Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- t####.####.com
- d####.####.cn
- c####.####.com
- uf####.####.com
- t####.####.cn
- m####.####.com
- a####.####.com
HTTP GET requests:
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- t####.####.cn/ggjc/update/20160419/051b9af8ab47201402ec4c46da12683c-22.d...
- t####.####.cn/ggjc/update/20151127/7672b8ff8aa64ae89d886be1700d0f00-47.d...
HTTP POST requests:
- t####.####.com/2.0/cu?auth_ver=####&appkey=####&nonce=####&is=####&model...
- c####.####.com/batsdk/api_int/newsync2
- uf####.####.com/?m=####&a=####
- m####.####.com/api?action=####&from=####&token=####&type=####&index=####
- s####.####.com/cw/cp.action?requestId=####&g=####
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.com/app_logs
- m####.####.com/api?from=####&token=####&type=####&index=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/z-journal
- <Package Folder>/databases/sk-journal
- <Package Folder>/databases/jp.db
- <Package Folder>/databases/jp.db-journal
- <Package Folder>/databases/app_launch_cache.db-journal
- <Package Folder>/databases/ye_largedirs.db
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/rt.xml
- <Package Folder>/files/smartpriv1684313590.out
- <Package Folder>/databases/d
- <Package Folder>/databases/i
- <Package Folder>/shared_prefs/ye_trash.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/files/bw.db
- <Package Folder>/databases/z
- <Package Folder>/databases/sk
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/DianxinDXB.xml
- <Package Folder>/files/process_white_list.txt
- <Package Folder>/databases/download_table
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/zyi/sptool
- <Package Folder>/databases/d.db-journal
- <Package Folder>/databases/smart_priv.db-journal
- <Package Folder>/shared_prefs/app-update-prefs.xml
- <Package Folder>/shared_prefs/h.xml
- <Package Folder>/files/authrate.dat
- <Package Folder>/databases/ye_app_trash.db
- <Package Folder>/shared_prefs/ye_db_configs.xml
- <Package Folder>/files/smart_priv.db
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/re_po_rt.xml
- <Package Folder>/databases/d-journal
- <Package Folder>/files/zyi/loadr9
- <Package Folder>/shared_prefs/superrootcfg.xml.bak
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/files/.tmp/flg
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/zyi/r9-295a441r9.ad.odex
- <Package Folder>/app_ye_download/db_apptrash
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/batsdk_crash_switch.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/databases/perm.db-journal
- <Package Folder>/cache/su
- <Package Folder>/cache/chattr
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/d.xml
- <Package Folder>/files/zyi/libr9um.so
- <Package Folder>/shared_prefs/batsdk_user_info.xml
- <Package Folder>/files/zyi/libr9-56ab088r9.ad.so
- <Package Folder>/shared_prefs/leroadcfg.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/bw.db
- <Package Folder>/databases/bw.db-journal
- <Package Folder>/files/proguard
- <Package Folder>/shared_prefs/superrootcfg.xml
- <Package Folder>/databases/ye_app_trash.db-journal
- <Package Folder>/databases/tpgcc.db-journal
- <Package Folder>/shared_prefs/leroadcfg.xml
- <Package Folder>/databases/download_table-journal
- <Package Folder>/files/zyi/r9.jar
- <Package Folder>/shared_prefs/batsdk_app_life.xml
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/__send_data_1495016991509
- <Package Folder>/files/smartpriv1970885244.out
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/re_po_rt.xml.bak
- <Package Folder>/shared_prefs/config_update.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/install-recovery.sh
- <Package Folder>/shared_prefs/utils.xml
- <Package Folder>/files/su
- <Package Folder>/files/permdata.dat
- <Package Folder>/shared_prefs/ye_db_configs.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/bp-4.0-arm.src
- <Package Folder>/databases/smart_priv.db
- <Package Folder>/files/smartpriv815385531.out
- <Package Folder>/files/insdog
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/libcuid.so
- <Package Folder>/shared_prefs/config_update.xml
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/bp10
- <Package Folder>/files/jp.db
- <Package Folder>/databases/i-journal
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/files/bp10
- chmod 664 <Package Folder>/files/zyi/libr9-56ab088r9.ad.so
- touch /system/etc/.has_dxsu_daemon
- sh -c dumpsys package com.baidu.superservice 2>/dev/null
- chmod 664 <Package Folder>/files/zyi/loadr9
- dumpsys package com.dianxinos.superuser
- chmod 664 /data/data/####/files/zyi/sptool
- <Package Folder>/cache/chattr -ai /system/bin/su
- chmod 751 <Package Folder>/files/insdog
- chmod 6755 /system/xbin/su
- <Package Folder>/cache/chattr -ai /system/xbin/su
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2169 --user 0
- sh <Package Folder>/files/bp10 --check-version
- /system/bin/su
- id
- ps
- ln -s /system/xbin/su /system/bin/su
- <Package Folder>/cache/chattr +ai /system/etc/install-recovery.sh
- ls -l <Package Folder>
- chmod 751 /data/data/####/files/insdog
- <Package Folder>/cache/chattr +ai /system/xbin/su
- dumpsys package com.baidu.superroot
- su -v
- /system/xbin/su -v
- su
- chmod 755 <Package Folder>/files/proguard
- /system/bin/cat /proc/meminfo
- chmod 664 /data/data/####/files/zyi/libr9-56ab088r9.ad.so
- /system/bin/cat /sys/block/mmcblk2/device/cid
- chmod 664 <Package Folder>/files/zyi/libr9um.so
- sh -c dumpsys package com.dianxinos.superuser 2>/dev/null
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
- rm /system/bin/su
- /system/xbin/su
- dumpsys package com.zhiqupk.root
- chmod 664 /data/data/####/files/zyi/libr9um.so
- /system/bin/bp10 --check-version
- chmod 755 <Package Folder>/files/su
- /system/bin/getenforce
- sh -c dumpsys package com.baidu.superroot 2>/dev/null
- mount -o remount,rw /dev/block/sda1 /system
- chmod 664 /data/data/####/files/zyi/r9-295a441r9.ad.jar
- /system/bin/cat /sys/block/mmcblk0/device/cid
- /system/bin/cat /sys/block/mmcblk1/device/cid
- /system/bin/cat /sys/block/mmcblk3/device/cid
- chmod 755 /data/data/####/files/bp10
- chmod 755 <Package Folder>/files/chattr
- rm /system/xbin/su
- dumpsys package com.baidu.superservice
- <error:2>
- /system/xbin/su --daemon
- /data/data/####/files/bp10 --check-version
- sh -c dumpsys package com.zhiqupk.root 2>/dev/null
- chmod 664 <Package Folder>/files/zyi/r9-295a441r9.ad.jar
- sh
- sync
- mount -o remount,ro /dev/block/sda1 /system
- chmod 664 <Package Folder>/files/zyi/sptool
- chmod 755 /system/etc/install-recovery.sh
- <dexopt>
- chmod 664 /data/data/####/files/zyi/loadr9
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
