Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.84.origin
Downloads the following detected threats from the Web:
- Android.Xiny.84.origin
Network activity:
Connecting to:
- 1####.####.143
- a####.####.com
- de####.####.com
- equity####.####.com
- fan####.com
- frag####.####.com
- g####.####.com
- i####.####.com
- l####.####.com
- pco####.####.com
- sdk####.####.com
- st####.####.com
- w####.####.com
- y####.####.com
HTTP GET requests:
- 1####.####.143/d?host=####
- a####.####.com/t/font_16yfayjuq6c4n29.ttf
- de####.####.com/item.htm?id=####&ttid=####&umpChannel=####&u_channel=###...
- equity####.####.com/liuliangbao/track.do?wfType=####&wfCode=####&time=##...
- frag####.####.com/seller/detailbatsampling?wh_callback=####
- g####.####.com/??kissy/####
- g####.####.com/mtmalldetail.1.97?itemid=####&catid=####¶m=####&14962...
- g####.####.com/tps/TB1zfhvNXXXXXcPXVXXXXXXXXXX-142-40.png
- i####.####.com/imgextra/i1/TB1oDmaQVXXXXcRXpXXYXGcGpXX_M2.SS2_200x200q90...
- l####.####.com/m.gif?logtype=####&title=####&cache=####&scr=####&isbeta=...
- l####.####.com/oauth_native.htm?appKey=####&ttid=####
- pco####.####.com/app.gif?&cna=####
- sdk####.####.com/sdkConfigVersion.htm?platformName=####&sdkVersion=####
- st####.####.com/images/app/resource/icon_6.png?v=####
- w####.####.com/alihybrid.hybrid.call?cache=####&gmkey=####&gokey=####&cn...
- y####.####.com/m/um.htm?c=####
HTTP POST requests:
- a####.####.com/app_logs
- a####.####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&sv=#...
- fan####.com/?ct=####&ac=####
- g####.####.com/g2
- w####.####.com/api/update.do
Modified file system:
Creates the following files:
- <Package Folder>/app_alisdk_plugin_list/1496215273412.pluginlist
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/xm4399CB.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/.jiagu.ls
- <Package Folder>/files/0a231bd8575dcf72.txt
- <Package Folder>/files/1d77ea041509fe06.lock
- <Package Folder>/files/49814c4f5ac2f2f9.lock
- <Package Folder>/files/libjiagu.so
- <Package Folder>/files/libsecuritysdkx-3.1.27.so
- <Package Folder>/files/mobclick_agent_cached_<Package>16
- <Package Folder>/files/sp.lock
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/ALIBABA_SDK_DYNAMIC_CONFIG.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/SGMANAGER_DATA.xml
- <Package Folder>/shared_prefs/SGMANAGER_DATA.xml.bak
- <Package Folder>/shared_prefs/UTCommon.xml
- <Package Folder>/shared_prefs/UTMCConf-1426728695.xml
- <Package Folder>/shared_prefs/UTMCConf-314808628.xml
- <Package Folder>/shared_prefs/UTMCLog-1426728695.xml
- <Package Folder>/shared_prefs/UTMCLog-314808628.xml
- <Package Folder>/shared_prefs/imei.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/onesdk_device.xml
- <Package Folder>/shared_prefs/onesdk_hotpatch.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
- <SD-Card>/.com.taobao.dp/dd7893586a493dc3
- <SD-Card>/.com.taobao.dp/hid.dat
- <SD-Card>/<Package>/asdklog_a
- <SD-Card>/<Package>/asdklog_s
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/19rov81yhwurq9q0t4wtylsy5
- <SD-Card>/Android/####/1gt2xzg83oel5dawhb6lrn3nl
- <SD-Card>/Android/####/1yuw81vhwd8dfbq9s50wpzboz.tmp
- <SD-Card>/Android/####/2q6thnlpshrj8x8kyyt3xuccw
- <SD-Card>/Android/####/4jr50d4aj685p0ivogkn7y27f.tmp
- <SD-Card>/Android/####/4omt7neoo2hlq608ep6j28yqj.tmp
- <SD-Card>/Android/####/4yiaalc3igcnkur832843z85s.tmp
- <SD-Card>/Android/####/67mq5pk4uaqc9qyyzfw277bte.tmp
- <SD-Card>/Android/####/6gxsoevlkdt62lk2t8whuhdxq.tmp
- <SD-Card>/Android/####/eqvop3um488lyan2h9o8ch9y.tmp
Miscellaneous:
Executes next shell scripts:
- cat /proc/cpuinfo | grep Serial
- getprop ro.product.cpu.abi
- ls -l /system/xbin/su
Uses special library to hide executable bytecode.
