Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- 61er####.com
- d####.####.cn
- d####.####.com
- e####.####.cn
- h####.####.cn
- i####.####.com
- m####.####.com
- m####.####.com:8757
HTTP GET requests:
- 61er####.com/wenxue/minjiangushi/20170227/266387.html
- d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
- h####.####.cn/launchconfig?t=####&p=aGlod####
- i####.####.com/allimg/170227/149516-1F22G5592a47.jpg
- m####.####.com/sdk.html
HTTP POST requests:
- d####.####.cn/index.php/clientrequest/clientcollect/isCollect
- d####.####.com/mmsdk/mmsdk?func=####&appkey=####&channel=####&code=####
- e####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- m####.####.com:8757/sdk.html
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/61cde2f8f4250e4cadef40a0e3abf54f
- <Package Folder>/cache/####/avoscloud-analysis
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/evnlxd0
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/AVOSCloud-SDK.xml
- <Package Folder>/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/com.avos.avoscloud.RequestStatisticsUtil.data.xml
- <Package Folder>/shared_prefs/com.avos.avoscloud.analysis.xml
- <Package Folder>/shared_prefs/com.iflytek.id.xml
- <Package Folder>/shared_prefs/ifly_launch_lib.xml
- <Package Folder>/shared_prefs/iflytek_state_<Package>.xml
- <Package Folder>/shared_prefs/lxdMoblieAgent_config_<Package>.xml
- <Package Folder>/shared_prefs/lxdMoblieAgent_event_<Package>.xml
- <Package Folder>/shared_prefs/lxdMoblieAgent_sys_config.xml
- <Package Folder>/shared_prefs/lxdMoblieAgent_sys_config.xml.bak
- <Package Folder>/shared_prefs/lxdMoblieAgent_upload_<Package>.xml
- <Package Folder>/shared_prefs/lxdMoblieAgent_upload_<Package>.xml.bak
- <Package Folder>/shared_prefs/pw.hais.util.xml
- <Package Folder>/shared_prefs/st.xml
- <SD-Card>/Android/####/img.61gequ.comallimg170227149516-1F22G5560EP.jpg
- <SD-Card>/Android/####/img.61gequ.comallimg170227149516-1F22G5592a47.jpg
- <SD-Card>/Download/####/4.6_lvs.jar.tmp
- <SD-Card>/dt/restime.dat
- <SD-Card>/iflyworkdir_test
Miscellaneous:
Executes next shell scripts:
- <dexopt>
