Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.65.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) d.zxl####.com.####.com:80
- TCP(HTTP/1.1) l.wando####.com:80
- TCP pyc.jy####.com:7803
- TCP pya.jy####.com:7801
- TCP pya.jy####.com:7802
DNS requests:
- ads####.wando####.com
- d.zxl####.com
- l.wando####.com
- pya.jy####.com
- pyb.jy####.com
- pyc.jy####.com
- ru.dn####.com
HTTP GET requests:
- d.zxl####.com.####.com/d/25zs72.png
HTTP POST requests:
- l.wando####.com/muce/data/sink?profile=####&vc=####&vn=####&gzip=####&en...
- l.wando####.com/network/v2/init
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/-1557675950-1796796546
- <Package Folder>/databases/mysql.db3-journal
- <Package Folder>/databases/yoo_p_download.db
- <Package Folder>/databases/yoo_p_download.db-journal
- <Package Folder>/files/####/<Package>_adnetwork_.log
- <Package Folder>/files/_b.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/log_module.xml
- <Package Folder>/shared_prefs/shenghuozhushou.xml
- <Package Folder>/shared_prefs/wdj_ads_config.xml
- <Package Folder>/shared_prefs/yo_ac_pre.xml
- <Package Folder>/shared_prefs/yo_conf_pre.xml
- <Package Folder>/shared_prefs/yo_info_pre.xml
- <Package Folder>/shared_prefs/yoo_r_common_pre.xml
- <SD-Card>/Download/####/25zs72.png.data
- <SD-Card>/wandoujia/####/.udid
Miscellaneous:
Executes next shell scripts:
- chmod 777 /data/local/tmp
Loads the following dynamic libraries:
- wdj_adnetwork
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.