Android.Xiny.2239

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Appsad.5.origin
Android.Click.171.origin
Android.DownLoader.463.origin
Android.Xiny.220.origin
Android.Xiny.255.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) premium####.com:80
TCP(HTTP/1.1) androi####.b####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) dpl.b####.com:80
TCP(HTTP/1.1) h5.nn####.com:80
TCP(HTTP/1.1) la####.landing####.com:80
TCP(HTTP/1.1) m####.trff####.com:80
TCP(HTTP/1.1) f####.cdn.1####.com:80
TCP(HTTP/1.1) ols.dedicat####.com:80
TCP(HTTP/1.1) na####.s####.1####.com:8111
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) mob.media####.club:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) www.nn####.com:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) real####.icec####.org:80
TCP(HTTP/1.1) u####.b####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) d.a####.site:80
TCP(HTTP/1.1) chilly-####.com:80
TCP(HTTP/1.1) pl####.mob####.b####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) pic.a####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(SSL/3.0) questio####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) questio####.com:443
TCP(TLS/1.0) sub.s####.1####.com:7078
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

a####.k####.a####.top
adser####.go####.com
adser####.go####.nl
ak.icec####.org
androi####.b####.com
api.bi####.com
api.mob####.b####.com
chilly-####.com
d.a####.site
dpl.b####.com
f####.cdn.1####.com
f####.google####.com
f####.gst####.com
googl####.g.doublec####.net
h5.nn####.com
l.a####.com
la####.landing####.com
log.t####.in
m####.trff####.com
mob.media####.club
na####.sno####.1####.com
ols.dedicat####.com
pag####.googles####.com
pic.a####.com
pl####.mob####.b####.com
premium####.com
questio####.com
real####.icec####.org
s####.mob####.b####.com
tpc.googles####.com
u####.b####.com
www.admobim####.com
www.go####.com
www.google-####.com
www.googlet####.com
www.mmmmmm####.com
www.nn####.com

HTTP GET requests:

ak.icec####.org/rule?platform=####&os_version=####&package_name=####&app...
androi####.b####.com/index.php/OfferList/getOfferListNew?start=####&limi...
api.bi####.com/sdkOffer?s=####&u=####&rt=####&at=####&androidId=####&gai...
api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
chilly-####.com/sf/2112585331/8jiKwcb?d=####
d.a####.site/Uploads/sa_model/2018/04/2749da811dba0bbce70271d3f37ea7d0.jar
dpl.b####.com/M00/01/AC/CvJKDlmUN1yAQ2teAArECJTDZRc385.zip
f####.cdn.1####.com/20180322205013-nativebd152t3
h5.nn####.com/cid=supergames/
la####.landing####.com/l.php?trf=####&t=####&portal=####&pid=####&source...
m####.trff####.com/?utm_medium=####&utm_campaign=####&cid=####
m####.trff####.com/?utm_term=####&clickverify=####&utm_content=####
m####.trff####.com/proc.php?2066f4b####
mob.media####.club/redirect?feed=####&auth=####&url=####&subid=####&subi...
ols.dedicat####.com/sl?feed=####&auth=####&subid=####
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20180627/r20180604/show_ads_impl.js
pic.a####.com/img/only_zj_40901.png
premium####.com/d/46064259b9f90e4c211?sub=####
premium####.com/d/46064259b9f90e4c211?sub=####&code=####
premium####.com/gw?sub=OBTWpBeE9EQTNNRFl4TWpBeE5ESXpOelF3TjE4Mk1ETkFZak5...
real####.icec####.org/module?platform=####&os_version=####&package_name=...
real####.icec####.org/realtime?platform=####&os_version=####&package_nam...
u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...
www.nn####.com/static/game/css/main.css
www.nn####.com/static/game/css/public.min.css
www.nn####.com/static/game/css/swiper.min.css
www.nn####.com/static/game/js/h5_main.js
www.nn####.com/static/game/js/jquery-3.1.1.min.js
www.nn####.com/static/game/js/jquery.lazyload.min.js
www.nn####.com/static/game/js/policy.js
www.nn####.com/static/game/js/swiper.min.js
www.nn####.com/static/game/lib/mmenu/jquery.mmenu.all.css
www.nn####.com/static/game/lib/mmenu/jquery.mmenu.all.js

HTTP POST requests:

androi####.b####.com/index.php/Applist/CheckAppUpdateList
l.a####.com/i.php
l.a####.com/l.php
l.a####.com/sal.php
na####.s####.1####.com:8111/native/api/v1/update
na####.s####.1####.com:8111/native/sdk/api/ad/client_action
na####.s####.1####.com:8111/native/sdk/api/regclient
pl####.mob####.b####.com/ad_dex.php
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
www.admobim####.com/surl/api2_reg.action
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action

Modified file system:

Creates the following files:

/data/data/####/.atmp9.jar
/data/data/####/.atmp_8.log
/data/data/####/ActivatePreUtil.xml
/data/data/####/AdsBusiness-data.xml
/data/data/####/BusinessPreUtil.xml
/data/data/####/LoginPreUtil.xml
/data/data/####/LoginPreUtil.xml.bak
/data/data/####/LoginPreUtil.xml.bak (deleted)
/data/data/####/OfferPreUtil.xml
/data/data/####/SSPPrefe.xml
/data/data/####/adblib.db-journal
/data/data/####/adflash.xml
/data/data/####/adflash_shell.jar
/data/data/####/adflashcore.jar
/data/data/####/ak.native.sdk.xml
/data/data/####/aps.xml
/data/data/####/apsad.xml
/data/data/####/apscomm.xml
/data/data/####/arrkii.native.sdk.db-journal
/data/data/####/arrkiiad.xml
/data/data/####/as.tmp
/data/data/####/black.dat
/data/data/####/checkfinish.xml
/data/data/####/classes.zip
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_s_af.db
/data/data/####/db_s_af.db-journal
/data/data/####/device_info.xml
/data/data/####/downloads.db-journal
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/google.db
/data/data/####/hunter_config.xml
/data/data/####/index
/data/data/####/ls_sp_date.xml
/data/data/####/my.db-journal
/data/data/####/org.ppsspp.ppsspp.id.GodofWar_ls_global_configs_sp.xml
/data/data/####/org.ppsspp.ppsspp.id.GodofWar_preferences.xml
/data/data/####/other_config.xml
/data/data/####/s_sdk_pro_pref.xml
/data/data/####/service_config.xml
/data/data/####/service_config.xml.bak
/data/data/####/settingsLog.xml
/data/data/####/settingsLog.xml.bak
/data/data/####/sp_config.xml
/data/data/####/t.jar
/data/data/####/t.zip
/data/data/####/t_ini.xml
/data/data/####/v71.xml
/data/data/####/v71.xml.bak
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.cuid
/data/media/####/49.x-4.3.5-vs.apk
/data/media/####/PlugShareData
/data/media/####/Plugin.zip
/data/media/####/gads.db
/data/media/####/inapp_dev.txt
/data/media/####/journal.tmp
/data/media/####/plugxml.xml
/data/media/####/s_client.txt
/data/media/####/s_imei.txt
/data/media/####/sp

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
desede-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-NoPadding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
desede-ECB-PKCS5Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial