Android.Xiny.2257

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Appsad.5.origin
Android.Click.171.origin
Android.DownLoader.463.origin
Android.Xiny.220.origin
Android.Xiny.255.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) api.info####.me:80
TCP(HTTP/1.1) globa####.facemoj####.com:80
TCP(HTTP/1.1) 1####.241.255.123:80
TCP(HTTP/1.1) androi####.b####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) dpl.b####.com:80
TCP(HTTP/1.1) h5.nn####.com:80
TCP(HTTP/1.1) xml.v####.com:80
TCP(HTTP/1.1) 1####.adsl####.com:80
TCP(HTTP/1.1) premium####.com:80
TCP(HTTP/1.1) u####.b####.com:80
TCP(HTTP/1.1) ols.dedicat####.com:80
TCP(HTTP/1.1) redi####.re####.pro:80
TCP(HTTP/1.1) d.ryez####.club:80
TCP(HTTP/1.1) medi####.hub.adplat####.io:80
TCP(HTTP/1.1) f####.cdn.1####.com:80
TCP(HTTP/1.1) na####.s####.1####.com:8111
TCP(HTTP/1.1) ibsig####.com:80
TCP(HTTP/1.1) api.l####.com:80
TCP(HTTP/1.1) 21fun####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) mob.media####.club:80
TCP(HTTP/1.1) www.nn####.com:80
TCP(HTTP/1.1) 347460####.world####.pro:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) real####.icec####.org:80
TCP(HTTP/1.1) pop####.net:80
TCP(HTTP/1.1) overt####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) pl####.mob####.b####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) pic.a####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(HTTP/1.1) sp.pop####.net:80
TCP(SSL/3.0) questio####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) c.n####.com:443
TCP(TLS/1.0) s####.ime.b####.jp:443
TCP(TLS/1.0) simejig####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) questio####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) sub.s####.1####.com:7078
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

1####.adsl####.com
21fun####.com
347460####.world####.pro
a####.k####.a####.top
adser####.go####.com
adser####.go####.nl
ak.icec####.org
androi####.b####.com
api.info####.me
api.l####.com
api.mob####.b####.com
c.n####.com
d.ryez####.club
dedicat####.com
dpl.b####.com
f####.cdn.1####.com
f####.google####.com
f####.gst####.com
g####.face####.com
globa####.facemoj####.com
googl####.g.doublec####.net
h5.nn####.com
ibsig####.com
l.a####.com
mob.media####.club
na####.sno####.1####.com
ols.dedicat####.com
overt####.com
pag####.googles####.com
pic.a####.com
pl####.mob####.b####.com
pop####.net
premium####.com
q.medi####.com
questio####.com
real####.icec####.org
redi####.re####.pro
s####.ime.b####.jp
s####.mob####.b####.com
sett####.crashly####.com
simejig####.com
sp.pop####.net
tpc.googles####.com
u####.b####.com
www.admobim####.com
www.go####.com
www.google-####.com
www.googlet####.com
www.mmmmmm####.com
www.nn####.com
xml.v####.com

HTTP GET requests:

1####.adsl####.com/d.php?campaing=####&link_id=####&source=####
21fun####.com/rf/9112585365/pdm?rd=####&u=aHR0c####
347460####.world####.pro/go.php?aid=####
ak.icec####.org/rule?platform=####&os_version=####&package_name=####&app...
androi####.b####.com/index.php/OfferList/getOfferListNew?start=####&limi...
api.info####.me/api/s2s/goto?id=####&channel=####&provider=####&appkey=#...
api.l####.com/redirect?s=####&at=####&rt=####&o=####&s1=####&s2=####&s3=...
api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
d.ryez####.club/Uploads/sa_model/2018/04/2749da811dba0bbce70271d3f37ea7d...
dpl.b####.com/M01/01/AD/CvJKDlnmx1-AEVWqABJ8ZLR4u0M7.4.zip
f####.cdn.1####.com/20180322205013-nativebd152t3
globa####.facemoj####.com/androidI18n/en_US_wordlist.mp3
h5.nn####.com/cid=supergames/
ibsig####.com/rf/9112585365/pdm?rd=####&u=aHR0c####
ibsig####.com/sf/2112585331/e1reUFL?d=####
ibsig####.com/sl?feed=####&auth=####&subid=####
medi####.hub.adplat####.io/cf?id=####&sid=####&subid=####&fid=####
medi####.hub.adplat####.io/r?fid=####&subid=####
mob.media####.club/redirect?feed=####&auth=####&url=####&subid=####&subi...
ols.dedicat####.com/sl?feed=####&auth=####&subid=####
overt####.com/d/46064259b9f90e4c211?sub=####&code=####
overt####.com/d/46801059bf4cd8312d4?sub=####&source=####
overt####.com/d/46801059bf4cd8312d4?sub=####&source=####&code=####
overt####.com/gw?sub=02962714-85dc-4c83-a06d-16e7ae508bab&source=1121&ur...
overt####.com/gw?sub=OBTWpBeE9EQTNNRGt5TURFM01UazFOVEUwTUY4Mk1EVkFXbXBqT...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20180627/r20180604/show_ads_impl.js
pic.a####.com/img/only_zj_40901.png
pop####.net/world/go/166486/434022
premium####.com/d/46064259b9f90e4c211?sub=####
premium####.com/d/46064259b9f90e4c211?sub=####&code=####
premium####.com/gw?sub=OBTWpBeE9EQTNNRGt5TURFM01UazFOVEUwTUY4Mk1EVkFXbXB...
real####.icec####.org/module?platform=####&os_version=####&package_name=...
real####.icec####.org/realtime?p=cGxhd####
redi####.re####.pro/?utm_medium=####&utm_campaign=####&cid=####
redi####.re####.pro/?utm_term=####&clickverify=####&utm_content=####
redi####.re####.pro/proc.php?34b12ef####
sp.pop####.net/go/166486/434022
sp.pop####.net/sgo/ad?p=####&w=####&t=####&r=####&vw=####&vh=####
u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...
www.nn####.com/static/game/css/main.css
www.nn####.com/static/game/css/public.min.css
www.nn####.com/static/game/css/swiper.min.css
www.nn####.com/static/game/js/h5_main.js
www.nn####.com/static/game/js/jquery-3.1.1.min.js
www.nn####.com/static/game/js/jquery.lazyload.min.js
www.nn####.com/static/game/js/policy.js
www.nn####.com/static/game/js/swiper.min.js
www.nn####.com/static/game/lib/mmenu/jquery.mmenu.all.css
www.nn####.com/static/game/lib/mmenu/jquery.mmenu.all.js
xml.v####.com/redirect?feed=####&auth=####&query=####

HTTP HEAD requests:

globa####.facemoj####.com/androidI18n/en_US_wordlist.mp3

HTTP POST requests:

api.info####.me/api/ads/connect
api.info####.me/api/ads/fetch?_s=####
api.info####.me/api/ads/vas?_s=####&
l.a####.com/l.php
l.a####.com/sal.php
na####.s####.1####.com:8111/native/api/v1/update
na####.s####.1####.com:8111/native/sdk/api/ad/client_action
na####.s####.1####.com:8111/native/sdk/api/regclient
pl####.mob####.b####.com/ad_dex.php
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
www.admobim####.com/surl/api2_reg.action
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action

Modified file system:

Creates the following files:

/data/data/####/-17662527460.dat
/data/data/####/-892628820.dat
/data/data/####/.atmp9.jar
/data/data/####/.atmp_8.log
/data/data/####/1526453960888
/data/data/####/1526453964486
/data/data/####/1526453970232
/data/data/####/1526453989147
/data/data/####/1526453997854
/data/data/####/5AFBD6C900AE-0001-0814-1925E9208EE8BeginSession.cls_temp
/data/data/####/5AFBD6C900AE-0001-0814-1925E9208EE8SessionApp.cls_temp
/data/data/####/5AFBD6C900AE-0001-0814-1925E9208EE8SessionDevice.cls_temp
/data/data/####/5AFBD6C900AE-0001-0814-1925E9208EE8SessionOS.cls_temp
/data/data/####/5AFBD6C900AE-0001-0814-1925E9208EE8SessionUser.cls_temp
/data/data/####/5AFBD6C900BB-0001-0808-1925E9208EE8BeginSession.cls_temp
/data/data/####/5AFBD6C900BB-0001-0808-1925E9208EE8SessionApp.cls_temp
/data/data/####/5AFBD6C900BB-0001-0808-1925E9208EE8SessionDevice.cls_temp
/data/data/####/5AFBD6C900BB-0001-0808-1925E9208EE8SessionOS.cls_temp
/data/data/####/5AFBD6C900BB-0001-0808-1925E9208EE8keys.meta
/data/data/####/5AFBD6C900BB-0001-0808-1925E9208EE8user.meta
/data/data/####/ActivatePreUtil.xml
/data/data/####/AdsBusiness-data.xml
/data/data/####/AppEventsLogger.persistedsessioninfo
/data/data/####/BusinessPreUtil.xml
/data/data/####/DasPreferences.xml
/data/data/####/DuKeyboardProvider.db-journal
/data/data/####/LoginPreUtil.xml
/data/data/####/LoginPreUtil.xml.bak
/data/data/####/MO.xml
/data/data/####/OfferPreUtil.xml
/data/data/####/SimejiMainProcesspreference.xml
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/ad_native_client_action_log
/data/data/####/ad_native_client_action_log-journal
/data/data/####/adblib.db-journal
/data/data/####/adflash.xml
/data/data/####/adflash_shell.jar
/data/data/####/adflashcore.jar
/data/data/####/ak.native.sdk.xml
/data/data/####/app.manager-journal
/data/data/####/aps.xml
/data/data/####/apsad.xml
/data/data/####/apscomm.xml
/data/data/####/arrkii.native.sdk.db-journal
/data/data/####/arrkiiad.xml
/data/data/####/as.tmp
/data/data/####/batsdk_crash_switch.xml
/data/data/####/black.dat
/data/data/####/classes.zip
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.simejikeyboard.channel_ls_global_configs_sp.xml
/data/data/####/com.simejikeyboard.channel_preferences.xml
/data/data/####/das_action_file.data
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_s_af.db
/data/data/####/db_s_af.db-journal
/data/data/####/device_info.xml
/data/data/####/dictsDataNew
/data/data/####/dictsDataOld
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/google.db
/data/data/####/hunter_config.xml
/data/data/####/im.database.ad-journal
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.u.xml
/data/data/####/main.mp3
/data/data/####/main.mp3.temp
/data/data/####/my.db
/data/data/####/my.db-journal
/data/data/####/other_config.xml
/data/data/####/profile_enable_subtype.xml
/data/data/####/s_sdk_pro_pref.xml
/data/data/####/sa_18d278e6-b997-4600-8fd2-5bbc6614cc75_1526453965515.tap
/data/data/####/sa_25f68008-c054-4683-8f8a-ead7513fc855_1526453963919.tap
/data/data/####/service_config.xml
/data/data/####/service_config.xml.bak
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap (deleted)
/data/data/####/session_analytics.tap.tmp
/data/data/####/settingsLog.xml
/data/data/####/simeji_multi_preference.xml
/data/data/####/sp_config.xml
/data/data/####/t.jar
/data/data/####/t.zip
/data/data/####/t_ini.xml
/data/data/####/v71.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.cuid
/data/media/####/.nomedia
/data/media/####/.user
/data/media/####/2018-05-16.txt
/data/media/####/49.x-5.0.4.apk
/data/media/####/5ee6c1297c3410ed8fd45b9d598e8646.0.tmp
/data/media/####/5ee6c1297c3410ed8fd45b9d598e8646.1.tmp
/data/media/####/79ea7b129a66db9c865bd495a434fb09.0.tmp
/data/media/####/79ea7b129a66db9c865bd495a434fb09.1.tmp
/data/media/####/877d83452bd0f0da669c7cfb1c6530fc.0.tmp
/data/media/####/877d83452bd0f0da669c7cfb1c6530fc.1.tmp
/data/media/####/PlugShareData
/data/media/####/Plugin.zip
/data/media/####/d2a859607267f6daa331bfcb232ce40e.0.tmp
/data/media/####/d2a859607267f6daa331bfcb232ce40e.1.tmp
/data/media/####/files.db
/data/media/####/gads.db
/data/media/####/inapp_dev.txt
/data/media/####/journal.tmp
/data/media/####/plugxml.xml
/data/media/####/s_client.txt
/data/media/####/s_imei.txt
/data/media/####/sp
/data/media/####/syncfiles.db

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq

Loads the following dynamic libraries:

CrabNative
crashlytics
das
gifimage
imagepipeline

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
desede-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-NoPadding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
desede-ECB-PKCS5Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial