Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- a####.####.com
- c####.####.com
- d####.####.cn
- e####.####.cn
- m####.####.com
- m####.####.com:8757
- o####.####.com
- r####.####.com
HTTP GET requests:
- c####.####.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=####&st...
- d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
- m####.####.com/
- r####.####.com/resources/album/686a3bfb288ff9c1ee9fea7e21b2ea21.png
HTTP POST requests:
- a####.####.com/app_logs
- a####.####.com/index.php/user
- e####.####.cn/cw/cp.action?requestId=####&g=####
- m####.####.com:8757/sdk.html
- o####.####.com/check_config_update
Modified file system:
Creates the following files:
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/tencent_analysis.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/ClassificationFragmentDataFile.dat
- <Package Folder>/files/ClassificationFragmentTopNewDataFile.dat
- <Package Folder>/files/FindFragmentfile1.dat
- <Package Folder>/files/FindFragmentimageListfile.dat
- <Package Folder>/files/com.tencent.open.config.json.1101781822
- <Package Folder>/files/loading_img
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/ZS_player.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak (deleted)
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1gihi5yegolxlayjimnud5jkg
- <SD-Card>/Android/####/1jtrmvryi6g4xrg1l654y4d7y
- <SD-Card>/Android/####/27d5ya36lslxewagdlwxj2b0i
- <SD-Card>/Android/####/27tehcf4egh4o41hqgvb8q0qt
- <SD-Card>/Android/####/299m3axpxx83nd8lfcsekcqp1
- <SD-Card>/Android/####/2ern2ljdpp2kivdeemf5p4t26
- <SD-Card>/Android/####/2kieisodviwapnh8iibb81fpl
- <SD-Card>/Android/####/2pexvvz2pqo0rgznk0mzbut2v
- <SD-Card>/Android/####/2ti8rn054n2pj74p8zk0y574v
- <SD-Card>/Android/####/2u53q67y50ey58v7nqj9kt7u0
- <SD-Card>/Android/####/3g16xdogy9b6gd655x42k5a8t
- <SD-Card>/Android/####/3lpki40p888tj9tnkdckbjyjd
- <SD-Card>/Android/####/3njo9iwwppa5hg5sbxnesimrd
- <SD-Card>/Android/####/45coytrk515287lpwyvsq2pia
- <SD-Card>/Android/####/4810kuw0scfau3ye5w0zmm6cd
- <SD-Card>/Android/####/4c3jaub8qpaxlpp5i8z1nqe1h
- <SD-Card>/Android/####/4p08bj2035l1g30nv7ya6fpzq
- <SD-Card>/Android/####/4zv6vqknef3mfj9b1h7jgecvs
- <SD-Card>/Android/####/506rlo8rr03h537xpsaxj6blt
- <SD-Card>/Android/####/54bbiuajjqyjkwfxgt3iw8ffu
- <SD-Card>/Android/####/5c5ge968whjvribiahd10b5ke
- <SD-Card>/Android/####/5kpszncxyfryevco4ynqvo0wa
- <SD-Card>/Android/####/5tl9bj4i1x11apgu3bzu89q0s
- <SD-Card>/Android/####/5u4xz4bsux72nkcuyrqza2g00
- <SD-Card>/Android/####/5w71vsz96swqm5wvqprjieklj
- <SD-Card>/Android/####/66sijuulre24m274wzxpnovis
- <SD-Card>/Android/####/6lyq16x5uc2ys4fra6broihth
- <SD-Card>/Android/####/70htgw43zakq9jlrirszp07o5
- <SD-Card>/Android/####/79lihlcmi9phs9g9w7dgorrli
- <SD-Card>/Android/####/7hol4pgez0dnieg5865kz51j
- <SD-Card>/Android/####/7kc2uij1iir8n73pz9tbo6qlm
- <SD-Card>/Android/####/wiaswl05oqvae2nl8qht5aml
- <SD-Card>/Download/####/4.6_lvs.jar.tmp
- <SD-Card>/Tencent/####/.mid.txt
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- <dexopt>
