Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- wea####.####.com
- t####.####.com
- laun####.####.com
- launche####.####.com
- d####.####.cn
- y####.####.cn
- a####.####.com
HTTP GET requests:
- t####.####.com/8ff54ced852782d61c229e9ff4b484a7?vc=####
- launche####.####.com/api/location/?deviceId=####&root=####&system=####&v...
- wea####.####.com/cb02b8772f2b6a2b877f53dfaa325aa4
- launche####.####.com/api/location/getfiles/?deviceId=####&root=####&syst...
- launche####.####.com/api/ilaucherclient/upgrade/?version_code=####&devic...
- launche####.####.com/api/ads/source/?channel=####&deviceId=####&root=###...
- launche####.####.com/api/feedback/pull/?deviceId=####&root=####&system=#...
- launche####.####.com/api/adposition/list/?channel=####&deviceId=####&roo...
- y####.####.cn/k2?protocol=####&version=####&cid=####
- d####.####.cn/jarFile/SDKAutoUpdate/hot.jar
- launche####.####.com/api/advancedown/?deviceId=####&root=####&system=###...
- launche####.####.com/api/ads/
- launche####.####.com/api/checklatesttheme/?deviceId=####&root=####&syste...
HTTP POST requests:
- a####.####.com/app_logs
- y####.####.cn/k1?requestId=####&g=####
- laun####.####.com/ilaucher/
- laun####.####.com/ilaucher_appcategory/
Modified file system:
Creates the following files:
- /sdcard/Android/data/####/theme/ios20160118/screenshots/1.jpg
- /data/data/####/databases/downloadswc-journal
- /sdcard/Android/data/####/theme/ios20160118/icons/app__gallery.png
- /sdcard/Android/data/####/file/OS_market.png
- /sdcard/dt/restime.dat
- /sdcard/Android/data/####/theme/ios20160118/icons/app_googleplus.png
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Android/data/####/theme/ios20160118/icons/boost_bg.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app_facebook.png
- /sdcard/Android/data/####/temp/os9theme
- /sdcard/Download/bu/4.8_hot.jar.tmp
- /sdcard/Android/data/####/theme/ios20160118/icons/home_setting.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app__dialer.png
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/umeng_it.cache
- /data/data/####/cache/webviewCacheChromium/data_1
- /sdcard/Android/data/####/theme/ios20160118/icons/app__text.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app__map.png
- /sdcard/Android/data/####/theme/ios20160118/pic.jpg
- /data/data/####/shared_prefs/a.xml.bak
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Android/data/####/theme/ios20160118/icons/app_chrome.png
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/Android/data/####/file/weather
- /data/data/####/databases/laucher.db-journal
- /sdcard/Android/data/####/theme/ios20160118/icons/calendar_bg.png
- /sdcard/Android/data/####/theme/ios20160118/wallpaper1.jpg
- /sdcard/Android/data/####/theme/ios20160118/icons/app__music.png
- /sdcard/Android/data/####/theme/ios20160118/screenshots/2.jpg
- /sdcard/Android/data/####/theme/ios20160118/icons/app__camera.png
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/theme/ios20160118/icons/app__download.png
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/Android/data/####/theme/ios20160118/icons/app_store.png
- /data/data/####/files/.imprint
- /sdcard/Android/data/####/theme/ios20160118/icons/app_google.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app_gmail.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app__videos.png
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/ads-1950661490.jar
- /sdcard/Android/data/####/theme/ios20160118/wallpaper2.jpg
- /sdcard/Android/data/####/theme/ios20160118/icons/app_gamecenter.png
- /sdcard/Android/data/####/theme/ios20160118/icons/weather_bg.png
- /data/data/####/databases/weather_manage.db-journal
- /sdcard/Android/data/####/theme/ios20160118/themeInfo.xml
- /sdcard/Android/data/####/theme/ios20160118/wallpaper3.jpg
- /sdcard/Android/data/####/theme/ios20160118/icons/app__contacts.png
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/mobclick_agent_cached_####5661
- /sdcard/Android/data/####/theme/ios20160118/icons/app_wallpaper.png
- /data/data/####/shared_prefs/st.xml
- /sdcard/Android/data/####/file/citys.db
- /sdcard/Android/data/####/theme/ios20160118/icons/app__calculator.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app_youtube.png
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/Android/data/####/theme/ios20160118/icons/app_theme.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app__mail.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app__gsettings.png
- /data/data/####/shared_prefs/a.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/Android/data/####/file/OS_market_origin.png
- /data/data/####/shared_prefs/W_Key.xml
- /sdcard/Android/data/####/theme/ios20160118/icons/app__clock.png
- /sdcard/Android/data/####/theme/ios20160118/widgetInfo.xml
- /sdcard/Android/data/####/theme/ios20160118/icons/app__browser.png
- /data/data/####/cache/ApplicationCache.db-journal
- /sdcard/Android/data/####/theme/ios20160118/icons/app__settings.png
- /data/data/####/databases/downloadswc
- /data/system/users/0/wallpaper
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/Android/data/####/theme/ios20160118/icons/app_common_bg.png
- /sdcard/Android/data/####/theme/ios20160118/icons/app_com_google_android_talk.png
Sets the 'executable' attribute to the following files:
- /data/system/users/0/wallpaper
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 48 40 9492 /data/data/####/cache/ads-1950661490.jar 1196647013 1005487570 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- /system/bin/dexopt --dex 27 47 40 111712 /storage/emulated/0/download/bu/4.8_hot.jar 1252293479 -1887743774 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
Contains functionality to send SMS messages automatically.