Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- afpt####.####.com
- g####.####.com
- h####.####.com
- c####.com
- d####.####.cn
- q####.####.com
- f####.####.com
- af####.####.com
- pix####.com
- z####.####.com
- l####.####.com
- n####.####.com
- pco####.####.com
- a####.####.com
- pag####.####.com
HTTP GET requests:
- h####.####.com/help_images/search_button.gif
- h####.####.com/help_images/input_back.gif
- n####.####.com/v1/images/login/toolback.jpg
- pix####.com/mobapp/bbqmindex.html
- g####.####.com/gxb.gif?si=####&ref=####&lang=####&bw=####&bh=####&pu=###...
- h####.####.com/help_images/menu_top.gif
- n####.####.com/v1/images/login/button07.gif
- n####.####.com/v1/images/login/topback.jpg
- h####.####.com/support/chanpinjieshao/
- h####.####.com/support/baobiaojiedu/fangkefenxi/
- a####.####.com/afp-creative/creative/u46686923/fe3fcd5538d95ae880bd15f2a...
- pix####.com/images/mobhome.png
- h####.####.com/support/changjianwenti/shujuzhunquexingwen/2013/0907/137....
- h####.####.com/help_images/logo.gif
- g####.####.com/r.php?t=####&v=####
- s####.####.com/img/pic1.gif
- h####.####.com/support/zhandianshezhi/chankanmimazhezhi/20130903/27.html
- s####.####.com/dplus.php?id=####
- h####.####.com/support/plus/search.php?kwtype=####&q=####
- h####.####.com/support/changjianwenti/shujuzhunquexingwen/
- h####.####.com/support/cnzz.js
- n####.####.com/v1/images/login/button04.gif
- n####.####.com/v1/images/login/button05.gif
- s####.####.com/img/2.gif
- c####.com/stat/website.php?web_id=####
- a####.####.com/g/mm/afp-cdn/JS/k.js
- a####.####.com/afp-creative/creative/u46686923/a33c97c31b5e8aef10ebbaa40...
- af####.####.com/ex?a=####&sp=####&cb=####&u=####&ds=####&_=####&fs=####&...
- h####.####.com/help_images/contact_back.gif
- n####.####.com/v1/images/qr/qr.php?siteid=####
- a####.####.com/dplusTrack/?data=####&ip=####&dataver=####&_=####
- a####.####.com/afp-creative/creative/u46686923/ca4c3bf3d5851a60ce9a55a47...
- pix####.com/mobapp/images/bbqm_bottom.jpg
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- s####.####.com/c.php?id=####
- afpt####.####.com/clk?bid=####&pid=####&cid=####&mid=####&oid=####&produ...
- n####.####.com/v1/images/login/button01.gif
- h####.####.com/support/baobiaojiedu/wangzhangaikuang/
- h####.####.com/h.js?1faf1e7####
- s####.####.com/core.php?web_id=####&t=####
- n####.####.com/v1/images/login/button02.gif
- s####.####.com/c.php?id=####&l=####
- pag####.####.com/pagead/js/r20170517/r20170110/show_ads_impl.js
- s####.####.com/stat.php?id=####&web_id=####&show=####
- pix####.com/images/applic.png
- l####.####.com/w.gif?logtype=####&pre=####&cache=####&scr=####&cna=####&...
- afpt####.####.com/opt?bid=####&pid=####&cid=####&mid=####&oid=####&produ...
- h####.####.com/help_images/search_right.gif
- n####.####.com/v1/images/login/button06.gif
- h####.####.com/support/jquery.min.js
- n####.####.com/v1/images/login/bqline.gif
- h####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- h####.####.com/images/tongji/site-overview-cumulative.jpg
- h####.####.com/support/image/contacts_03.gif
- pag####.####.com/pagead/js/adsbygoogle.js
- h####.####.com/support/chanpinjieshao
- f####.####.com/ser/detail.html?service_code=####&mm_gxbid=####&jlogid=####
- n####.####.com/v1/images/login/logo.gif
- h####.####.com/help_images/search_back.gif
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- h####.####.com/images/tongji/authorize-password-example.jpg
- a####.####.com/afp-creative/creative/u46686923/cb538b6141cb0feb4c1ab63a3...
- afpt####.####.com/imp?bid=####&pid=####&cid=####&mid=####&oid=####&produ...
- h####.####.com/images/tongji/site-list-set.jpg
- n####.####.com/v1/images/login/button03.gif
- s####.####.com/acookie.html
- pix####.com/mobapp/images/mid.jpg
- n####.####.com/v1/images/ios_download.gif
- h####.####.com/images/tongji/site-setting-authorize-password-closed.jpg
- h####.####.com/help_images/logo1.gif
- a####.####.com/g/mm/afp-cdn/JS/r.js
- h####.####.com/help_images/icon.gif
- a####.####.com/afp-creative/creative/u46686923/e7452824c6e75973bc965121a...
- pix####.com/images/mobtop.jpg
- h####.####.com/support/baobiaojiedu/wangzhangaikuang/changjianwen/2013/0...
- h####.####.com/help_images/tit_icon.gif
- q####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- n####.####.com/v1/images/login/leftback.jpg
- h####.####.com/help_images/tit_back.gif
- pco####.####.com/app.gif?&cna=####
- af####.####.com/acookie.html
- pix####.com/mobapp/images/line.gif
- n####.####.com/v1/images/login/titleback.jpg
- s####.####.com/core.php?web_id=####&show=####&t=####
- h####.####.com/help_css/css.css
- n####.####.com/v1/images/login/check.jpg
- s####.####.com/stat.php?id=####&show=####
- h####.####.com/help_images/menu_bottom.gif
- s####.####.com/core.php?web_id=####&l=####&t=####
- pix####.com/mobapp/images/begin-normal.png
- a####.####.com/afp-creative/creative/u46686923/527c168cffa4245269c1b1a83...
- n####.####.com/v1/images/an_download.gif
- n####.####.com/v1/login.php?siteid=####
- h####.####.com/support/baobiaojiedu/liuliangfenxi/
- h####.####.com/images/tongji/site-setting-authorize-password-set-passwor...
- h####.####.com/help_images/search_pic.gif
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
HTTP POST requests:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.