Android.Xiny.1122

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.247.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) log.sn####.com.####.net:80
TCP(HTTP/1.1) x####.tc.qq.com:80
TCP(HTTP/1.1) p1.ps####.com.####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) v####.ix####.com.####.com:80
TCP(HTTP/1.1) ib.sn####.com:80
TCP(HTTP/1.1) ic.sn####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) icha####.sn####.com:80
TCP(HTTP/1.1) c####.im.qq.com:80
TCP(HTTP/1.1) q.q####.cn:80
TCP(HTTP/1.1) p9.ps####.com.####.com:80
TCP 60.2####.109.29:8900

DNS requests:

a####.u####.com
a0.ps####.com
c####.im.qq.com
dm.tou####.com
i####.sn####.com
ib.sn####.com
ic.sn####.com
icha####.sn####.com
loc.map.b####.com
log.sn####.com
m####.g####.com
mon.sn####.com
oc.u####.co
oc.u####.com
p1.ps####.com
p3.ps####.com
p9.ps####.com
q.q####.cn
s0.ps####.com
v####.ix####.com
www.in####.cn

HTTP GET requests:

ib.sn####.com/2/essay/zone/config/v5/?ac=####&channel=####&aid=####&app_...
ib.sn####.com/neihan/service/fonts/?ac=####&channel=####&aid=####&app_na...
ib.sn####.com/neihan/stream/category/data/v3/?screen_width=####&category...
ib.sn####.com/push/get_service_addrs/?iid=####&device_id=####&ac=####&ch...
ib.sn####.com/service/11/app_ad/?_unused=####&carrier=####&mcc_mnc=####&...
ib.sn####.com/service/settings/v2/?app=####&default=####&ac=####&channel...
ic.sn####.com/2/essay/zone/config/v5/?iid=####&device_id=####&ac=####&ch...
ic.sn####.com/2/essay/zone/user/profile/?iid=####&device_id=####&ac=####...
ic.sn####.com/2/essay/zone/user/subscribe/?query_user_id=####&iid=####&d...
ic.sn####.com/neihan/stream/category/data/v3/?screen_width=####&category...
ic.sn####.com/neihan/video/playback/1521188948.28/?video_id=####&quality...
icha####.sn####.com/feedback/2/list/?appkey=####&count=####&ac=####&chan...
icha####.sn####.com/service/2/app_alert/?has_market=####&lang=####&carri...
icha####.sn####.com/service/2/app_notify/?allow_notify=####&leave_time=#...
log.sn####.com.####.net/2/data/v2/get_essay_comments/?group_id=####&coun...
log.sn####.com.####.net/2/user/info/?ac=####&channel=####&aid=####&app_n...
log.sn####.com.####.net/2/user/info/?iid=####&device_id=####&ac=####&cha...
log.sn####.com.####.net/get_domains/?ac=####&channel=####&aid=####&app_n...
log.sn####.com.####.net/large/6e15000dcb2c13f7df1e
log.sn####.com.####.net/large/6e1a00032aad85f568ce
log.sn####.com.####.net/large/6e2700042fa52e4ef54c
log.sn####.com.####.net/large/6e310007092cef280c06
log.sn####.com.####.net/large/6e3c0011716136e9ea16
log.sn####.com.####.net/large/6e4500142bcf4a3aa3fd
log.sn####.com.####.net/large/6e560002f068692f0fc2
log.sn####.com.####.net/large/6e5b000834b3fb041d2f
log.sn####.com.####.net/medium/249b0018a2a3a21ea657
log.sn####.com.####.net/medium/3afa000051094171ec55
log.sn####.com.####.net/medium/3e7e000047a56547a570
log.sn####.com.####.net/medium/50400011354b5fdf4c28
log.sn####.com.####.net/medium/58760003998487378253
log.sn####.com.####.net/medium/5d4e000cfb459bb9ec30
log.sn####.com.####.net/medium/65890045c90e57c23060
log.sn####.com.####.net/medium/658c0011ff58405a8624
log.sn####.com.####.net/medium/986/6529627357
log.sn####.com.####.net/monitor/settings/?ac=####&channel=####&aid=####&...
log.sn####.com.####.net/site/2eaf000557acc7aa2d71
log.sn####.com.####.net/site/image/joke_zone/chengxuyuan_chengxuyuan_gal...
log.sn####.com.####.net/site/image/joke_zone/fanbao_fanbao200.jpg
log.sn####.com.####.net/site/image/joke_zone/fankui_slogan200.pic.jpg
log.sn####.com.####.net/site/image/joke_zone/fugu_fugu_gallery_fugu_gall...
log.sn####.com.####.net/site/image/joke_zone/huaipinwei_huaipinwei_galle...
log.sn####.com.####.net/site/image/joke_zone/jiniandaji_200.JPG
log.sn####.com.####.net/site/image/joke_zone/leg_xiao1_1.jpeg
log.sn####.com.####.net/site/image/joke_zone/music_music1.jpg
log.sn####.com.####.net/site/image/joke_zone/ticket_piao200_1.jpg
log.sn####.com.####.net/site/image/joke_zone/xuexing_1101800926d75c78c2o...
log.sn####.com.####.net/site/image/joke_zone/zhengjianzhao_zhengjianzhao...
log.sn####.com.####.net/w240/56ad000db77473b1baaa
log.sn####.com.####.net/w400/51120014bbfd0c71ec05
log.sn####.com.####.net/w424/542c00057fed41491c9c
log.sn####.com.####.net/w435/5025000f928a9eebb018
log.sn####.com.####.net/w440/5b8b0003ff3004930fda
log.sn####.com.####.net/w480/511f0015b41451245d84
log.sn####.com.####.net/w480/56bd0007faf92a2911c9
log.sn####.com.####.net/w480/5b6f000774ed7f13620f
log.sn####.com.####.net/w480/5b730003eff37126406e
log.sn####.com.####.net/w480/5b7c0006fc736f52273a
log.sn####.com.####.net/w480/5b9f00006b741e176e0e
log.sn####.com.####.net/w480/6188000142029dd84290
log.sn####.com.####.net/w480/619200084884cce41b04
log.sn####.com.####.net/w480/667a0006c76995fd254d
log.sn####.com.####.net/w480/69a20003965ebea87c79
log.sn####.com.####.net/w480/69a800025dec8fc326fd
p1.ps####.com.####.com/large/6e0d000743402af5ecac
p1.ps####.com.####.com/large/6e40000da5d7d176d69f
p1.ps####.com.####.com/medium/2c6d000a86af89699873
p1.ps####.com.####.com/medium/3a1f000882fb90131880
p1.ps####.com.####.com/medium/5d4a001eddfb6f671007
p1.ps####.com.####.com/medium/658d000cdf0256c0e8fa
p1.ps####.com.####.com/medium/659200041120dd1fa413
p1.ps####.com.####.com/w369/500d00045d3e637f6706
p1.ps####.com.####.com/w480/54180017756c28ce8352
p1.ps####.com.####.com/w480/542c00035888f91231b6
p1.ps####.com.####.com/w480/5974000b0b8e523d78b8
p1.ps####.com.####.com/w480/617c00018ccba3322600
p1.ps####.com.####.com/w480/618400038ba45a4eaf01
p1.ps####.com.####.com/w720/542c00035888f91231b6
p9.ps####.com.####.com/medium/3f030018e6983adb303c
q.q####.cn/qqapp/100290348/988576BEBBB7A4784A43888C59E194B3/100
q.q####.cn/qqapp/100290348/F7A9CB8F9F5E4C94976838EA49E355F1/100
v####.ix####.com.####.com/f9e04162770eee3ddabaf80f80cec389/5aab8056/vide...
x####.tc.qq.com/www/mb/images/head_50.jpg

HTTP POST requests:

a####.u####.com/app_logs
c####.im.qq.com/cgi-bin/cgi_svrtime
ic.sn####.com/service/1/z_app_stats/?iid=####&device_id=####&ac=####&cha...
log.sn####.com.####.net/service/2/app_log_config/
oc.u####.com/check_config_update

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/databases/essay.db-journal
<Package Folder>/databases/feedback.db-journal
<Package Folder>/databases/ss_app_log.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/firll.dat
<Package Folder>/files/####/offinfo.dat
<Package Folder>/files/.imprint
<Package Folder>/files/mobclick_agent_cached_<Package>220
<Package Folder>/files/observerFile3
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/app_config.xml
<Package Folder>/shared_prefs/app_setting.xml
<Package Folder>/shared_prefs/app_track.xml
<Package Folder>/shared_prefs/applog_stats.xml
<Package Folder>/shared_prefs/com.ss.spipe_setting.xml
<Package Folder>/shared_prefs/mipush.xml
<Package Folder>/shared_prefs/mipush_extra.xml
<Package Folder>/shared_prefs/multi_process_config.xml
<Package Folder>/shared_prefs/push_setting.xml
<Package Folder>/shared_prefs/snssdk_openudid.xml
<Package Folder>/shared_prefs/ss_app_config.xml
<Package Folder>/shared_prefs/ss_location.xml
<Package Folder>/shared_prefs/ss_splash_ad.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/z.xml
<SD-Card>/Android/####/05b72033344b0fde078647cab7ce06be.dat
<SD-Card>/Android/####/0ea28326a6ba4c27abe807cbe63de6b9.dat
<SD-Card>/Android/####/0f31b5ed7606474590020877bed79f69.dat
<SD-Card>/Android/####/1025127c6096968d9dbef3a95b3e4502.dat
<SD-Card>/Android/####/1723a2d124abd208f11e458b7ea0208d.dat
<SD-Card>/Android/####/1de1929167927595de9a295ff349eca1.dat
<SD-Card>/Android/####/2438b5b9231134c32b1a766f6346e67e.dat
<SD-Card>/Android/####/2dc8efcd8980a88826e6b6c4a768883d.dat
<SD-Card>/Android/####/30bcf271fa3f1c3fc74d4e08dd7bb91d.dat
<SD-Card>/Android/####/32d34e60fe2b89c47b3654092776c686.dat
<SD-Card>/Android/####/3d4fb7de60ec5330c3a14e3c37c5ed65.dat
<SD-Card>/Android/####/4571e757c8198277bc8ade84175de37c.dat
<SD-Card>/Android/####/48c29f7533e51e9d633a660b53c3ec5b.dat
<SD-Card>/Android/####/4c3bde83782c8c971319da1ae04de8e9.dat
<SD-Card>/Android/####/52cf9a0488f30b5736d9c3fdab0638e7.dat
<SD-Card>/Android/####/55c217737a35a4b2a8a21fffbc366c71.dat
<SD-Card>/Android/####/56e9d162fd44eb19e194fac687a130a7.dat
<SD-Card>/Android/####/5e9e1d8f0732f3967fa7bf8c5cf08618.dat
<SD-Card>/Android/####/6a96959d6ae0aa74a34afdd49d02e45c.dat
<SD-Card>/Android/####/6b34d9b38fb69ee5a5527259fd94a435.dat
<SD-Card>/Android/####/6da85b4268ecefd59513fa4b154891e0.dat
<SD-Card>/Android/####/6db51adde4a9ca59afce2f2035e3aa12.dat
<SD-Card>/Android/####/73b760070159014068a5563985ca83fb.dat
<SD-Card>/Android/####/74d6f5172de9cdb469902a5d1a2087f9.dat
<SD-Card>/Android/####/753bdd178b46ff9a25329bbcb02c3b1e.dat
<SD-Card>/Android/####/760d4ab70d1241c2fdaccffe93e4e953.dat
<SD-Card>/Android/####/79c88a56ce2c103f45f378c83b9c496a.dat
<SD-Card>/Android/####/7a543cdd2bc2cac79275768bcd61ce47.dat
<SD-Card>/Android/####/7b3725e35c08ec410a5363f3ef01d707.dat
<SD-Card>/Android/####/7c23bd9c1b62877a06b53d3fa831f7c8.dat
<SD-Card>/Android/####/860f75ee994095833e3c9358dc5a4a87.dat
<SD-Card>/Android/####/8f80ad2af4f19b62112ac5069b9dd244.dat
<SD-Card>/Android/####/8fa8d0dcd521f1336a5dabb9f2f55c87.dat
<SD-Card>/Android/####/a9532982838fc009c1f9017f3482a38f.dat
<SD-Card>/Android/####/a99bcc091c3bf3ba36ef6bf6cf852edf.dat
<SD-Card>/Android/####/ab1532b14755aa9b19bb896862abd87e.dat
<SD-Card>/Android/####/b2046a3883ee768b87039c39dfe132a5.dat
<SD-Card>/Android/####/b2b4f9055d31b6935ca2920bf0c1affa.dat
<SD-Card>/Android/####/b57bc7466b340b7fcfa3905c13212867.dat
<SD-Card>/Android/####/b5b146ae57c11b054bad0b41ea165960.dat
<SD-Card>/Android/####/b70fe657881010197dd5c9d766921a03.dat
<SD-Card>/Android/####/b8ce6c9576c11d5c9c5f42e59081f2e0.dat
<SD-Card>/Android/####/bd46d34cbb35c53d5669cb0047558283.dat
<SD-Card>/Android/####/be9367d03494a4628807e4a6ad0154e1.dat
<SD-Card>/Android/####/c46b2ba3c41e0de4d555d0af42649aea.dat
<SD-Card>/Android/####/c63b6be89876b089710d6de461f92b56.dat
<SD-Card>/Android/####/c6ffe954b315d0874a405085f3be1601.dat
<SD-Card>/Android/####/c736fc431a2188f68c7a6e46253fd3e1.dat
<SD-Card>/Android/####/c91240a9619563531599eadad06296ba.dat
<SD-Card>/Android/####/cb44a960f29a3df129a252e4cfc9d7c9.dat
<SD-Card>/Android/####/clientudid.dat
<SD-Card>/Android/####/d4d308d01bef84af78b41f2925547537.dat
<SD-Card>/Android/####/d5f460c968bd29f845812a5c4cd387dd.dat
<SD-Card>/Android/####/d8bd260477c183002d0fee0729876b2c.dat
<SD-Card>/Android/####/d97b6c1d4cb392844590bef8b86845a6.dat
<SD-Card>/Android/####/da8b67aaa8593a9113e65fb47050b959.dat
<SD-Card>/Android/####/e0d2434a2b92eede33a9c8fd845b9e0e.dat
<SD-Card>/Android/####/e6b778176d6d920261e7e31816052e58.dat
<SD-Card>/Android/####/eb904aa121294a23eeeac322801ffd88.dat
<SD-Card>/Android/####/f4568f93d329c124478b3614188e902e.dat
<SD-Card>/Android/####/f45c3b17718c5ba95426916679d819b0.dat
<SD-Card>/Android/####/f5f587b97c5af0aeab58ddca0e37b851.dat
<SD-Card>/Android/####/f953f3100d260c418ae8b4e3d45209e3.dat
<SD-Card>/Android/####/tempimage-1023461087.tmp
<SD-Card>/Android/####/tempimage-1053139910.tmp
<SD-Card>/Android/####/tempimage-1074167075.tmp
<SD-Card>/Android/####/tempimage-1083713260.tmp
<SD-Card>/Android/####/tempimage-1109600399.tmp
<SD-Card>/Android/####/tempimage-1358847915.tmp
<SD-Card>/Android/####/tempimage-1425793836.tmp
<SD-Card>/Android/####/tempimage-1435049851.tmp
<SD-Card>/Android/####/tempimage-1510527226.tmp
<SD-Card>/Android/####/tempimage-1529840433.tmp
<SD-Card>/Android/####/tempimage-1686059259.tmp
<SD-Card>/Android/####/tempimage-1725748946.tmp
<SD-Card>/Android/####/tempimage-1969294051.tmp
<SD-Card>/Android/####/tempimage-312105440.tmp
<SD-Card>/Android/####/tempimage-323532576.tmp
<SD-Card>/Android/####/tempimage-348109466.tmp
<SD-Card>/Android/####/tempimage-372888259.tmp
<SD-Card>/Android/####/tempimage-512955960.tmp
<SD-Card>/Android/####/tempimage-536411761.tmp
<SD-Card>/Android/####/tempimage-561542895.tmp
<SD-Card>/Android/####/tempimage-593128704.tmp
<SD-Card>/Android/####/tempimage-662151642.tmp
<SD-Card>/Android/####/tempimage-68864558.tmp
<SD-Card>/Android/####/tempimage-721326995.tmp
<SD-Card>/Android/####/tempimage-787644896.tmp
<SD-Card>/Android/####/tempimage1024073087.tmp
<SD-Card>/Android/####/tempimage105928880.tmp
<SD-Card>/Android/####/tempimage1064371173.tmp
<SD-Card>/Android/####/tempimage1151739072.tmp
<SD-Card>/Android/####/tempimage1220212151.tmp
<SD-Card>/Android/####/tempimage126796511.tmp
<SD-Card>/Android/####/tempimage1467676340.tmp
<SD-Card>/Android/####/tempimage1523605008.tmp
<SD-Card>/Android/####/tempimage1572111822.tmp
<SD-Card>/Android/####/tempimage157883538.tmp
<SD-Card>/Android/####/tempimage1590100821.tmp
<SD-Card>/Android/####/tempimage1596139028.tmp
<SD-Card>/Android/####/tempimage1664050194.tmp
<SD-Card>/Android/####/tempimage1672202107.tmp
<SD-Card>/Android/####/tempimage1695832762.tmp
<SD-Card>/Android/####/tempimage1728260796.tmp
<SD-Card>/Android/####/tempimage1767476823.tmp
<SD-Card>/Android/####/tempimage180833188.tmp
<SD-Card>/Android/####/tempimage1810345131.tmp
<SD-Card>/Android/####/tempimage1821743780.tmp
<SD-Card>/Android/####/tempimage1825502228.tmp
<SD-Card>/Android/####/tempimage1936962148.tmp
<SD-Card>/Android/####/tempimage282370950.tmp
<SD-Card>/Android/####/tempimage386088264.tmp
<SD-Card>/Android/####/tempimage429022438.tmp
<SD-Card>/Android/####/tempimage510929277.tmp
<SD-Card>/Android/####/tempimage592263947.tmp
<SD-Card>/Android/####/tempimage612089605.tmp
<SD-Card>/Android/####/tempimage640815357.tmp
<SD-Card>/Android/####/tempimage655520321.tmp
<SD-Card>/Android/####/tempimage673389550.tmp
<SD-Card>/Android/####/tempimage68979132.tmp
<SD-Card>/Android/####/tempimage693798378.tmp
<SD-Card>/Android/####/tempimage736683355.tmp
<SD-Card>/Android/####/tempimage773549479.tmp
<SD-Card>/Android/####/tempimage980598528.tmp
<SD-Card>/Android/####/tempimage996137492.tmp
<SD-Card>/baidu/####/ls.db
<SD-Card>/baidu/####/ls.db-journal
<SD-Card>/baidu/####/yoh.dat
<SD-Card>/baidu/####/yol.dat
<SD-Card>/baidu/####/yom.dat
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

/data/user/0/<Package>/lib/libsupervisor.so <Package> com.ss.android.message.NotifyService <Package>:push /data/user/0/<Package> 0
chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
locSDK5

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial