Android.Xiny.416

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.110.origin
Android.RemoteCode.93.origin
Android.Xiny.1.origin
Android.Xiny.197
Android.Xiny.232.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) premium####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) offer####.online:80
TCP(HTTP/1.1) im####.startap####.com.####.net:80
TCP(HTTP/1.1) uswild####.al####.com.####.net:80
TCP(HTTP/1.1) b####.ly:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) star####.edges####.net:80
TCP(HTTP/1.1) t####.date####.info:80
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) trac####.suma####.com:80
TCP(HTTP/1.1) x####.nl:80
TCP(HTTP/1.1) va.ec.startap####.com:80
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) en####.phn.double####.com:80
TCP(HTTP/1.1) dsa.startap####.edg####.net:80
TCP(HTTP/1.1) adn.vision-####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) c####.jq####.com:80
TCP(HTTP/1.1) funn####.net:80
TCP(HTTP/1.1) gl####.ymtrac####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) a.n####.ren:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) pop####.net:80
TCP(HTTP/1.1) c####.u####.u####.com:80
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(HTTP/1.1) ds-ak####.akam####.net.####.net:80
TCP(HTTP/1.1) va.or####.startap####.com:80
TCP(HTTP/1.1) www.jp####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:8088
TCP(HTTP/1.1) ap####.mobisen####.com:80
TCP(HTTP/1.1) c####.gowa####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) st####.startap####.edges####.net:80
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) o-####.prodt####.com:443
TCP(TLS/1.0) q####.go2af####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) c####.liveja####.com:443
TCP(TLS/1.0) creat####.liveja####.com:443
TCP(TLS/1.0) billmsc####.com:443

DNS requests:

a.n####.ren
adn.vision-####.com
akw.e####.space
ap####.mobisen####.com
api.migh####.com
api.mob####.b####.com
aws.smarter####.net
b####.ly
billmsc####.com
c####.gowa####.com
c####.jq####.com
c####.liveja####.com
c####.liveja####.com
c####.startap####.com
c####.u####.u####.com
c.s####.co
cl####.ads####.com
cpgnrot####.com
creat####.liveja####.com
ds-ak####.akam####.net
dts.startap####.com
ea.sno####.1####.com
en####.phn.double####.com
en.sno####.1####.com
f####.google####.com
funn####.net
gl####.ymtrac####.com
i####.st####.startap####.com
i####.startap####.com
im####.startap####.com
imp.startap####.com
mo.freeind####.com
o-####.prodt####.com
offer####.online
p####.lead####.com
pop####.net
premium####.com
req.startap####.com
s####.mob####.b####.com
s.c####.aliexp####.com
t####.date####.info
t####.q####.agency
trac####.suma####.com
va.or####.startap####.com
www.admobim####.com
www.cu####.com
www.jp####.com
www.mmmmmm####.com
www.startap####.com
www.x####.nl
www.zfr####.com
x####.nl

HTTP GET requests:

a.n####.ren/sm/v1/click?rule_id=####&sub_1=####&publisher_slot=####&pub_...
adn.vision-####.com/API/Click.ashx?M=####&gaid=####&sid=####
adn.vision-####.com/API/Click.ashx?M=MTA4N####&sid=####&idfa=####&gaid=#...
ap####.mobisen####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
api.mob####.b####.com/index.php?r=####
api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
b####.ly/2BJFBGJ
c####.gowa####.com/click?transaction_id=wadogo_WAdvAppthisNewAPI_304213_...
c####.gowa####.com/click?transaction_id=wadogo_WAdvPubNativeNewAPI_30359...
c####.gowa####.com/click?transaction_id=wadogo_WAdvRevmobBulkAPI_310988_...
c####.jq####.com/ui/1.11.4/jquery-ui.min.js
c####.u####.u####.com/index.php?service=####&pub=####&offer_id=####&uc_t...
c.s####.co/api/v4/click?_castle####
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
ds-ak####.akam####.net.####.net/2/259588/b?dE=####&cS=####&cE=####&rqS=#...
ds-ak####.akam####.net.####.net/aksb.min.js
dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFWldbW...
dsa.startap####.edg####.net/tracking/adImpression?d=IAAAA####&position=#...
en####.phn.double####.com/Redirect.eng?MediaSegmentId=####&dcid=####&vmI...
en####.phn.double####.com/link.engine?Hardlink=####&currentURL=####&guid...
funn####.net/
gl####.ymtrac####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=...
im####.startap####.com.####.net/image/fetch/f_auto,q_80,w_100,h_100/http...
im####.startap####.com.####.net/image/fetch/f_auto,q_80,w_124,h_124/http...
im####.startap####.com.####.net/image/fetch/f_auto,q_80,w_256,h_256/http...
im####.startap####.com.####.net/image/fetch/f_auto,q_80,w_300,h_300/http...
im####.startap####.com.####.net/image/fetch/f_auto,q_80,w_84,h_84/http:/...
im####.startap####.com.####.net/image/fetch/f_auto,q_80/http://static.ak...
im####.startap####.com.####.net/static/images/close-btn-infra.png
im####.startap####.com.####.net/static/images/fullpage_beach_infra/lands...
im####.startap####.com.####.net/static/images/fullpage_beach_infra/x.png
im####.startap####.com.####.net/static/images/fullpage_float_window_infr...
im####.startap####.com.####.net/static/images/fullpage_two_icons_infra/a...
im####.startap####.com.####.net/static/images/fullpage_two_icons_infra/s...
im####.startap####.com.####.net/static/images/fullpage_two_icons_infra/x...
im####.startap####.com.####.net/static/images/fullpage_vertical_photogra...
im####.startap####.com.####.net/static/images/fullscreen_xmas2017/elemen...
im####.startap####.com.####.net/static/images/fullscreen_xmas2017/top_de...
im####.startap####.com.####.net/styles/compressed/fullpage_beach_infra.2...
im####.startap####.com.####.net/styles/compressed/fullpage_float_window_...
im####.startap####.com.####.net/styles/compressed/fullpage_two_icons_inf...
im####.startap####.com.####.net/styles/compressed/fullpage_vertical_gene...
im####.startap####.com.####.net/styles/compressed/fullpage_vertical_phot...
im####.startap####.com.####.net/styles/compressed/fullscreen_xmas2017_el...
im####.startap####.com.####.net/styles/compressed/fullscreen_xmas2017_to...
offer####.online/r/c9e89fce-e63c-11e7-8e12-1141fb30693e/0/
offer####.online/r/c9e89fce-e63c-11e7-8e12-1141fb30693e/1/
pop####.net/world/go/118844/282334
pop####.net/world/sgo/ad?p=####&w=####&t=####&r=####&vw=####&vh=####
premium####.com/d/46064259b9f90e4c211?sub=####
premium####.com/d/46064259b9f90e4c211?sub=####&code=####
premium####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&s...
premium####.com/gw?url=https://billmscurlrev.com/c/0e3d3438-e3bf-11e6-b9...
st####.startap####.edges####.net/InApp/resources/info_ex_l.png
st####.startap####.edges####.net/InApp/resources/info_ex_s.png
st####.startap####.edges####.net/InApp/resources/info_l.png
st####.startap####.edges####.net/InApp/resources/info_s.png
star####.edges####.net/1.3/getads?publisherId=####&productId=####&os=###...
star####.edges####.net/1.3/getadsmetadata?publisherId=####&productId=###...
star####.edges####.net/1.3/gethtmlad?publisherId=####&productId=####&os=...
star####.edges####.net/1.3/trackdownload?publisherId=####&productId=####...
star####.edges####.net/tracking/infoEvent?publisherId=100322561&productI...
t####.date####.info/d2b1fa9a-62dc-4dc3-8c11-6bf046592f9b?src=####&campai...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_click_id=####&...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_s...
trac####.suma####.com/aff_r?offer_id=328149&aff_id=3599&url=http://click...
trac####.suma####.com/aff_r?offer_id=328766&aff_id=5323&url=http://click...
trac####.suma####.com/aff_r?offer_id=335419&aff_id=3599&url=http://click...
uswild####.al####.com.####.net/app/umeng?pid=####&dp=####&af=####&sk=###...
va.ec.startap####.com/1.3/gethtmlad?publisherId=####&productId=####&os=#...
va.or####.startap####.com/1.3/getads?publisherId=####&productId=####&os=...
va.or####.startap####.com/1.3/gethtmlad?publisherId=####&productId=####&...
va.or####.startap####.com/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFWldbWFF...
va.or####.startap####.com/tracking/adImpression?d=####&position=####&ts=...
va.or####.startap####.com/tracking/adImpression?d=####&ts=####&tsh=####
va.or####.startap####.com/tracking/adImpression?d=IAAAA####&ts=####&tsh=...
www.cu####.com/20171212103437.201712121030.zip
www.jp####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=####&...
x####.nl/css/magnific-popup.css?148827####
x####.nl/css/magnific-popup.css?149193####
x####.nl/js/jquery.chained.remote.js?143323####
x####.nl/js/magnific-popup.js
x####.nl/js/popupRegister.js
x####.nl/lps/citrine/css/style.css?151063####
x####.nl/lps/css/bootstrap.min.css?146227####
x####.nl/lps/css/font-awesome.min.css?146841####
x####.nl/lps/css/select2.min.css?146841####
x####.nl/lps/css/style.css?151063####
x####.nl/lps/js/bootstrap.min.js?146227####
x####.nl/lps/js/jquery-1.11.3.min.js?146227####
x####.nl/lps/js/plugins/icheck.min.js?146530####
x####.nl/lps/js/register-form-v1.js?146892####
x####.nl/lps/js/select2.min.js?146841####
x####.nl/lps/js/tether.min.js?146530####
x####.nl/theme/MobileBootstrap/js/additional-methods.min.js?146356####
x####.nl/theme/MobileBootstrap/js/jquery.validate.min.js?146356####
x####.nl/x/citrine?pid=####&pi=####&clickId=####&hit_id=####&fwd_data1=#...

HTTP POST requests:

ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/checklib
ea.sno####.1####.com:18088/sdk/api/regclient
ea.sno####.1####.com:8088/sdk/api/ad/hull_v2
ea.sno####.1####.com:8088/sdk/api/log/record
mo.freeind####.com/detail/getOfferListNew?enc=####
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
www.admobim####.com/surl/api2_reg.action?ecy=####
www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.zfr####.com/up.do?enc=####

Modified file system:

Creates the following files:

/data/anr/traces.txt
<Package Folder>/app_lib/libbiuma.so
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_0 (deleted)
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_1 (deleted)
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_2 (deleted)
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/data_3 (deleted)
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/index
<Package Folder>/cache/####/index (deleted)
<Package Folder>/cache/filename_return_ad
<Package Folder>/cache/filename_return_ad_html
<Package Folder>/databases/adblib.db
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/Roboto-Regular.ttf
<Package Folder>/files/close_button.png
<Package Folder>/files/d.dex
<Package Folder>/files/d.dex (deleted)
<Package Folder>/files/d.zip
<Package Folder>/files/drawable-hdpi.zip
<Package Folder>/files/drawable.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/empty_star.png
<Package Folder>/files/f.dex
<Package Folder>/files/f.zip
<Package Folder>/files/filled_star.png
<Package Folder>/files/google.db
<Package Folder>/files/half_star.png
<Package Folder>/files/info_ex_l.png
<Package Folder>/files/info_ex_s.png
<Package Folder>/files/info_l.png
<Package Folder>/files/info_s.png
<Package Folder>/files/lib.dat
<Package Folder>/files/logo.png
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/ob.dex
<Package Folder>/files/ob.zip
<Package Folder>/files/resources.zip
<Package Folder>/files/snowfox_v19i.jar
<Package Folder>/files/tab_side.png
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/D824hunter_config.xml
<Package Folder>/shared_prefs/D824other_config.xml
<Package Folder>/shared_prefs/D824service_config.xml
<Package Folder>/shared_prefs/D824service_config.xml.bak
<Package Folder>/shared_prefs/D824sp_config.xml
<Package Folder>/shared_prefs/D824upgrade_config.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.Cook...le.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.xml.bak
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/s_sdk_pro_pref.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/t_ini.xml
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/Android/####/dev_f53bc04.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/pid
<SD-Card>/Android/####/ua.dat
<SD-Card>/LogN/####/sp
<SD-Card>/baidu/####/journal
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.lfp.got.Tk
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 777 <Package Folder>/bbiuma
dd if=<Package Folder>/lib/libbiuma.so of=<Package Folder>/bbiuma
sh

Loads the following dynamic libraries:

libbiuma

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial