Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) mv.65####.com:8757
- TCP(HTTP/1.1) and####.appc####.com:80
- TCP(HTTP/1.1) a.sm####.cn:80
- TCP(HTTP/1.1) i####.jd.com:80
- TCP(HTTP/1.1) 1####.228.233.154:80
- TCP(HTTP/1.1) i####.j####.com:80
- TCP(HTTP/1.1) d.xiongj####.com.####.com:80
- TCP(HTTP/1.1) w####.x.jd.com:80
- TCP(HTTP/1.1) bj.imp.voic####.cn:80
- TCP(HTTP/1.1) 1####.228.233.205:80
- TCP(HTTP/1.1) e.xiongj####.com.cn:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(TLS/1.0) api.map.b####.com:443
- TCP(TLS/1.0) and####.appc####.com:443
- TCP(TLS/1.0) regi####.xm####.xi####.com:443
DNS requests:
- a####.u####.com
- a.sm####.cn
- api.map.b####.com
- bj.imp.voic####.cn
- d.xiongj####.com.cn
- e.xiongj####.com.cn
- i####.360bu####.com
- i####.jd.com
- mv.65####.com
- pi####.qq.com
- regi####.xm####.xi####.com
- w####.x.jd.com
- www.xiaoxio####.com
HTTP GET requests:
- and####.appc####.com/api/app_ad.php?a=####&adtype=####&stattype=####&eid...
- bj.imp.voic####.cn/ad/impress?impressId=####&traceId=####&inAId=####&wPl...
- d.xiongj####.com.####.com/jarFile/SDKAutoUpdate/lvs.jar
- i####.j####.com/pop/jfs/t7957/29/1963257916/296416/ff2eb3c0/59a65adfNb72...
- i####.jd.com/dsp/np?log=####&v=####&seq=####&n=####&p=####
- w####.x.jd.com/adx/nurl/xunfei?price=####&v=####&ad=####&info=####
HTTP POST requests:
- mv.65####.com:8757/sdk.html
- pi####.qq.com/mstat/report/?index=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/oil_db-journal
- <Package Folder>/databases/pri_wxop_tencent_analysis.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/wxop_tencent_analysis.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/mobclick_agent_cached_<Package>74
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/.mta-wxop.xml
- <Package Folder>/shared_prefs/.mta-wxop.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/authStatus_<Package>.xml
- <Package Folder>/shared_prefs/authStatus_<Package>;pushservice.xml
- <Package Folder>/shared_prefs/com.firebear.androil_preferences.xml
- <Package Folder>/shared_prefs/mipush.xml
- <Package Folder>/shared_prefs/mipush.xml.bak
- <Package Folder>/shared_prefs/mipush_extra.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/4mo80t34znl1bj7p9829mc7cp.0.tmp
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/log.lock
- <SD-Card>/Android/####/log1.txt
- <SD-Card>/Download/####/4.6_lvs.jar.tmp
- <SD-Card>/Tencent/####/.mid.txt
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
Loads the following dynamic libraries:
- BaiduMapSDK_base_v4_1_1
- uti
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
