Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- 2####.####.214
- 2####.####.202
- imgc####.####.com
- zt-adfi####.####.com
- 1####.####.95:8088
- a####.####.cn
- o####.####.com
- p####.####.com
- 1####.####.179:8088
- 1####.####.123
- f####.####.com
- mobads-####.####.com
- i####.####.com:8088
- mo####.####.com
- a####.####.com
- qzones####.####.cn
HTTP GET requests:
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js-release/2017022...
- mo####.####.com/ads/css/min/main.css
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.appca...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- mo####.####.com/ads/index.htm
- imgc####.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his...
- mo####.####.com/ads/pa/8/__xadsdk__remote__8.35.jar
- zt-adfi####.####.com/1512/rt/gx.bin
- mo####.####.com/cpro/ui/mads.php?code2=####&b1492592599083=####
- 2####.####.214/action/miniad/ad?app_id=####&udid=####&imsi=####&net=####...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo...
- 1####.####.179:8088/v1/event/js?imei=####&imsi=####&android_id=####&scwh...
- mo####.####.com/ads/ads.appcache
- mo####.####.com/cpro/ui/mads.php?code2=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- mo####.####.com/ads/js/c.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-close....
- mo####.####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=##...
- mo####.####.com/cpro/ui/mads.php?code2=####&b=####
- a####.####.cn/jarFile/SDKAutoUpdate/bush.jar
- 2####.####.202/action/connect/active?app_id=####&udid=####&imsi=####&net...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- mo####.####.com/ads/js/ads.trunk.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/inter_close...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/popup_ad_ca...
- 2####.####.214/action/pop_ad/ad?app_id=####&udid=####&imsi=####&net=####...
- 1####.####.123/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&datat...
- f####.####.com/it/u=2792549463,2215338741&fm=76
- 1####.####.95:8088/v1/event/g?imei=####&net=####&carrier=####&odin=####&...
- mo####.####.com/ads/js/main.js
HTTP POST requests:
- a####.####.com/app_logs
- s####.####.com/err
- p####.####.com/api/q/a/3907f1092e70226c90275bf42603b8552
- mobads-####.####.com/brwhis.log
- a####.####.cn/action/user_info
- s####.####.com/cw/cp.action?requestId=####&g=####
- o####.####.com/check_config_update
- s####.####.com/activate
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- i####.####.com:8088/a/e
Modified file system:
Creates the following files:
- /sdcard/Android/data/cache/iconCache/CacheTime
- /sdcard/Android/data/cache/CacheTime.dat
- /data/data/####/app_e_qq_com_setting/gdt_suid
- /data/data/####/plib/libcrypt.so
- /sdcard/Android/data/cache/UnPackage.dat
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/GDTSDK.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/com.baidu.mobads.loader.xml
- /data/data/####/app_web_localdata/ApplicationCache.db-journal
- /data/data/####/files/CacheTime
- /sdcard/Download/46/4.2_bush.jar.tmp
- /data/data/####/files/.imprint
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/AppSettings.xml
- /data/data/####/cache/temp.jar
- /data/data/####/databases/GDTSDK.db
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.next.sig
- /data/data/####/cache/.engine.apk
- /data/data/####/shared_prefs/W_Key.xml.bak
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/databases/downloadswc
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/TDpref_shorttime.xml
- /data/data/####/shared_prefs/__xadsdk_downloaded__version__.xml
- /data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /sdcard/sys_nicholas.txt
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/files/mpush_version_preferences_file
- /data/data/####/shared_prefs/TDCloudSettingsConfig7E79A5F03C4965CE240EB9F20A6B0083.xml
- /data/data/####/shared_prefs/__x_adsdk_agent_header__.xml
- /data/data/####/shared_prefs/cwdata.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.tmp
- /data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__fc961551-8a13-4de3-a799-b993f8deaf26.jar
- /data/data/####/files/CacheTime.dat
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/TDtcagent.db
- /data/data/####/shared_prefs/tdg_share.xml
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.cfg
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/cache/.key.apk
- /data/data/####/shared_prefs/init_count.xml
- /sdcard/Android/data/.nomedia
- /sdcard/Android/data/cache/AppPackage.dat
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar.sig
- /sdcard/cw/assetstime.dat
- /sdcard/.tcookieid
- /data/data/####/shared_prefs/st.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar
- /data/data/####/app_e_qq_com_plugin/update_lc
- /data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__b740b15e-021d-4173-b541-d8760f9e3358.jar
- /data/data/####/cache/libloader.so
- /data/data/####/app_e_qq_com_setting/devCloudSetting.sig
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.sig
- /data/data/####/shared_prefs/android_pre.xml
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/TDpref_longtime.xml
- /data/data/####/shared_prefs/TDCloudSettingsConfig7E79A5F03C4965CE240EB9F20A6B0083.xml.bak
- /data/data/####/files/td.lock
- /data/data/####/app_e_qq_com_setting/devCloudSetting.cfg
- /data/data/####/files/tdlock.txt
- /data/data/####/shared_prefs/shell_pre.xml
- /data/data/####/shared_prefs/TDpref_longtime.xml.bak
- /data/data/####/databases/mpush_app.db-journal
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/shared_prefs/ShowAdFlag.xml
- /data/data/####/files/gxTmp/gx
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /sdcard/Android/data/.class/android
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/files/TDtcagent.db-journal
Miscellaneous:
Executes next shell scripts:
- su
- cat /proc/version
- cat /sys/class/net/wlan0/address
- spc -v
- chmod 777 /data/data/####/files/gxTmp/gx
- chmod 777 /data/data/####/files/gxTmp
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
