Android.DownLoader.2554

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

s####.####.com
2####.####.197
d####.####.cn
a####.####.cn
a####.####.com

HTTP GET requests:

2####.####.197/action/account/award?app_id=####&udid=####&imsi=####&net=...
2####.####.197/action/connect/active?app_id=####&udid=####&imsi=####&net...
2####.####.197/action/account/getinfo?app_id=####&udid=####&imsi=####&ne...
d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar

HTTP POST requests:

a####.####.cn/action/user_info
a####.####.com/app_logs
s####.####.com/cw/cp.action?requestId=####&g=####
s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####

Modified file system:

Creates the following files:

<Package Folder>/shared_prefs/qiandao_flag.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/admob.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/files/.imprint
<Package Folder>/files/CacheTime.dat
<Package Folder>/databases/GuessStarFace-journal
<Package Folder>/cache/ads-1912817548.jar
<Package Folder>/databases/GuessStarFace
<Package Folder>/shared_prefs/AppSettings.xml.bak
<Package Folder>/shared_prefs/a.xml
<Package Folder>/databases/downloadswc-journal
<Package Folder>/shared_prefs/AppSettings.xml
<Package Folder>/cache/webviewCacheChromium/index
<Package Folder>/cache/webviewCacheChromium/f_000001
<Package Folder>/cache/webviewCacheChromium/f_000003
<Package Folder>/cache/webviewCacheChromium/f_000002
<Package Folder>/cache/webviewCacheChromium/f_000004
<Package Folder>/shared_prefs/ShowAdFlag.xml
<Package Folder>/databases/downloadswc
<Package Folder>/shared_prefs/st.xml
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/save_open_jifen.xml
<Package Folder>/shared_prefs/qiandao_flag.xml.bak
<Package Folder>/databases/webview.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/cache/webviewCacheChromium/data_3
<Package Folder>/cache/webviewCacheChromium/data_2
<Package Folder>/cache/webviewCacheChromium/data_1
<Package Folder>/cache/webviewCacheChromium/data_0