Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- 2####.####.31
- a####.####.com
- c####.####.com
- d####.####.cn
- google-####.com
- h####.####.com
- i####.####.com
- o####.####.com
- q####.####.cn
- st####.####.cn
- st####.####.com
- t####.####.com
- y####.####.cn
- y####.####.com
HTTP GET requests:
- 2####.####.31/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/gou.jar?wsiphost...
- a####.####.com/CookieMapping/BaiduCM?baidu_error=####×tamp=####
- a####.####.com/images/404.png
- c####.####.com/b?type=####&jzqs=####
- d####.####.cn/jarFile/SDKAutoUpdate/gou.jar
- google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&ul=...
- h####.####.com/hm.js?b366fbb####
- i####.####.com/doctor/20141021/9/20141021155251485_100_100.png
- i####.####.com/upload/20140321/7/20140321123221281.jpg
- i####.####.com/user/20170606/0/20170606153432665_64_64.jpg
- q####.####.cn/qqapp/1101094951/0E707C9CE116852D645BC0B6E7AD08A8/100
- st####.####.cn/ag_track-0.1.23.js
- st####.####.com/mvl.js
- st####.####.com/pc/static/img/live/replay.png
- t####.####.com/js/ag.js
- t####.####.com/pv?atscu=####&atsdomain=####&agfid=####&atsp=####&atsl=##...
- y####.####.cn/k2?protocol=####&version=####&cid=####
- y####.####.com/images/yh_1409/y_t_3.png
HTTP POST requests:
- a####.####.com/app_logs
- o####.####.com/check_config_update
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/index
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <Package Folder>/shared_prefs/sharedpreference.xml
- <Package Folder>/shared_prefs/st.xml
- <SD-Card>/Android/####/-1098090989
- <SD-Card>/Android/####/-115278958
- <SD-Card>/Android/####/-1371596393
- <SD-Card>/Android/####/-1578221205
- <SD-Card>/Android/####/-1586102639
- <SD-Card>/Android/####/-1646127893
- <SD-Card>/Android/####/-470330305
- <SD-Card>/Android/####/-63802290
- <SD-Card>/Android/####/-758797001
- <SD-Card>/Android/####/-899901320
- <SD-Card>/Android/####/-930018031
- <SD-Card>/Android/####/-93696199
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1072515376
- <SD-Card>/Android/####/1078415143
- <SD-Card>/Android/####/1085491030
- <SD-Card>/Android/####/1124578912
- <SD-Card>/Android/####/1209218196
- <SD-Card>/Android/####/1375417150
- <SD-Card>/Android/####/1556879855
- <SD-Card>/Android/####/1791968001
- <SD-Card>/Android/####/1822356467
- <SD-Card>/Android/####/1888800458
- <SD-Card>/Android/####/1965502222
- <SD-Card>/Android/####/2080736319
- <SD-Card>/Android/####/492068985
- <SD-Card>/Android/####/551660904
- <SD-Card>/Android/####/5864885
- <SD-Card>/Android/####/933742685
- <SD-Card>/Download/####/4.8_gou.jar.tmp
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- <dexopt>
