Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- 2####.####.32
- 2####.####.35
- downloa####.####.net
- e####.####.cn
- m####.####.com
- m####.####.com:8757
- s####.net
HTTP GET requests:
- 2####.####.32/downloadfile.pandaad.net/resource/tempapp/softTest.apk?wsi...
- 2####.####.35/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/lvs.jar?wsiphost...
- downloa####.####.net/resource/tempapp/softTest.apk
- m####.####.com/sdk-core-v40.js
- m####.####.com/sdk.html
HTTP POST requests:
- e####.####.cn/cw/cp.action?requestId=####&g=####
- m####.####.com:8757/sdk.html
- s####.net/Mini/niouy.action?key=####
Modified file system:
Creates the following files:
- <Package Folder>/app_qdceyko/<Package>.apk
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/st.xml
- <SD-Card>/Download/####/4.6_lvs.jar.t
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- <dexopt>
