Android.Xiny.2212

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.84.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) t####.dmp.y####.net:80
TCP(HTTP/1.1) mo####.b####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) www.dianm####.com:80
TCP(HTTP/1.1) s####.j####.cn:80
TCP(HTTP/1.1) 1####.29.106.14:8888
TCP(HTTP/1.1) www.beid####.com:80
TCP(HTTP/1.1) w####.datou####.com:80
TCP(HTTP/1.1) cdn.51tangz####.com:80
TCP(HTTP/1.1) api.and####.di####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) apilo####.a####.com:80
TCP(HTTP/1.1) au.y####.net:80
TCP(HTTP/1.1) s.y####.net:80
TCP(TLS/1.0) res####.a####.com:443
UDP 2####.0.0.1:9998
UDP easytom####.com:80
UDP easytom####.com:19000
UDP s.j####.cn:80
TCP 1####.121.49.97:7009
UDP s.j####.cn:19000

DNS requests:

a####.u####.com
amap####.cn-hang####.oss####.####.com
aos.w####.y####.net
aow.d####.com
api####.a####.com
api.and####.di####.com
au.y####.net
az.gu####.com
cdn.51tangz####.com
easytom####.com
mo####.b####.com
pi####.qq.com
res####.a####.com
s####.gw.y####.net
s####.j####.cn
s.j####.cn
s.y####.net
sis.j####.io
t####.dmp.y####.net
w####.datou####.com
www.beid####.com
www.dianm####.com

HTTP GET requests:

api.and####.di####.com/active/index.do?TaPqagq####
api.and####.di####.com/collection/v2_index.do?4VkZXpDwdfZS+Xkljn+k1Bn2I8...
api.and####.di####.com/collection/v2_index.do?T1LA390bV6JS+Xkljn+k1NOBD7...
api.and####.di####.com/deep_encry_sdk/cache_img.do?FDWnV0g####
api.and####.di####.com/deep_encry_sdk/special.do?FDWnV0g####
au.y####.net/offer/dist/aos/pkg/3.1.0/offers_3.1.0.zip
cdn.51tangz####.com/diy/e29fa9b3deb73b60a809f24fa259cee8-daidaimuyecun.jpg
cdn.51tangz####.com/diy/e5668bc5a048773f5c9257fddc40350a-yiqiniubanner.jpg
mo####.b####.com/wall/pa/__pasys_remote_offer_wall.jar
mo####.b####.com/wall/pa/__pasys_remote_offer_wall.php?v=####&tp=####&os...
s.y####.net/aos/v3/pns?s=####
s.y####.net/stat/aos/v3/init?s=####
s.y####.net/stat/aos/v3/pkc?s=####
s.y####.net/stat/aos/v3/pku?s=####
s.y####.net/v3/get?s=####
s.y####.net/v3/zip_upd?s=####
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
w####.datou####.com/AdPublisherConnect?udid=####&device_name=####&device...
www.beid####.com/fct/fileDownLoadAction?filePath=####
www.dianm####.com/sdk/DianCaiWall.zip

HTTP POST requests:

a####.u####.com/app_logs
apilo####.a####.com/v3/log/init
pi####.qq.com/mstat/report/?index=####
s####.j####.cn/v2/report
t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
www.dianm####.com/diancai/getConfig.json
www.dianm####.com/diancai/init.json
www.dianm####.com/diancai/wall.do

Modified file system:

Creates the following files:

/data/data/####/-1561993216.xml
/data/data/####/-560630345.xml
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.log1.txt
/data/data/####/.log2.txt
/data/data/####/.mta-wxop.xml
/data/data/####/20b92129c7c263373bf13a67fa29db52.zip
/data/data/####/633562242
/data/data/####/633562242.jar
/data/data/####/757138c6ef1fe3dfbf12a81e2a1d206c-journal
/data/data/####/BC4776C2FDC237A349CAB1ECC29686E7.xml
/data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml
/data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml.bak
/data/data/####/JPushSA_Config.xml
/data/data/####/OFFERSCONFIG1.xml
/data/data/####/OxgHkj2lz09F
/data/data/####/OxgHkj2lz09F-journal
/data/data/####/P15pKIjsm64m
/data/data/####/P15pKIjsm64m-journal
/data/data/####/PrefsFile
/data/data/####/T1oX0rhhuXWt
/data/data/####/T1oX0rhhuXWt-journal
/data/data/####/XKwVoK0huy3R
/data/data/####/XKwVoK0huy3R-journal
/data/data/####/__pasys_remote_offer_wall.jar.beforesign.tm
/data/data/####/__pasys_remote_offer_wall.tmp.jar
/data/data/####/app_black_list
/data/data/####/arrow-left-pink.png
/data/data/####/arrow-left.png
/data/data/####/arrow-right-pink.png
/data/data/####/arrow-right.png
/data/data/####/be2c4c32db07850cba346b99c275384d
/data/data/####/be2c4c32db07850cba346b99c275384d-journal
/data/data/####/blank.gif
/data/data/####/cc96cc113c00ed83b3d603f90a951cb9
/data/data/####/cc96cc113c00ed83b3d603f90a951cb9-journal
/data/data/####/close-icon.png
/data/data/####/cn.jpush.serverconfig.xml
/data/data/####/com.aishion.tzhuan_preferences.xml
/data/data/####/datouniao_config.xml
/data/data/####/db
/data/data/####/db-journal
/data/data/####/default.png
/data/data/####/detail-wx-miniprogram.html
/data/data/####/detail-wx-miniprogram.js
/data/data/####/detail-wx.html
/data/data/####/detail-wx.js
/data/data/####/detail.html
/data/data/####/detail.js
/data/data/####/dtn_ad_sys.db-journal
/data/data/####/dynamicamapfile.db
/data/data/####/dynamicamapfile.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/feedback.html
/data/data/####/feedback.js
/data/data/####/form.css
/data/data/####/global.js
/data/data/####/gminfo.xml
/data/data/####/gminfo.xml.bak (deleted)
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_local_notification.db
/data/data/####/jpush_local_notification.db-journal
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jpush_statistics.db
/data/data/####/jpush_statistics.db-journal
/data/data/####/jqIqJYOT3JpT
/data/data/####/jqIqJYOT3JpT-journal
/data/data/####/libjiagu.so
/data/data/####/libwgs2gcj.so
/data/data/####/libzhuantange.so
/data/data/####/lists.css
/data/data/####/lists.html
/data/data/####/lists.js
/data/data/####/md5.js
/data/data/####/multidex.version.xml
/data/data/####/nointernet.png
/data/data/####/pic_friend_step1.jpg
/data/data/####/pic_friend_step2.jpg
/data/data/####/pic_friend_step3.jpg
/data/data/####/pic_friend_step4.jpg
/data/data/####/pic_friend_step5.jpg
/data/data/####/pic_m.png
/data/data/####/pic_tips_01.png
/data/data/####/pic_tips_02.png
/data/data/####/pic_xiaochengxu_kefu_step1.png
/data/data/####/pic_xiaochengxu_kefu_step2.png
/data/data/####/pic_xiaochengxu_kefu_step3.png
/data/data/####/pic_xiaochengxu_kefu_step4.png
/data/data/####/pic_xiaochengxu_kefu_step5.png
/data/data/####/pic_xiaochengxu_kefu_step6.png
/data/data/####/pic_xiaochengxu_step1.png
/data/data/####/pic_xiaochengxu_step2.png
/data/data/####/pic_xiaochengxu_step3.png
/data/data/####/pic_xiaochengxu_step4.png
/data/data/####/pic_xiaochengxu_step5.png
/data/data/####/preference_daow.xml
/data/data/####/preferences.xml
/data/data/####/pri_wxop_tencent_analysis.db-journal
/data/data/####/rep.db-journal
/data/data/####/result.png
/data/data/####/rule.html
/data/data/####/sdetail.html
/data/data/####/share.css
/data/data/####/share.html
/data/data/####/share.js
/data/data/####/spname.xml
/data/data/####/sprite-face.png
/data/data/####/sprite-icons.png
/data/data/####/sprite-icons2.png
/data/data/####/statistics_config.xml
/data/data/####/tempfile
/data/data/####/tzhuan_pref.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/wIU6pTyUBYWX
/data/data/####/wIU6pTyUBYWX-journal
/data/data/####/wsUL1uCdKvjD
/data/data/####/wsUL1uCdKvjD-journal
/data/data/####/wx-qr-step1.jpg
/data/data/####/wx-qr-step2.jpg
/data/data/####/wx-qr-step3.jpg
/data/data/####/wx-qr-step4.jpg
/data/data/####/wx-qr-step5.jpg
/data/data/####/wx-step1.jpg
/data/data/####/wx-step2.jpg
/data/data/####/wx-step3.jpg
/data/data/####/wx-step4.jpg
/data/data/####/wx-step5.jpg
/data/data/####/wxop_tencent_analysis.db-journal
/data/data/####/zy_init.xml
/data/media/####/.downName.txt
/data/media/####/.gmbc1.txt
/data/media/####/.gmbc2.txt
/data/media/####/.gmbc3.txt
/data/media/####/.gmbc4.txt
/data/media/####/.installed.txt
/data/media/####/.listPackName.txt
/data/media/####/.log1.txt
/data/media/####/.log2.txt
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/.openAppSum.txt
/data/media/####/.org
/data/media/####/.push_deviceid
/data/media/####/30ea0af914b64e1818d567daba76f99a.ymtf
/data/media/####/3ooafmcd8rxsrz03h58kmmgep0.tmp
/data/media/####/4tjutrlef7mo9h569ghbatd9v0.tmp
/data/media/####/9E1DF2C13652918C3464F27C81646407
/data/media/####/DB956F75B2C1E2D7ADA90A35A4D07B79
/data/media/####/E51653CCC9CBBE0C621F65A73009E5C1
/data/media/####/ad.dat
/data/media/####/i42d45df023jnkdd93la483f9xGFKXI
/data/media/####/ini.dat
/data/media/####/journal.tmp
/data/media/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat sys/class/net/eth0/address
cat sys/class/net/wlan0/address

Loads the following dynamic libraries:

jpush182
libjiagu
zhuantangc

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
PBEWITHMD5andDES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES
PBEWITHMD5andDES
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial