Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- mo####.####.com
- imgc####.####.com
- d####.####.cn
- h####.####.cn
- b####.####.cn
- m####.####.com
- a####.####.com
- qzones####.####.cn
HTTP GET requests:
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js-release/2017022...
- mo####.####.com/ads/css/min/main.css
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.appca...
- mo####.####.com/ads/js/ads.trunk.js
- mo####.####.com/ads/pa/__pasys_remote_banner.jar
- mo####.####.com/ads/index.htm
- imgc####.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his...
- mo####.####.com/cpro/ui/mads.php?code2=####&b1492592824141=####
- d####.####.cn/jarFile/SDKAutoUpdate/giantt.jar
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo...
- b####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- mo####.####.com/ads/ads.appcache
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/popup_ad_ca...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-close....
- mo####.####.com/ads/pa/__pasys.apk
- h####.####.cn/launchconfig?t=####&p=####
- mo####.####.com/ads/pa/__pasys.php
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/inter_close...
- mo####.####.com/ads/js/c.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- m####.####.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&datat...
- mo####.####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####&...
HTTP POST requests:
- s####.####.com/err
- a####.####.com/api/check_app_update
- d####.####.cn/msp.do
- a####.####.com/app_logs
- s####.####.com/activate
- b####.####.cn/cw/cp.action?requestId=####&g=####
Modified file system:
Creates the following files:
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.sig
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.cfg
- /data/data/####/app_e_qq_com_setting/gdt_suid
- /data/data/####/databases/downloadswc-journal
- /sdcard/dt/restime.dat
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_e_qq_com_plugin/update_lc
- /sdcard/Download/hou/4.5_giantt.jar.tmp
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/iflyworkdir_test
- /data/data/####/databases/GDTSDK.db-journal
- /data/data/####/databases/GDTSDK.db
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/app_database/ApplicationCache.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/ifly_launch_lib.xml.bak
- /data/data/####/files/__pasys_remote_banner.tmp.jar
- /data/data/####/shared_prefs/com.iflytek.msc.xml
- /data/data/####/files/.imprint
- /sdcard/msc/user.perf
- /data/data/####/shared_prefs/a.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar.sig
- /data/data/####/shared_prefs/__sdk_pasys_pkgs.xml
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/files/__pasys_remote_banner.jar.beforesign
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.tmp
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/__pasys.apk.beforesign
- /data/data/####/shared_prefs/st.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/shared_prefs/ifly_launch_lib.xml
- /data/data/####/cache/webviewCacheChromium/f_000002
- /sdcard/msc/55691c296e977bcc18b82c78c9fb6277/urec.data
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/umeng_it.cache
- /sdcard/msc/55691c296e977bcc18b82c78c9fb6277/u.data
- /data/data/####/app_database/localstorage/http_mobads.baidu.com_0.localstorage-journal
- /data/data/####/shared_prefs/__sdk_pasys_pkgurls.xml
- /data/data/####/app_e_qq_com_setting/devCloudSetting.cfg
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- /data/data/####/app_e_qq_com_setting/devCloudSetting.sig
- /data/data/####/databases/downloadswc
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
