Android.DownLoader.2462

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

s####.####.com
d####.####.cn
o####.####.com
p####.####.com
n####.####.com:16020
a####.####.com

HTTP GET requests:

n####.####.com:16020/api/com.sasdffg.vcvfrth/anzhi/0/2.2.1
d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar

HTTP POST requests:

o####.####.com/v2/get_update_time
s####.####.com/cw/cp.action?requestId=####&g=####
o####.####.com/v2/check_config_update
s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
a####.####.com/app_logs
p####.####.com/api/q/a/3e47ba4d845b8456f45d1d4bbc191ac29

Modified file system:

Creates the following files:

<Package Folder>/shared_prefs/TDCloudSettingsConfig61D60A5BF46AB8752886FE618ADDD377.xml.bak
<Package Folder>/files/tdlock.txt
<Package Folder>/shared_prefs/TDpref_shorttime.xml.bak
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/databases/mpush_app.db-journal
<Package Folder>/files/.imprint
<Package Folder>/files/TDtcagent.db
<Package Folder>/shared_prefs/umeng_feedback_user_info.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/icon_mark_info.xml
<Package Folder>/files/td.lock
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/files/TDtcagent.db-journal
<Package Folder>/shared_prefs/a.xml
<Package Folder>/files/.umeng/exchangeIdentity.json
<Package Folder>/shared_prefs/W_Key.xml.bak
<Package Folder>/databases/downloadswc-journal
<Package Folder>/shared_prefs/config.xml
<Package Folder>/files/download.db-journal
<Package Folder>/shared_prefs/version_compat.xml
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/shared_prefs/onlineconfig_agent_online_setting_<Package>.xml
<Package Folder>/databases/downloadswc
<Package Folder>/shared_prefs/st.xml
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/icon_build_events.xml
<Package Folder>/files/download.db
<Package Folder>/shared_prefs/TDpref_longtime.xml.bak
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/shared_prefs/TDCloudSettingsConfig61D60A5BF46AB8752886FE618ADDD377.xml
<Package Folder>/files/mobclick_agent_cached_<Package>12
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/umeng_feedback_conversations.xml