Android.Xiny.425

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.110.origin
Android.RemoteCode.93.origin
Android.Xiny.1.origin
Android.Xiny.197
Android.Xiny.232.origin

Downloads the following detected threats from the Web:

Android.RemoteCode.110.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) r####.adsb####.com:80
TCP(HTTP/1.1) www.univers####.com:80
TCP(HTTP/1.1) clk.ar####.co:80
TCP(HTTP/1.1) trac####.le####.com:80
TCP(HTTP/1.1) trac####.suma####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) a####.bat####.net:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) camspla####.com:80
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) i.cdn####.com:80
TCP(HTTP/1.1) tra####.tc-cl####.com:80
TCP(HTTP/1.1) t####.confirm####.online:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) bkmsoft####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) js.parking####.net:80
TCP(HTTP/1.1) 1####.243.199.134:80
TCP(HTTP/1.1) tango####.com:80
TCP(HTTP/1.1) koolmed####.com:80
TCP(HTTP/1.1) www.jp####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:8088
TCP(HTTP/1.1) ap####.mobisen####.com:80
TCP(HTTP/1.1) parking####.net:80
TCP(HTTP/1.1) c####.gowa####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) g####.gl:443
TCP(TLS/1.0) app.ad####.com:443
TCP(TLS/1.0) formula####.com:443
TCP(TLS/1.0) clk.tap####.com:443
TCP(TLS/1.0) c####.roya####.net:443

DNS requests:

a####.bat####.net
akw.e####.space
ali.f####.cdn.####.com
ap####.mobisen####.com
api.migh####.com
api.mob####.b####.com
app.ad####.com
aws.smarter####.net
bkmsoft####.com
c####.gowa####.com
c####.roya####.net
c.s####.co
camspla####.com
cl####.ads####.com
clk.ar####.co
clk.tap####.com
ea.sno####.1####.com
en.sno####.1####.com
formula####.com
g####.gl
googl####.g.doublec####.net
i.cdn####.com
js.parking####.net
koolmed####.com
mo.freeind####.com
offer####.online
p####.lead####.com
parking####.net
r####.adsb####.com
s####.mob####.b####.com
t####.confirm####.online
tango####.com
tra####.tc-cl####.com
trac####.le####.com
trac####.suma####.com
www.admobim####.com
www.cu####.com
www.jp####.com
www.mmmmmm####.com
www.univers####.com
www.zfr####.com

HTTP GET requests:

a####.bat####.net/call/v2/ad/click?recommend_id=####&ads_id=####&aff_id=...
ali.f####.cdn.####.com/20171213102849-snowfox_v19i154.jar
ap####.mobisen####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
api.mob####.b####.com/index.php?r=####
api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
bkmsoft####.com/hindiloveshayariimages/get_all_products.php?
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (31).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (32).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (33).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (35).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (37).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (38).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (40).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (41).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (42).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (43).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (44).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (45).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (46).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (47).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (48).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (49).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (50).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (51).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (52).png
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (53).png
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (55).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (56).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (59).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (60).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (36).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (37).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (38).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (39).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (40).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (41).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (42).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (43).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (44).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (45).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (46).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (47).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (48).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (49).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (50).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (51).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (52).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (53).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (54).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (55).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (56).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (57).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (58).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (59).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (60).jpg
bkmsoft####.com/sunstarappstudio/get_all_products.php?
bkmsoft####.com/sunstarappstudio/image/3D Photo Gallery-Photo Manager-Ph...
bkmsoft####.com/sunstarappstudio/image/Blur_Photo_Editor.png
bkmsoft####.com/sunstarappstudio/image/Body Plastic Surgery Photo Editor...
bkmsoft####.com/sunstarappstudio/image/Crorepati live app_banner.png
bkmsoft####.com/sunstarappstudio/image/Ghost_Camera.png
bkmsoft####.com/sunstarappstudio/image/Good Morning Wishes.png
bkmsoft####.com/sunstarappstudio/image/Letter Wallpaper.png
bkmsoft####.com/sunstarappstudio/image/My_name_ringtone_yams.png
bkmsoft####.com/sunstarappstudio/image/Photo Video Maker With Music-Movi...
bkmsoft####.com/sunstarappstudio/image/Steam Photo Editor.png
bkmsoft####.com/sunstarappstudio/image/Video Converter.png
bkmsoft####.com/sunstarappstudio/image/Video song statusWhatsap status v...
bkmsoft####.com/sunstarappstudio/image/Video to mp3 converter-Mp4 to mp3...
bkmsoft####.com/sunstarappstudio/image/Video to mp3_vanila.png
bkmsoft####.com/sunstarappstudio/image/Weather Channel.png
bkmsoft####.com/sunstarappstudio/image/X Collage Photo Editor.png
bkmsoft####.com/sunstarappstudio/image/ad_bodyslimmer.png
bkmsoft####.com/sunstarappstudio/image/adicon_cutpaste.png
bkmsoft####.com/sunstarappstudio/image/adicon_photo_editor.png
bkmsoft####.com/sunstarappstudio/image/adicon_prizma.png
bkmsoft####.com/sunstarappstudio/image/adicon_song_cutter.png
bkmsoft####.com/sunstarappstudio/image/adicon_videotpmp3.png
bkmsoft####.com/sunstarappstudio/image/bit camera.png
bkmsoft####.com/sunstarappstudio/image/blouse_design.png
bkmsoft####.com/sunstarappstudio/image/girlfriend photo editor.png
bkmsoft####.com/sunstarappstudio/image/goodmorningimage1.png
bkmsoft####.com/sunstarappstudio/image/letter wallpaper_sunstar.png
bkmsoft####.com/sunstarappstudio/image/love good morning image.png
bkmsoft####.com/sunstarappstudio/image/mobile_number_tracker_banner.png
bkmsoft####.com/sunstarappstudio/image/video_convertrt_banner.png
c####.gowa####.com/click?transaction_id=wadogo_WAdvPubNativeNewAPI_30359...
c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
camspla####.com/
camspla####.com/styles/forms.css
camspla####.com/styles/layout.css
camspla####.com/styles/navi.css
camspla####.com/styles/tables.css
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
clk.ar####.co/aff_c?offer_id=####&aff_id=####&aff_sub=####&sub_channel=#...
i.cdn####.com/themes/assets/style.css
i.cdn####.com/themes/registrar/style_namecheap.css
js.parking####.net/assets/scripts/jsparkcaf.js
js.parking####.net/assets/scripts/registrar-caf/243142.js
js.parking####.net/assets/scripts/tier2caf.js
js.parking####.net/scripts/feedmeCaf.php?q=####&ip=####&max=####&hl=####...
js.parking####.net/track.php?domain=####&toggle=####&uid=MTU####
koolmed####.com/r/76c96dd4-e85b-11e7-97d2-1144879f22ea/0/
koolmed####.com/r/76c96dd4-e85b-11e7-97d2-1144879f22ea/1/
koolmed####.com/r/77729f62-e85b-11e7-b06b-1142e8499c68/0/
koolmed####.com/r/77729f62-e85b-11e7-b06b-1142e8499c68/1/
parking####.net/jsparkcaf.php?regcn=####&_v=####&_h=####&_t=####
r####.adsb####.com/c/67e4f89dc239c781?c3=####&c2=####&c1=####
t####.confirm####.online/?utm_medium=####&utm_campaign=####&c3=####&c2=#...
tango####.com/66291_nl_4247_android?rpm=0.2&fallbackUrl=https://formulaw...
tra####.tc-cl####.com/?p=####&media_type=####&click_id=####&pi=####
trac####.le####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&click_id=...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_s...
trac####.suma####.com/aff_r?offer_id=328149&aff_id=3599&url=http://click...
www.cu####.com/20171212103437.201712121030.zip
www.jp####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=####&...
www.univers####.com/Adminpanel/CategoryJson.php?a####
www.univers####.com/Adminpanel/image/adicon_photo_editor.png
www.univers####.com/Adminpanel/image/adicon_videotpmp3.png

HTTP POST requests:

ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/checklib
ea.sno####.1####.com:18088/sdk/api/regclient
ea.sno####.1####.com:8088/sdk/api/ad/hull_v2
ea.sno####.1####.com:8088/sdk/api/log/record
js.parking####.net/ls.php
mo.freeind####.com/detail/getOfferListNew?enc=####
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
www.admobim####.com/surl/api2_reg.action?ecy=####
www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.zfr####.com/up.do?enc=####

Modified file system:

Creates the following files:

<Package Folder>/app_lib/libmosel.so
<Package Folder>/cache/####/-6065482491758265024
<Package Folder>/cache/####/2ae288efb005fe37c024795562e4f78d.0.tmp
<Package Folder>/cache/####/2ae288efb005fe37c024795562e4f78d.1.tmp
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/e3a85dc5698cbcee15b35c7c9d7b33a6.0.tmp
<Package Folder>/cache/####/e3a85dc5698cbcee15b35c7c9d7b33a6.1.tmp
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/ads-1702544704.jar
<Package Folder>/databases/adblib.db
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/412293793
<Package Folder>/files/####/412293793.data
<Package Folder>/files/d.dex
<Package Folder>/files/d.dex (deleted)
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/f.zip
<Package Folder>/files/google.db
<Package Folder>/files/lib.dat
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/ob.dex
<Package Folder>/files/ob.zip
<Package Folder>/files/snowfox_v19i.jar
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/D824hunter_config.xml
<Package Folder>/shared_prefs/D824other_config.xml
<Package Folder>/shared_prefs/D824service_config.xml
<Package Folder>/shared_prefs/D824sp_config.xml
<Package Folder>/shared_prefs/D824upgrade_config.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/isupdate.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/s_sdk_pro_pref.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/songcutter.xml
<Package Folder>/shared_prefs/songcutter.xml.bak
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/t_ini.xml
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/Android/####/-1062533969.tmp
<SD-Card>/Android/####/-1086172752.tmp
<SD-Card>/Android/####/-1104036827.tmp
<SD-Card>/Android/####/-1145160013.tmp
<SD-Card>/Android/####/-1337003050.tmp
<SD-Card>/Android/####/-1439710467.tmp
<SD-Card>/Android/####/-1468339618.tmp
<SD-Card>/Android/####/-1496968769.tmp
<SD-Card>/Android/####/-1525597920.tmp
<SD-Card>/Android/####/-1554227071.tmp
<SD-Card>/Android/####/-1564193885.tmp
<SD-Card>/Android/####/-1582856222.tmp
<SD-Card>/Android/####/-1611485373.tmp
<SD-Card>/Android/####/-1625934241.tmp
<SD-Card>/Android/####/-1640114524.tmp
<SD-Card>/Android/####/-1668743675.tmp
<SD-Card>/Android/####/-1687893651.tmp
<SD-Card>/Android/####/-1697372826.tmp
<SD-Card>/Android/####/-1741293962.tmp
<SD-Card>/Android/####/-1842361681.tmp
<SD-Card>/Android/####/-30729599.tmp
<SD-Card>/Android/####/-335305928.tmp
<SD-Card>/Android/####/-437385515.tmp
<SD-Card>/Android/####/-456042742.tmp
<SD-Card>/Android/####/-484671893.tmp
<SD-Card>/Android/####/-541930195.tmp
<SD-Card>/Android/####/-555181129.tmp
<SD-Card>/Android/####/-599188497.tmp
<SD-Card>/Android/####/-627817648.tmp
<SD-Card>/Android/####/-633003976.tmp
<SD-Card>/Android/####/-656446799.tmp
<SD-Card>/Android/####/-809869145.tmp
<SD-Card>/Android/####/-91933070.tmp
<SD-Card>/Android/####/-962233324.tmp
<SD-Card>/Android/####/1001733394.tmp
<SD-Card>/Android/####/1022991165.tmp
<SD-Card>/Android/####/1051620316.tmp
<SD-Card>/Android/####/1080249467.tmp
<SD-Card>/Android/####/1089931412.tmp
<SD-Card>/Android/####/1113732709.tmp
<SD-Card>/Android/####/1118560563.tmp
<SD-Card>/Android/####/1147195418.tmp
<SD-Card>/Android/####/1175824569.tmp
<SD-Card>/Android/####/1233077167.tmp
<SD-Card>/Android/####/1261706318.tmp
<SD-Card>/Android/####/1340004261.tmp
<SD-Card>/Android/####/1347593771.tmp
<SD-Card>/Android/####/1396925414.tmp
<SD-Card>/Android/####/1435943698.tmp
<SD-Card>/Android/####/1710090789.tmp
<SD-Card>/Android/####/1738719940.tmp
<SD-Card>/Android/####/1767349091.tmp
<SD-Card>/Android/####/1795978242.tmp
<SD-Card>/Android/####/1796613605.tmp
<SD-Card>/Android/####/1824607393.tmp
<SD-Card>/Android/####/1853236544.tmp
<SD-Card>/Android/####/1881865695.tmp
<SD-Card>/Android/####/1910494846.tmp
<SD-Card>/Android/####/1939123997.tmp
<SD-Card>/Android/####/1967753148.tmp
<SD-Card>/Android/####/1977435093.tmp
<SD-Card>/Android/####/202427731.tmp
<SD-Card>/Android/####/231056882.tmp
<SD-Card>/Android/####/259686033.tmp
<SD-Card>/Android/####/288315184.tmp
<SD-Card>/Android/####/316944335.tmp
<SD-Card>/Android/####/34119042.tmp
<SD-Card>/Android/####/345573486.tmp
<SD-Card>/Android/####/374202637.tmp
<SD-Card>/Android/####/402831788.tmp
<SD-Card>/Android/####/418845980.tmp
<SD-Card>/Android/####/431460939.tmp
<SD-Card>/Android/####/460090090.tmp
<SD-Card>/Android/####/540860186.tmp
<SD-Card>/Android/####/628605191.tmp
<SD-Card>/Android/####/885713867.tmp
<SD-Card>/Android/####/935554585.tmp
<SD-Card>/Android/####/978977308.tmp
<SD-Card>/Android/####/994362014.tmp
<SD-Card>/Android/####/dev_f53bc04.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/pid
<SD-Card>/Android/####/ua.dat
<SD-Card>/LogN/####/sp
<SD-Card>/Write On Photo/image1510835503036.png
<SD-Card>/Write On Photo/image1510835529254.png
<SD-Card>/baidu/####/journal
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.cgt.esv.Fz
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 777 <Package Folder>/bmosel
dd if <Package Folder>/lib/libmosel.so of <Package Folder>/bmosel
dd if=<Package Folder>/lib/libmosel.so of=<Package Folder>/bmosel
sh

Loads the following dynamic libraries:

libmosel

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial