Android.DownLoader.2503

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

s####.####.com
u####.####.com
st####.####.com
d####.####.cn
c####.####.com
n####.####.com
a####.####.com

HTTP GET requests:

st####.####.com/build/1502/4d/d9/201703281549.zip
a####.####.com/v1/zeus/ml?appkey=####&timestamp=####&sign=####
st####.####.com/app/data/privacy_8_1463389040.zip
d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
a####.####.com/v1/sdk/pl?d=####&vl=####&sign=####&appkey=####&timestamp=...
n####.####.com/get?model=####&is=####&signmd5=####&op=####&vendor=####&l...
a####.####.com/zeus/upgrade?appkey=####&timestamp=####&sign=####&apk=###...
n####.####.com/feedback/notify?model=####&is=####&signmd5=####&op=####&v...
a####.####.com/root/supercheck?appkey=####&timestamp=####&type=####&sign...
st####.####.com/jiankong/100020/ec/1b/9_com.baidu.mzjoid_1.0.1.apk
a####.####.com/root/setting?appkey=####&timestamp=####&sign=####
st####.####.com/app/data/jp_1_1427696574.zip
st####.####.com/rootsdk/100020/de/02/4_com.baidu.zeus_1.4.8.apk
st####.####.com/app/data/bw/bw_3_100020_1456731178.zip
st####.####.com/approot/100020/95/44/2_com.baidu.superservice_5.2.0.apk
u####.####.com/api/apps/check_update?ver=####&sig=####&uv=####&sd=####&m...

HTTP POST requests:

a####.####.com/v1/zeus/build?appkey=####&timestamp=####&sign=####
a####.####.com/v1/zeus/slg?appkey=####&timestamp=####&sign=####
c####.####.com/batsdk/api_int/newsync2
u####.####.com/api/tokens?tk=####&sv=####
u####.####.com/api/data?token=####&tk=####&sv=####
s####.####.com/cw/cp.action?requestId=####&g=####
a####.####.com/app_logs
s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
a####.####.com/v1/report?appkey=####&timestamp=####&sign=####&msg_id=####

Modified file system:

Creates the following files:

<Package Folder>/databases/z-journal
<Package Folder>/databases/sk-journal
<Package Folder>/databases/jp.db
<Package Folder>/databases/jp.db-journal
<Package Folder>/databases/app_launch_cache.db-journal
<Package Folder>/files/reinstall
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/files/smartpriv-2003164482.out
<Package Folder>/databases/c
<Package Folder>/databases/d
<Package Folder>/databases/i
<Package Folder>/databases/baidu_localscan.db
<Package Folder>/shared_prefs/a.xml
<Package Folder>/files/bw.db
<Package Folder>/files/zyi/r9-c4974f0r9.ad.odex
<Package Folder>/databases/z
<Package Folder>/databases/sk
<Package Folder>/files/zyi/r9-c4974f0r9.ad.jar
<Package Folder>/databases/bw.db
<Package Folder>/databases/downloadswc
<Package Folder>/databases/pg.db-journal
<Package Folder>/files/chattr
<Package Folder>/shared_prefs/app-update-prefs.xml.bak
<Package Folder>/databases/root_report.db
<Package Folder>/files/.tmp/uni
<Package Folder>/files/zyi/sptool
<Package Folder>/shared_prefs/root_report.xml.bak
<Package Folder>/databases/smart_priv.db-journal
<Package Folder>/shared_prefs/app-update-prefs.xml
<Package Folder>/databases/zeus_unfinish_transaction.db-journal
<Package Folder>/shared_prefs/h.xml
<Package Folder>/databases/c-journal
<Package Folder>/files/authrate.dat
<Package Folder>/files/4.3_hyjwan.dex
<Package Folder>/shared_prefs/ye_db_configs.xml
<Package Folder>/files/.tmp/uniz
<Package Folder>/files/smart_priv.db
<Package Folder>/databases/baidu_localscan.db-journal
<Package Folder>/shared_prefs/i.xml
<Package Folder>/shared_prefs/rt.xml
<Package Folder>/files/be03bdfb7aec72fd9195311f2656619a
<Package Folder>/files/.b/4-1.4.8
<Package Folder>/files/.tmp/superservice.apk
<Package Folder>/databases/d-journal
<Package Folder>/files/zyi/loadr9
<Package Folder>/shared_prefs/superrootcfg.xml.bak
<Package Folder>/shared_prefs/st.xml
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/files/.tmp/uniz-2003164482.out
<Package Folder>/files/.4/4-1.4.8.dex
<Package Folder>/files/mobclick_agent_cached_<Package>203
/data/anr/traces.txt
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/databases/perm.db-journal
<Package Folder>/cache/su
<Package Folder>/cache/chattr
<Package Folder>/files/.imprint
<Package Folder>/shared_prefs/d.xml
<Package Folder>/files/zyi/libr9um.so
<Package Folder>/files/.tmp/uniz-1912817548.out
<Package Folder>/shared_prefs/W_Key.xml.bak
<Package Folder>/files/.4/lib/1.4.8/1576963293/armeabi/libbaiduzeus148.so
<Package Folder>/files/proguard
<Package Folder>/shared_prefs/superrootcfg.xml
<Package Folder>/databases/bw.db-journal
<Package Folder>/databases/app_launch_cache.db
<Package Folder>/databases/pg.db
<Package Folder>/shared_prefs/batsdk_app_life.xml
<Package Folder>/files/smartpriv-1855034231.out
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/smartpriv-1912817548.out
<Package Folder>/databases/perm.db
<Package Folder>/files/.tmp/9-1.0.1
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/batsdk_user_info.xml
<Package Folder>/databases/notify_items.sp
<Package Folder>/files/zyi/libr9-2e70790r9.ad.so
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/cache/install-recovery.sh
<Package Folder>/files/bat_crash_1495005877894
<Package Folder>/shared_prefs/utils.xml
<Package Folder>/files/su
<Package Folder>/files/permdata.dat
<Package Folder>/databases/downloadswc-journal
<Package Folder>/shared_prefs/loadercfg.xml
<Package Folder>/files/.tmp/4-1.4.8
<Package Folder>/files/bp-4.0-arm.src
<Package Folder>/shared_prefs/root_report.xml
<Package Folder>/shared_prefs/zeuscfg.xml
<Package Folder>/databases/smart_priv.db
<Package Folder>/files/insdog
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/local_config.xml
<Package Folder>/shared_prefs/config_update.xml
<Package Folder>/databases/root_report.db-journal
<Package Folder>/files/.4/lib/1.4.8/2059872424/armeabi/libbaiduzeus148.so
<Package Folder>/databases/notify_items.sp-journal
<Package Folder>/files/bp10
<Package Folder>/files/jp.db
<Package Folder>/databases/i-journal

Miscellaneous:

Executes next shell scripts:

/data/data/####/files/insdog data/data/####/ #### 1 1 37f4b1144d55bea0dc58e074f1c12ea9 598153950705653 100020 f98eaedb09f57121985266ecaabeb5c7 3ad11f77-9cbd-450d-bd16-1a4119df7847 18 tk=R+j5VNzrMIi0JvNqAFDJug==&v=3.7.2&mode=Gene
chmod 771 /data/data/####/files/.tmp/4-1.4.8
/system/bin/bp10 --check-version
chmod 771 <Package Folder>/files/.4/lib/1.4.8/2059872424/armeabi/libbaiduzeus148.so
ls -l <Package Folder>
<Package Folder>/cache/chattr +ai /system/xbin/su
chmod 777 /data/data/####/files/.tmp/uni
chmod 771 /data/data/####/files/.4/4-1.4.8.dex
chmod 664 <Package Folder>/files/zyi/libr9um.so
/system/xbin/su
chmod 664 <Package Folder>/files/zyi/r9-c4974f0r9.ad.jar
dumpsys package com.zhiqupk.root
chmod 664 <Package Folder>/files/zyi/loadr9
/system/bin/getenforce
mount -o remount,rw /dev/block/sda1 /system
chmod 755 /data/data/####/files/bp10
chmod 755 <Package Folder>/files/chattr
/data/data/####/files/bp10 --check-version
chmod 771 <Package Folder>/files/.tmp
chmod 777 <Package Folder>/files/.tmp/uni
mount -o remount,ro /dev/block/sda1 /system
sh <Package Folder>/files/insdog data/data/<Package>/ <Package> 1 1 37f4b1144d55bea0dc58e074f1c12ea9 598153950705653 100020 f98eaedb09f57121985266ecaabeb5c7 3ad11f77-9cbd-450d-bd16-1a4119df7847 18 tk=R+j5VNzrMIi0JvNqAFDJug==&v=3.7.2&mode=<System Property>
/system/bin/cat /sys/block/mmcblk2/device/cid
chmod 766 <Package Folder>/files/.tmp//superservice.apk
sh <Package Folder>/files/bp10 --check-version
ln -s /system/xbin/su /system/bin/su
/system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
su -v
/system/xbin/su -v
/system/bin/cat /sys/block/mmcblk3/device/cid
/system/bin/cat /proc/meminfo
chmod 751 /data/data/####/files/insdog
chmod 664 /data/data/####/files/zyi/libr9-2e70790r9.ad.so
chmod 755 <Package Folder>/files/su
chmod 755 /data/data/####/files/reinstall
sh -c dumpsys package com.baidu.superroot 2>/dev/null
/system/bin/cat /sys/block/mmcblk0/device/cid
chmod 771 /data/data/####/files/.4/lib/1.4.8/2059872424/armeabi/libbaiduzeus148.so
/system/bin/cat /sys/block/mmcblk1/device/cid
rm /system/xbin/su
dumpsys package com.baidu.superservice
<error:2>
/system/xbin/su --daemon
/system/bin/su
chmod 771 /data/data/####/files/.4/lib/1.4.8/1576963293/armeabi/libbaiduzeus148.so
chmod 664 <Package Folder>/files/zyi/sptool
chmod 664 /data/data/####/files/zyi/loadr9
chmod 755 <Package Folder>/files/bp10
chmod 751 <Package Folder>/files/insdog
chmod 6755 /system/xbin/su
<Package Folder>/cache/chattr -ai /system/xbin/su
dumpsys package com.baidu.superroot
chmod 771 <Package Folder>/files/.4/lib/1.4.8/1576963293/armeabi/libbaiduzeus148.so
ps
chmod 771 <Package Folder>/files/.4/lib/1.4.8/2059872424/armeabi
chmod 664 /data/data/####/files/zyi/libr9um.so
chmod 771 <Package Folder>/files/.4/dex
sh -c dumpsys package com.dianxinos.superuser 2>/dev/null
chmod 755 <Package Folder>/files/.tmp//uni
sync
chmod 771 /data/data/####/files/.4/dex
chmod 771 <Package Folder>/files/.4/4-1.4.8.dex
chmod 771 <Package Folder>/files/.tmp/4-1.4.8
chmod 771 /data/data/####/files/.4/lib/1.4.8/1576963293/armeabi
chmod 771 <Package Folder>/files/.4/lib/1.4.8/1576963293/armeabi
chmod 766 /data/data/####/files/.tmp//superservice.apk
sh -c dumpsys package com.baidu.superservice 2>/dev/null
dumpsys package com.dianxinos.superuser
chmod 664 /data/data/####/files/zyi/sptool
<Package Folder>/cache/chattr -ai /system/bin/su
chmod 771 /data/data/####/files/.tmp
chmod 771 /data/data/####/files/.4/lib/1.4.8/2059872424/armeabi
chmod 755 <Package Folder>/files/proguard
chmod 664 /data/data/####/files/zyi/r9-c4974f0r9.ad.jar
touch /system/etc/.has_dxsu_daemon
chmod 771 /data/data/####/files/.4
chmod 664 <Package Folder>/files/zyi/libr9-2e70790r9.ad.so
chmod 755 <Package Folder>/files/reinstall
rm /system/bin/su
chmod 771 <Package Folder>/files/.4
chmod 755 /data/data/####/files/.tmp//uni
su
sh -c dumpsys package com.zhiqupk.root 2>/dev/null
sh
<dexopt>
chmod 755 /system/etc/install-recovery.sh

Uses elevated priveleges.

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial