Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.84.origin
Downloads the following detected threats from the Web:
- Android.Xiny.84.origin
Network activity:
Connecting to:
- 2####.####.197
- a####.####.cn
- a####.####.com
- a####.####.net
- o####.####.com
- r####.####.net
- s####.####.net
- t####.####.net
HTTP GET requests:
- 2####.####.197/action/connect/active?app_id=####&udid=####&imsi=####&net...
- a####.####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=...
- a####.####.net/v3/zip_upd?s=####
- r####.####.net/spot/aos/v2/reqv3?s=####
- s####.####.net/aos/v3/pns?s=####
- s####.####.net/stat/aos/v3/init?s=####
HTTP POST requests:
- a####.####.com/a/aow/update?msg=####
- a####.####.com/app_logs
- o####.####.com/check_config_update
- t####.####.net/v1/android/packages?rt=####&sign=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/1d4fbaea0a204393447787fdb98c3a62
- <Package Folder>/databases/1d4fbaea0a204393447787fdb98c3a62-journal
- <Package Folder>/databases/6b1d4d4915ee0f5b5244dd22b4bec883
- <Package Folder>/databases/6b1d4d4915ee0f5b5244dd22b4bec883-journal
- <Package Folder>/databases/OxgHkj2lz09F-journal
- <Package Folder>/databases/P15pKIjsm64m
- <Package Folder>/databases/P15pKIjsm64m-journal
- <Package Folder>/databases/T1oX0rhhuXWt
- <Package Folder>/databases/T1oX0rhhuXWt-journal
- <Package Folder>/databases/XKwVoK0huy3R
- <Package Folder>/databases/XKwVoK0huy3R-journal
- <Package Folder>/databases/e6c0df84b646b5b448a206dbbeaf53b2-journal
- <Package Folder>/databases/jqIqJYOT3JpT
- <Package Folder>/databases/jqIqJYOT3JpT-journal
- <Package Folder>/databases/wIU6pTyUBYWX
- <Package Folder>/databases/wIU6pTyUBYWX-journal
- <Package Folder>/databases/wsUL1uCdKvjD
- <Package Folder>/databases/wsUL1uCdKvjD-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/.jiagu.ls
- <Package Folder>/files/CacheTime.dat
- <Package Folder>/files/libjiagu.so
- <Package Folder>/files/libmetopqqzze.so
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/64e8404501430d07935d4e82e9ef26a6.xml
- <Package Folder>/shared_prefs/AppSettings.xml
- <Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- <Package Folder>/shared_prefs/OFFERSCONFIG1.xml
- <Package Folder>/shared_prefs/PaySettings.xml
- <Package Folder>/shared_prefs/ShowAdFlag.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/preference_daow.xml
- <Package Folder>/shared_prefs/preferences.xml
- <Package Folder>/shared_prefs/preferences.xml.bak
- <Package Folder>/shared_prefs/spotData.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Android/####/AppPackage.dat
- <SD-Card>/Android/####/CacheTime.dat
- <SD-Card>/Android/####/UnPackage.dat
- <SD-Card>/Android/####/android
- <SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
- <SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
Miscellaneous:
Uses special library to hide executable bytecode.
