Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- c####.####.com
- s####.####.com
- d####.####.cn
- u####.####.com
HTTP GET requests:
- u####.####.com/cleanmaster_lite//controller/config/app.ini
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- u####.####.com/cleanmaster_lite//controller/config/promotion.ini
- u####.####.com/cleanmaster_lite/controller/config//main_cfg.ini
- c####.####.com/api/GetCloudMsgEx?phonelanguage=####&cmlanguage=####&mcc=...
- u####.####.com/cleanmaster_lite//controller/CloudCfg.php?phonelanguage=#...
- u####.####.com/cleanmaster_lite//controller/config/switch.ini
- u####.####.com/cleanmaster_lite//controller/config/junk.ini
- u####.####.com/cleanmaster_lite//controller/config/gp_rate.ini
- u####.####.com/cleanmaster_lite_cn/getversions.php?phonelanguage=####&cm...
- u####.####.com/cleanmaster_lite//controller/config/rootguidetxt.ini
- u####.####.com/cleanmaster_lite//controller/config/task.ini
HTTP POST requests:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Modified file system:
Creates the following files:
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856228.ich
- <Package Folder>/shared_prefs/<Package>.update.UpdateManager.xml.bak
- <Package Folder>/files/infoc_1/cmlite_act_unknown_1495005901229.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856201.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856346.ich
- <Package Folder>/databases/temp_collect.db-journal
- <Package Folder>/databases/diskcache.db-journal
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855216.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856263.ich
- <Package Folder>/files/appcpu2_hf_en.db.bak
- <Package Folder>/app_files/cloud_config/junk.new
- <Package Folder>/app_files/cloud_config/task.new
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856365.ich
- <Package Folder>/files/kfmt.dat
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856287.ich
- <Package Folder>/files/infoc_1/cmlite_standby_dataindoor_1495005854079.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856363.ich
- <Package Folder>/updatedata/versions_get.dwn
- <Package Folder>/databases/downloadswc
- <Package Folder>/files/infoc_1/cmlite_standby_enumerror_1495005855116.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855234.ich
- <Package Folder>/shared_prefs/misc.xml
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855179.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855182.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855169.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855153.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855188.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855226.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856301.ich
- <Package Folder>/files/infoc_1/cmlite_boost_device_1495005856390.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856292.ich
- <Package Folder>/app_files/cloud_config/main_cfg.new
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855145.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856256.ich
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855172.ich
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/files/appcpu2_hf_en.db.lzma
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855203.ich
- <Package Folder>/databases/cleanmaster_process_list.db-journal
- <Package Folder>/app_files/cloud_config/rootguidetxt.new
- <Package Folder>/app_files/cloud_config/promotion.new
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855231.ich
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/misc.xml.bak
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856235.ich
- <Package Folder>/app_files/cloud_config/switch.new
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856170.ich
- <Package Folder>/updatedata/cloud_string_res_2.dwn
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855170.ich
- <Package Folder>/files/infoc_1/cmlite_standby_enumerror_1495005855125.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855175.ich
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856386.ich
- <Package Folder>/shared_prefs/cleancloud_pref.xml
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856377.ich
- <Package Folder>/files/infoc_1/cmlite_main_click_1495005856567.ich
- <Package Folder>/updatedata/ips_versions.dwn
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856387.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856197.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855220.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855185.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856199.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855191.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855149.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855228.ich
- <Package Folder>/app_files/cloud_config/app.new
- <Package Folder>/files/kctrl.dat
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855135.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855155.ich
- <Package Folder>/bspatch
- <Package Folder>/shared_prefs/<Package>_ui_preferences.xml
- <Package Folder>/files/infoc_1/cmlite_hardware_status_1495005858711.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855187.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856232.ich
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856336.ich
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/infoc_1/cmlite_standby_query_1495005856125.ich
- <Package Folder>/updatedata/cloud_string_res_2.dwn.default
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855167.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856230.ich
- <Package Folder>/app_files/cloud_config/gp_rate.new
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855222.ich
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/infoc_1/cmlite_act_unknown_1495005856632.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855164.ich
- <Package Folder>/files/AppEventsLogger.persistedsessioninfo
- <Package Folder>/shared_prefs/<Package>.update.UpdateManager.xml
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855235.ich
- <Package Folder>/updatedata/ips_versions_cn.dwn
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
