Android.DownLoader.1881

Technical information

Malicious functions:

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

s####.####.com
i####.####.cn
g####.####.com
h####.####.com
i####.####.com
c####.####.net
7j####.####.com
c-h####.####.com
d####.####.com
a####.####.cn
dce####.####.com
a####.####.com

HTTP GET requests:

i####.####.com/uploads/icons/0/e/0e6ba17079fb398a8f8323c9bae8417e.png
a####.####.com/store/static/kvt/339f4e6d9208da324e30b4930c2d6c72.png
i####.####.com/launch/a/b/abdd0b26bb3ec2fc492261f4dfb175aa.jpg
i####.####.com/uploads/icons/f/3/f38ba4a82b60352fa9d3705156ac11fd.png
i####.####.com/uploads/icons/6/c/6ca9375e7cd5a3a97cce40df1cedee7b.png
i####.####.com/icons/6/b/6bdfe0d7ff92579721360b11faae5df3.png
dce####.####.com/api/start
i####.####.cn/2016/8/11/13976784_.jpg
i####.####.com/uploads/icons/8/8/889d66d5ff4cf2e5db62cdfb8f34462e.png
i####.####.com/uploads/icons/0/d/0d5c68d9dc40a376b301fad5c9f8e2ea.png
i####.####.com/uploads/icons/1/0/10cdedbd8078caa8df86fecd1f09dcfc.png
i####.####.com/uploads/icons/c/a/caad6200cec69bb86e7ca1c0da16f911.png
g####.####.com/img/0/512_512/6f0fdba85d51d96be6950d46ab177adb.png
dce####.####.com/api/index
i####.####.com/uploads/icons/f/7/f703a473d25b98facd5bebe49e548d65.png
i####.####.com/uploads/icons/6/9/6937e88d497e6255ab3c96c4d7df11bb.png
a####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
7j####.####.com/tdata_Oxl942
dce####.####.com/api/ranking?type=####&page=####
i####.####.com/uploads/icons/d/0/d004bf0cd2624405b7fc2203c438f63d.png
s####.####.com/config/hz-hzv3.conf
g####.####.com/img/0/512_512/362bb670d71be75b6b6e14f5c60ae43a.png
i####.####.com/uploads/icons/b/a/baed28484bc42fd1016ae1818dc5aae0.png
i####.####.com/uploads/icons/b/9/b9570f8d0d016084f983fa5435850a1a.jpg
7j####.####.com/tdata_Hhd935
i####.####.com/uploads/icons/2/9/296c435f806bee9ad4f1effa10003aec.png
i####.####.com/uploads/icons/d/1/d1caa9e89e0549541a852732b6f52cc7.png
dce####.####.com/api/clients/releases/latest
i####.####.com/uploads/icons/c/b/cb4a18690466416086918cf7e31568b0.png
i####.####.cn/2016/8/23/14065814_.png
dce####.####.com/api/game/manage?data=####
i####.####.com/gcenter.json
g####.####.com/img/0/512_512/67189ba5518b019fee4ebe0a19128a10.png
i####.####.com/uploads/icons/2/d/2d9d457b1b647d8004c459da65cb8cbe.png
i####.####.com/uploads/icons/0/9/0957808717878cb0e6bd369d06855f3c.png
i####.####.com/uploads/icons/3/f/3fa131a97c900d52cd3595b2b6cb2a48.png

HTTP POST requests:

c####.####.net/config/update
h####.####.com/app.gif
c####.####.net/async/dc/appstore
s####.####.com/api.php?format=####&t=####
s####.####.com/cw/cp.action?requestId=####&g=####
d####.####.com/api/sdk/reportactive?cuid=####&svr=####&ovr=####&device=####&app_id=####&channel_id=####&sdk=####
s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
a####.####.com/app_logs
d####.####.com/api/sdk/activate?cuid=####&svr=####&ovr=####&device=####&app_id=####&channel_id=####&sdk=####
c-h####.####.com/api.php?format=####&t=####
dce####.####.com/

Modified file system:

Creates the following files:

/sdcard/Android/data/####/cache/-1104418711
/data/data/####/files/init.pid
/data/data/####/databases/download.db
/sdcard/Android/data/####/cache/117451587.tmp
/data/data/####/shared_prefs/dc.current.preferences.xml.bak
/sdcard/backups/system/.timestamp
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/Android/data/####/cache/-1819145262.tmp
/data/data/####/databases/Staistics-journal
/data/data/####/databases/pushg.db-journal
/data/data/####/files/.imprint
/sdcard/libs/####.db
/data/data/####/shared_prefs/loadingImg.xml
/sdcard/Android/data/####/cache/-1631392728.tmp
/sdcard/Android/data/####/cache/136081776.tmp
/data/data/####/files/__local_stat_cache.json
/data/data/####/files/__local_ap_info_cache.json
/data/data/####/shared_prefs/a.xml
/data/data/####/shared_prefs/W_Key.xml.bak
/sdcard/Android/data/####/cache/600802286.tmp
/sdcard/.SystemService/appids.dat
/data/data/####/databases/increment.db-journal
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/data/data/####/files/init_c.pid
/sdcard/system/tmp/local/tdata_Hhd935
/data/data/####/databases/downloadswc
/sdcard/Download/fts/4.3_hyjwan.jar.tmp
/data/data/####/shared_prefs/hj_datasdk_settings.xml
/sdcard/backups/system/.confd
/data/data/####/files/libcuid.so
/data/data/####/files/run.pid
/data/data/####/files/tdata_Hhd935
/data/data/####/shared_prefs/setting.xml
/data/data/####/shared_prefs/hj_datasdk_settings.xml.bak
/sdcard/Android/data/####/cache/-92325294.tmp
/data/data/####/databases/Staistics
/sdcard/Android/data/####/cache/diskCache/journal
/data/data/####/shared_prefs/dc.current.preferences.xml
/sdcard/Android/data/####/cache/-1243769352.tmp
/sdcard/Android/data/####/cache/-284201199.tmp
/data/data/####/shared_prefs/version.xml
/sdcard/dt/restime.dat
/data/data/####/files/tdata_Hhd935.jar
/data/data/####/shared_prefs/requisite.xml
/sdcard/Android/data/####/cache/936161128.tmp
/sdcard/huanju/data/config.properties
/sdcard/.xy
/data/data/####/files/umeng_it.cache
/sdcard/Android/data/####/cache/.nomedia
/sdcard/Android/data/####/cache/-157062072.tmp
/sdcard/Android/data/####/cache/1324000105.tmp
/sdcard/system/tmp/local/tdata_Oxl942
/sdcard/Android/data/####/cache/-1474212434.tmp
/sdcard/Android/data/####/cache/550333925.tmp
/data/data/####/files/push.pid
/sdcard/Android/data/####/cache/diskCache/3514e7cb671ee7a06b1ed6bc22c14dac.0
/data/data/####/databases/pushsdk.db-journal
/data/data/####/files/tdata_Oxl942
/sdcard/backups/.SystemConfig/.cuid2
/sdcard/Android/data/####/cache/diskCache/journal.tmp
/data/data/####/files/gdaemon_20161017
/sdcard/Android/data/####/cache/-1581635941.tmp
/data/data/####/shared_prefs/packverson.xml
/data/data/####/shared_prefs/versionUpdate.xml
/data/data/####/databases/favorite
/data/data/####/databases/download.db-journal
/data/data/####/shared_prefs/loadingImg.xml.bak
/data/data/####/shared_prefs/st.xml
/data/data/####/files/__local_last_session.json
/sdcard/Android/data/####/cache/-2102691441.tmp
/data/data/####/shared_prefs/LTBL_Game.xml
/sdcard/Android/data/####/cache/1743144276.tmp
/data/data/####/files/tdata_Oxl942.jar
/sdcard/Android/data/####/cache/-2063815759.tmp
/sdcard/huanju/.cuid
/sdcard/Android/data/####/cache/-828775639.tmp
/data/data/####/shared_prefs/dc.C530161078E360C0E85CBFE1C87C8B42D.preferences.xml.bak
/data/data/####/databases/downloadswc-journal
/sdcard/libs/com.getui.sdk.deviceId.db
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/databases/favorite-journal
/data/data/####/databases/dataeye_database_C530161078E360C0E85CBFE1C87C8B42D.db
/data/data/####/databases/pushext.db-journal
/sdcard/.SystemService/C530161078E360C0E85CBFE1C87C8B42D/uid
/data/data/####/shared_prefs/configs.xml
/data/data/####/shared_prefs/dc.C530161078E360C0E85CBFE1C87C8B42D.preferences.xml
/sdcard/Android/data/####/cache/diskCache/913131af4b69784214eeadb760297e24.0
/data/data/####/shared_prefs/gx_sp.xml
/sdcard/libs/com.igexin.sdk.deviceId.db
/sdcard/Android/data/####/cache/-1931391528.tmp
/sdcard/Android/data/####/cache/-375219581.tmp
/sdcard/backups/system/.confd-journal
/sdcard/Android/data/####/cache/-2130181705.tmp
/sdcard/Android/data/####/cache/426379801
/data/data/####/shared_prefs/W_Key.xml
/sdcard/libs/app.db
/sdcard/TiantianGame/cachePic/480437123e68d25a478a41bc69b835a9
/data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
/sdcard/Android/data/####/cache/-1364950492.tmp
/sdcard/Android/data/####/cache/1971932020.tmp
/data/data/####/shared_prefs/####_preferences.xml.bak
/sdcard/backups/.SystemConfig/.cuid
/data/data/####/databases/dataeye_database_C530161078E360C0E85CBFE1C87C8B42D.db-journal
/data/data/####/files/__send_data_1485423388772

Sets the 'executable' attribute to the following files:

/data/data/####/files/gdaemon_20161017

Miscellaneous:

Executes next shell scripts:

chmod 700 /data/data/####/files/gdaemon_20161017
/data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24837 300 0
/system/bin/sh
chmod 777 /data/data/####/cache
getprop ro.miui.ui.version.name
chmod 777 /data/data/####/cache/apk

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial