/images/indexIcon3.png
- h####.####.com/hm.js?b78b756####
- f####.####.com/Wfulihezi/Tpl/Public/js/swiper.min.js
- f####.####.com/Wfulihezi/Tpl/Public/images/duide.png
- p####.####.com/2016/08/22/57baa70fdbba9.png
- f####.####.com/Wfulihezi/Tpl/Public/images/boon-bj_03.png
- f####.####.com/Wfulihezi/Tpl/Public/images/bonn-center-icon_26.png
- f####.####.com/Wfulihezi/Tpl/Public/images/boon-bj_06.png
- f####.####.com/Wfulihezi/Tpl/Public/images/tk-img01.png
- f####.####.com/Wfulihezi/Tpl/Public/js/main.js
- f####.####.com/Wfulihezi/Tpl/Public/images/bonn-center-icon_20.png
- f####.####.com/Wfulihezi/Tpl/Public/images/logo.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
- p####.####.com/2017/03/14/58c7ad0b3cd96.png
- f####.####.com/Wfulihezi/Tpl/Public/images/bonn-center-icon_08.png
HTTP POST requests:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
