Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- 1####.####.211
- a####.####.com
- c####.####.com
- d####.####.cn
- g####.####.com
- h####.####.com
- l####.####.com
- mo####.####.com
- mobads-####.####.com
- p####.####.com
- pco####.####.com
- pl####.####.com
- r####.####.com
- s####.####.com
- st####.####.com
- ub####.####.com
- w####.####.com
- y####.####.com
HTTP GET requests:
- 1####.####.211/mobads.php?7j_K000####&ck=####
- c####.####.com/cpro/ui/noexpire/img/sdk_banner_base_new/tuwen-icon-downl...
- d####.####.cn/jarFile/SDKAutoUpdate/newmon.jar
- g####.####.com/alilog/??s/7.5.1####
- g####.####.com/yt/youkuplayer.fdl.h5send?cache=####&gmkey=####&gokey=###...
- h####.####.com/hm.js?f5bf2d0####
- l####.####.com/yt.gif?logtype=####&title=####&pre=####&cache=####&scr=##...
- mo####.####.com/cpro/ui/mads.php?code2=####&b1496212864171=####
- mobads-####.####.com/upload/apps/baidusearch_AndroidPhone_1019902zac2bf9...
- p####.####.com/play/get.json?vid=XMT####&ct=####&ran=####
- pco####.####.com/app.gif?&cna=####
- pl####.####.com/mb?aw=####&vs=####&pver=####&tict=####&vr=####&wintype=#...
- r####.####.com/0541010157B061E6641DA422DBC29992
- st####.####.com/h5/player/res/img/new_loading.png
- ub####.####.com/media/v1/0f00026sg2NPd7socVbdDf.png
- w####.####.com/adx.php?c=####&ext=####
- y####.####.com/yt/vp.event?t=####&e=####&v=####&d=####&x=dj1oN####&cna=#...
HTTP POST requests:
- a####.####.com/app_logs
- mobads-####.####.com/brwhis.log
- s####.####.com/cw/interface!u2.action?protocol=####&version=####
Modified file system:
Creates the following files:
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__0c0324ea-e89a-4c2f-b0fb-9aac6f2bc3fc.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__bf720de0-5ed8-4d60-95f1-329991830fe9.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/index
- <Package Folder>/databases/Hawk
- <Package Folder>/databases/Hawk-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/shared_prefs/__sdk_ral.xml
- <Package Folder>/shared_prefs/__sdk_ral.xml.bak
- <Package Folder>/shared_prefs/__sdk_remote_dl_2.xml
- <Package Folder>/shared_prefs/__x_adsdk_agent_header__.xml
- <Package Folder>/shared_prefs/__xadsdk_downloaded__version__.xml
- <Package Folder>/shared_prefs/baidu_mobads_shoubai_dl_ts.xml
- <Package Folder>/shared_prefs/baidu_mobads_shoubailp.xml
- <Package Folder>/shared_prefs/baidu_mobads_shoubailp.xml.bak
- <Package Folder>/shared_prefs/cdata.xml
- <Package Folder>/shared_prefs/com.baidu.mobads.loader.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Download/####/3.7_newmon.jar.tmp
- <SD-Card>/bddownload/a44295617d82746d3274bd5bf4623600.apk.tmp
- <SD-Card>/cw/assetstime.dat
Miscellaneous:
Executes next shell scripts:
- <dexopt>
