Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.78.origin
Downloads the following detected threats from the Web:
- Android.Xiny.78.origin
Modified file system:
Creates the following files:
- <Package Folder>/app_widata/wi_common
- <Package Folder>/app_widata/wi_pay
- <Package Folder>/app_widata/wiconfig.xml
- <Package Folder>/databases/aoi.db-journal
- <Package Folder>/files/tcom
- <Package Folder>/files/tianfkfhkgjfhkfj
- <Package Folder>/files/tianfkfhkgjfhkfj.jar
- <Package Folder>/files/wtianfkfhkgjfhkfj.jar
- <Package Folder>/shared_prefs/aoe_setting.xml
- <Package Folder>/shared_prefs/dsp_sh.xml
- <Package Folder>/shared_prefs/pt_cfg_ps.xml
- <Package Folder>/shared_prefs/ptf_gvzy.xml
- <SD-Card>/.AOE/.300008365932.log
- <SD-Card>/.AOE/.report_log_index.txt
- <SD-Card>/.AOE/AOELog.txt
- <SD-Card>/Android/####/<Package>.ls
- <SD-Card>/InAppBillingLibrary/log
Miscellaneous:
Executes next shell scripts:
- <dexopt>
