Android.DownLoader.2800

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

d####.####.cn
y####.####.cn

HTTP GET requests:

d####.####.cn/jarFile/SDKAutoUpdate/wet4.jar

HTTP POST requests:

y####.####.cn/k2?protocol=####&version=####&cid=####

Modified file system:

Creates the following files:

<Package Folder>/databases/downloadswc
<Package Folder>/databases/downloadswc-journal
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/592E656B0349-0001-083D-94F48FE198F4BeginSession.cls_temp
<Package Folder>/files/####/592E656B0349-0001-083D-94F48FE198F4SessionApp.cls_temp
<Package Folder>/files/####/592E656B0349-0001-083D-94F48FE198F4SessionDevice.cls_temp
<Package Folder>/files/####/592E656B0349-0001-083D-94F48FE198F4SessionOS.cls_temp
<Package Folder>/files/####/com.crashlytics.settings.json
<Package Folder>/files/####/initialization_marker
<Package Folder>/files/####/sa_4a9688a5-3c66-4f96-ab85-4d53fe58d401_1496212845593.tap
<Package Folder>/files/####/session_analytics.tap
<Package Folder>/files/####/session_analytics.tap (deleted)
<Package Folder>/files/####/session_analytics.tap.tmp
<Package Folder>/files/AppEventsLogger.persistedsessioninfo
<Package Folder>/files/gaClientId
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/Global.xml
<Package Folder>/shared_prefs/SevenMinsABS.xml
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/shared_prefs/a.xml
<Package Folder>/shared_prefs/a.xml.bak
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
<Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
<Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
<Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
<Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
<Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.m.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/st.xml
<Package Folder>/shared_prefs/thirtyDayFit_instance.xml
<Package Folder>/shared_prefs/thirtyDayFit_instance.xml.bak
<SD-Card>/Download/####/4.8_wet4.jar.tmp
<SD-Card>/dt/restime.dat