Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- statis####.####.com
- d####.####.cn
- o####.####.com
- ser####.####.com
- a####.####.com
HTTP GET requests:
- ser####.####.com/res/ipingke/upload/theme/1404805387648..jpg
- ser####.####.com/res/ipingke/upload/theme/1431420656659..jpg
- ser####.####.com/adsw/pk_adsw.html
- ser####.####.com/res/ipingke/upload/theme/1423812785468..jpg
- ser####.####.com/res/ipingke/upload/theme/1438591102514..jpg
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- ser####.####.com/res/ipingke/upload/theme/1407230885988..jpg
- ser####.####.com/res/ipingke/upload/theme/1395820163936pk_mmmm1.jpg
- ser####.####.com/res/ipingke/upload/theme/1410923442135..jpg
- ser####.####.com/res/ipingke/upload/theme/1421138392471..jpg
- ser####.####.com/res/ipingke/upload/theme/1428048276179..jpg
- ser####.####.com/res/ipingke/upload/theme/1432800542030..jpg
- ser####.####.com/res/ipingke/upload/theme/1421979137238..jpg
- ser####.####.com/res/ipingke/upload/theme/1429079564019..jpg
- ser####.####.com/res/ipingke/upload/theme/1435226469993..jpg
- ser####.####.com/res/ipingke/upload/theme/1416380156821..jpg
- ser####.####.com/res/ipingke/upload/theme/1411456749668..jpg
- ser####.####.com/res/ipingke/upload/theme/1428632158339..jpg
- ser####.####.com/res/ipingke/upload/theme/1434102303743..jpg
- ser####.####.com/res/ipingke/upload/theme/1412250476755..jpg
HTTP POST requests:
- a####.####.com/app_logs
- ser####.####.com/doc/service/down/get_loading_config.json
- statis####.####.com/statistics/config.json
- ser####.####.com/doc/service/up/init.json
- ser####.####.com/doc/service/down/advertInfo.json
- ser####.####.com/doc/service/down/notify.json
- statis####.####.com/statistics/init.json
- ser####.####.com/doc/service/down/image_type_list.json
- ser####.####.com/doc/service/down/lazy_suit_list.json
- statis####.####.com/statistics/oprdetail.json
- s####.####.com/cw/cp.action?requestId=####&g=####
- statis####.####.com/statistics/event.json
- o####.####.com/check_config_update
- ser####.####.com/doc/service/down/unlock_image_type.json
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- ser####.####.com/doc/service/down/loading_page.json
- ser####.####.com/doc/service/down/user_info.json
- ser####.####.com/doc/service/down/theme_classify_list.json
- ser####.####.com/doc/service/down/audit.json
- statis####.####.com/statistics/pv_uv.json
- ser####.####.com/doc/service/down/theme_list_new.json
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/databases/call_desk.db-journal
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/call_config.xml.bak
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/call_config.xml
- <Package Folder>/shared_prefs/period_time.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/syezon_agent_online_setting_<Package>.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/shared_prefs/syezon_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
