Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- a####.####.com
- d####.####.cn
- ma####.####.com
- s####.####.com
HTTP GET requests:
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- d####.####.cn/upload/2017/06/13/7yw_qyc320x124_BBC3_6323.jpg
- ma####.####.com/AppList.aspx?ClassId=####&Login=####&Sort=####&SdkVersio...
HTTP POST requests:
- a####.####.com/api/check_app_update
- s####.####.com/cw/cp.action?requestId=####&g=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/quyou.db-journal
- <Package Folder>/files/mobclick_agent_cached_<Package>321
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/quyou.pre.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.xy
- <SD-Card>/7yw/####/-1075365973
- <SD-Card>/7yw/####/-1122749911
- <SD-Card>/7yw/####/-1149289396
- <SD-Card>/7yw/####/-124909038
- <SD-Card>/7yw/####/-1291984573
- <SD-Card>/7yw/####/-1364518007
- <SD-Card>/7yw/####/-1431337493
- <SD-Card>/7yw/####/-1433988828
- <SD-Card>/7yw/####/-1503470662
- <SD-Card>/7yw/####/-1529752437
- <SD-Card>/7yw/####/-1547739177
- <SD-Card>/7yw/####/-1603564171
- <SD-Card>/7yw/####/-1726167159
- <SD-Card>/7yw/####/-1739115011
- <SD-Card>/7yw/####/-1894966549
- <SD-Card>/7yw/####/-1930989025
- <SD-Card>/7yw/####/-2035384124
- <SD-Card>/7yw/####/-212505104
- <SD-Card>/7yw/####/-235527259
- <SD-Card>/7yw/####/-356848759
- <SD-Card>/7yw/####/-376983168
- <SD-Card>/7yw/####/-57624188
- <SD-Card>/7yw/####/-874775186
- <SD-Card>/7yw/####/-882478870
- <SD-Card>/7yw/####/-922323806
- <SD-Card>/7yw/####/-934822515
- <SD-Card>/7yw/####/-965397912
- <SD-Card>/7yw/####/1005011858
- <SD-Card>/7yw/####/1264784754
- <SD-Card>/7yw/####/1399148939
- <SD-Card>/7yw/####/1487330762
- <SD-Card>/7yw/####/1554971572
- <SD-Card>/7yw/####/1724997122
- <SD-Card>/7yw/####/1938473770
- <SD-Card>/7yw/####/2106458689
- <SD-Card>/7yw/####/2136510153
- <SD-Card>/7yw/####/2143767539
- <SD-Card>/7yw/####/260344525
- <SD-Card>/7yw/####/269116328
- <SD-Card>/7yw/####/350775782
- <SD-Card>/7yw/####/535914265
- <SD-Card>/7yw/####/636727563
- <SD-Card>/7yw/####/662535217
- <SD-Card>/7yw/####/776484075
- <SD-Card>/7yw/####/879844184
- <SD-Card>/Download/####/4.3_hyjwan.jar.tmp
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- <dexopt>
