Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ipv6-wi####.appl####.com.####.net:80
- TCP(HTTP/1.1) a.sm####.cn:80
- TCP(HTTP/1.1) 2####.243.193.48:80
- TCP(HTTP/1.1) qq.com.yuchan####.####.cn:80
- TCP(HTTP/1.1) d.weixu####.com.####.com:80
- TCP(HTTP/1.1) app.appsf####.com:80
- TCP(HTTP/1.1) applovi####.edg####.net:80
- TCP(HTTP/1.1) 2####.243.193.33:80
- TCP(HTTP/1.1) yes.yuchan####.com.cn:80
- TCP(TLS/1.0) api.face####.com:443
DNS requests:
- a.appl####.com
- a.sm####.cn
- app.appsf####.com
- as####.appl####.com
- d.appl####.com
- d.weixu####.com.cn
- g####.face####.com
- img.appl####.com
- pr####.appl####.com
- qq.com.yuchan####.####.cn
- r####.appl####.com
- r.eli####.cn
- rt.appl####.com
- yes.yuchan####.com.cn
HTTP GET requests:
- app.appsf####.com/com.turbochilli.rollingsky?pid=####&af_c_id=####&af_cl...
- applovi####.edg####.net/o8adb692/72fd34007298a34c59f04bc149ad3532b7ecd11...
- applovi####.edg####.net/o8adb692/79b209ea4a6a5a5e55b6cc931e88142785ba1eb...
- applovi####.edg####.net/oaf48081/8f8ea5881e917d58134d814825b79da304b6eca...
- applovi####.edg####.net/ob13c7a6/3c8e73e699fc5dbb8faef370c381f45b32d5f68...
- applovi####.edg####.net/ob13c7a6/7dee2ce541bc0aa6abd8645bc1d51d2b2051290...
- applovi####.edg####.net/ob13c7a6/cdf0c27cd38743c72562685bb12a1dcfe3a3bd3...
- applovi####.edg####.net/ob13c7a6/edec24b38c56cc4e51e7cb6247917b29d2ec2b1...
- d.weixu####.com.####.com/2011/gou.jar
- d.weixu####.com.####.com/2011/lvs.jar
- ipv6-wi####.appl####.com.####.net/1380229154.js
- ipv6-wi####.appl####.com.####.net/1476158467_512x512_opt_v1.png
- ipv6-wi####.appl####.com.####.net/2.0/ad?v1=####&model=####&dx=####&dy=#...
- ipv6-wi####.appl####.com.####.net/2.0/ad?v1=####&model=####&etf=####&dx=...
- ipv6-wi####.appl####.com.####.net/imp?clcode=####&placement=####
- ipv6-wi####.appl####.com.####.net/jquery-1.9.1.min.js
- ipv6-wi####.appl####.com.####.net/jquery-2.1.1.min.js
- ipv6-wi####.appl####.com.####.net/jquery.knob.js
- ipv6-wi####.appl####.com.####.net/nad?v1=####&model=####&dx=####&dy=####...
- ipv6-wi####.appl####.com.####.net/playable/RTB_Short_p_02.js
- ipv6-wi####.appl####.com.####.net/playable/RollingSky_V2_l_03.js
- ipv6-wi####.appl####.com.####.net/playable/RollingSky_V2_p_03.js
- ipv6-wi####.appl####.com.####.net/playable/abi_V1_p_04.js
- ipv6-wi####.appl####.com.####.net/playable/c2_pathfind_02.min.js
- ipv6-wi####.appl####.com.####.net/playable/playable_close.png
- ipv6-wi####.appl####.com.####.net/playable/playable_fallback.png
- ipv6-wi####.appl####.com.####.net/playable/playable_loader.gif
- ipv6-wi####.appl####.com.####.net/redirect?clcode=####&did=####&eventid=...
- ipv6-wi####.appl####.com.####.net/sound_off.png
- ipv6-wi####.appl####.com.####.net/sound_on.png
- ipv6-wi####.appl####.com.####.net/vid?clcode=####&event=####&placement=#...
HTTP POST requests:
- a.sm####.cn/cw/cp.action?requestId=####&g=####
- a.sm####.cn/k1?requestId=####&g=####&ua=####
- ipv6-wi####.appl####.com.####.net/device?api_key=####
- ipv6-wi####.appl####.com.####.net/pix?event=####&ts=####&platform=####&m...
- qq.com.yuchan####.####.cn/cw/interface!u2.action?protocol=####&version=#...
- yes.yuchan####.com.cn/k2?protocol=####&version=####&cid=####
Modified file system:
Creates the following files:
- /data/data/####/ActivityPREF.xml
- /data/data/####/FBAdPrefs.xml
- /data/data/####/SDKIDFA.xml
- /data/data/####/W_Key.xml
- /data/data/####/a.xml
- /data/data/####/com.applovin.interstitial.sharedpreferences.xml
- /data/data/####/com.applovin.sdk.1.xml
- /data/data/####/com.applovin.sdk.1.xml.bak
- /data/data/####/com.applovin.sdk.impl.postbackQueue.domain.xml
- /data/data/####/com.xshexian.tijian.net_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/index
- /data/data/####/st.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/1380229154.js
- /data/media/####/1476158467_512x512_opt_v1.png
- /data/media/####/4.6_lvs.jar
- /data/media/####/4.8_gou.jar.tmp
- /data/media/####/79b209ea4a6a5a5e55b6cc931e88142785ba1ebd_v23_phone.mp4
- /data/media/####/8f8ea5881e917d58134d814825b79da304b6eca5_v23_phone.mp4
- /data/media/####/cdf0c27cd38743c72562685bb12a1dcfe3a3bd3b_v23_phone.mp4
- /data/media/####/edec24b38c56cc4e51e7cb6247917b29d2ec2b1b_v23_phone.mp4
- /data/media/####/jquery-1.9.1.min.js
- /data/media/####/jquery-2.1.1.min.js
- /data/media/####/jquery.knob.js
- /data/media/####/o8adb692_72fd34007298a34c59f04bc149ad3532b7ecd...ne.png
- /data/media/####/ob13c7a6_3c8e73e699fc5dbb8faef370c381f45b32d5f...e.jpeg
- /data/media/####/ob13c7a6_7dee2ce541bc0aa6abd8645bc1d51d2b20512...e.jpeg
- /data/media/####/playable_RTB_Short_p_02.js
- /data/media/####/playable_RollingSky_V2_p_03.js
- /data/media/####/playable_abi_V1_p_04.js
- /data/media/####/playable_c2_pathfind_02.min.js
- /data/media/####/playable_playable_close.png
- /data/media/####/playable_playable_fallback.png
- /data/media/####/playable_playable_loader.gif
- /data/media/####/restime.dat
- /data/media/####/sound_off.png
- /data/media/####/sound_on.png
Miscellaneous:
Loads the following dynamic libraries:
- dcae
- rbd
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
