Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- ap####.####.com
- resse####.####.cn:8080
- resse####.####.cn
- i####.####.com
- to####.####.com
- pin####.####.com
- d####.####.cn
- updchec####.####.cn
- s####.####.cn
- and####.####.com
- usdp####.####.com
- a####.####.cn
- 1####.####.129:8080
- du####.####.com
- 2####.####.129:8080
- m####.####.com
- updchec####.####.cn:8080
- o####.####.cn
- a####.####.com
- b####.####.com
HTTP GET requests:
- a####.####.com/open/soft/downlink?id=####
- i####.####.com/2016/9/21/KDEwNngp/5bed75d9-d006-4439-bde3-4f93749f0ac1.jpg
- i####.####.com/2016/9/22/7ad9c5c2-a17f-461c-a5b6-83bf2cf548bb.png
- i####.####.com/2016/2/19/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/11f5d...
- i####.####.com/2015/11/24/d6f522e2-4a5b-4abe-a1ed-469bc38d14da.png
- a####.####.cn/103531-13291-1489573607.apk
- i####.####.com/2016/8/17/45109256-11b7-4609-af61-06e7ebbeb51b.gif
- i####.####.com/2016/2/19/10ce920d-95d8-414e-ab6c-43904091697d.png
- a####.####.com/open/soft/details.json?ver=####&id=####
- i####.####.com/2016/1/5/b167be8a-0b10-4e49-8353-73f853d58691.jpg
- a####.####.com/open/soft/list.json?type=####&page=####
- i####.####.com/2016/11/18/9eff6dbc-3e6c-4214-8699-288ecdb01a08.png
- i####.####.com/2016/9/23/962f811b-5cac-4525-8f09-029d3f1c6c59.jpg
- du####.####.com/game/?pageid=####&p_tag=####
- i####.####.com/2016/4/27/c4a0ae72-d3e0-4e51-953e-87adfdf5c55a.png
- i####.####.com/2015/6/23/17a8ccb6-6723-48f7-8ac4-a3313f65a5a0.jpg
- usdp####.####.com/sdk_server/sdk_ng_plugin_utils_271581825_1493735815301...
- i####.####.com/2016/4/27/a3b4b8be-5dd7-4a63-bd27-9f78cf79ee82.png
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- i####.####.com/2014/3/24/0920c01a-821b-4f2b-807e-f4a676fd175a.png
- i####.####.com/2015/8/19/f7c4455b-0924-453a-a712-abb1eca5984f.png
- i####.####.com/2016/12/22/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/049e...
- b####.####.com/gg/update.json
- i####.####.com/2016/12/22/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/0e32...
- ap####.####.com/game/252000/252881/20170512205035_oem_5006902.apk?r=####
- i####.####.com/2016/9/23/fa69c9f0-709d-4b88-94cb-2675c119a7a3.jpg
- i####.####.com/2016/2/19/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/659e5...
- i####.####.com/2016/7/6/445d4af1-7269-459b-be01-14433b4b784c.jpg
- i####.####.com/2016/3/18/92485450-3695-4c47-8dfb-6da05964d2cc.jpg
- pin####.####.com/ping.ashx/new.js?key=####&sid=####&pageSize=####&setpag...
- i####.####.com/2016/9/21/KDEwNngp/09f7cd93-8ee3-4993-90bd-03266cdf6344.jpg
- i####.####.com/2014/10/1/446dbdac-230d-487a-ab27-3994b486c077.jpg
- i####.####.com/2016/4/22/230d7f96-c254-401e-9aad-1989510dde11.jpg
- a####.####.com/open/azboxmessage.json?
- usdp####.####.com/sdk_server/sdk_ng_plugin_loader_170918529_149373581530...
- i####.####.com/2016/3/31/80ce6d62-f8fe-4f46-9fa6-ff481457aa14.png
- i####.####.com/2015/12/10/0afe72f3-3fce-4abd-a928-d65144e4da28.jpg
- a####.####.com/open/soft/down?ver=####&id=####
- i####.####.com/2016/9/23/fbe16bc7-998c-4d4e-8eba-27bc1930d2e4.png
- a####.####.com/open/soft/list.json?ver=####&type=####&page=####
- i####.####.com/2016/2/19/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/2b81c...
- a####.####.com/open/block/box_home_scroll.json?
- i####.####.com/2015/9/8/85ac4c7e-17e8-49f8-95ff-8c218dd103fc.jpg
- i####.####.com/2016/9/23/KDEwNngp/90d2356f-847a-4160-a8dc-af720b76c216.jpg
- a####.####.com/open/soft/list.json?ver=####&type=####
- i####.####.com/2016/12/22/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/857b...
- usdp####.####.com/sdk_server/sdk_ng_plugin_lib_137364097_1493735815301.apk
- i####.####.com/2016/9/21/28ebcbaa-8ea8-41d9-8784-d648727eb443.jpg
- i####.####.com/2016/12/22/c609c4f6-6250-4b94-bcad-9ca6412f9e69.gif
- i####.####.com/2016/9/23/KDEwNngp/962f811b-5cac-4525-8f09-029d3f1c6c59.jpg
- i####.####.com/2015/12/8/be3df467-253c-46dc-809b-82f29154767e.jpg
- i####.####.com/2016/9/23/KDEwNngp/fa69c9f0-709d-4b88-94cb-2675c119a7a3.jpg
- i####.####.com/2016/12/22/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/4ea2...
- a####.####.com/open/gg/message.json?
- i####.####.com/2016/4/5/1926c0ce-eae9-4182-9aa2-d094f941964f.png
- to####.####.com/count?key=####&sourceid=####&name=####
- usdp####.####.com/sdk_server/sdk_ng_plugin_update_238027393_149373581530...
- i####.####.com/2016/9/23/KDEwNngp/9914c3fc-f4c8-411a-b32b-3755270e815a.jpg
- i####.####.com/2016/9/21/KDEwNngp/4d8364fb-fa5f-4368-b8eb-c3946089cd10.jpg
- i####.####.com/2016/2/19/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/04789...
- i####.####.com/2016/9/21/KDEwNngp/23cb5ec8-3541-4d4e-b6bb-b231bbe53ec5.jpg
- i####.####.com/2015/7/15/7ce54422-aaa2-407d-8488-63d9c8c57f82.jpg
- i####.####.com/2016/2/19/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/14268...
- i####.####.com/2016/4/22/42ddd0f0-f180-489a-8a5e-6938075b097f.png
- i####.####.com/2015/12/21/989c891e-8e23-4e7e-9e76-31b71a4d4b1e.gif
- i####.####.com/2016/4/11/9e9a5056-c279-4ede-bc75-418ea9a93b3a.jpg
- m####.####.com/start.php?openudid=####&networking=####&os=####&model=###...
- d####.####.cn/andl/dda.php?appid=####&cid=####&t=####
- i####.####.com/2016/9/23/9914c3fc-f4c8-411a-b32b-3755270e815a.jpg
- i####.####.com/2016/12/22/W3dtOndtcmIyLnBuZyxyOjAsYjowXQ==/KDEwNngp/e108...
- usdp####.####.com/sdk_server/sdk_ng_plugin_log_204472961_1493735815301.apk
- i####.####.com/2016/9/23/KDEwNngp/8eeab3f4-5a3a-463d-920f-6e74aa8df438.jpg
- i####.####.com/2016/9/23/90d2356f-847a-4160-a8dc-af720b76c216.jpg
- a####.####.com/ad.ashx/azboxmessage.json?
HTTP POST requests:
- s####.####.cn/ng/mcs/mcs.combine?ver=####&df=####&cver=####&os=####
- updchec####.####.cn:8080/client/rescond.check?df=####
- s####.####.cn/ng/client/system.getGameChConfig?ver=####&df=####&cver=###...
- resse####.####.cn/client/res.pkginfo.get?df=####
- d####.####.cn/xxdatareport.php?platform=####&appid=####
- s####.####.cn/ng/client/system.getSecurityKey?ver=####&df=####&cver=####...
- a####.####.cn/act/client/client.event.report?df=####&ver=####&fr=####&cv...
- s####.####.cn/ng/client/system.configByKey?ver=####&df=####&cver=####&os...
- updchec####.####.cn/client/rescond.check?df=####
- 2####.####.129:8080/httpdns/request
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
- resse####.####.cn/client/pack.plugin.get?df=####
- s####.####.cn/ng/client/log.collect.sdklog?ver=####&df=####&cver=####&os...
- 1####.####.129:8080/httpdns/request
- resse####.####.cn:8080/client/res.msgtempl.get?df=####
- and####.####.com/rqd/async?aid=####
- o####.####.cn/gamesdk/init/103531
Miscellaneous:
Contains functionality to send SMS messages automatically.
