Android.Xiny.1475

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) q.c####.com:80
TCP(HTTP/1.1) d.weixu####.com.####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) i####.ish####.com:80
TCP(HTTP/1.1) nav.cn.ron####.com:80
TCP(HTTP/1.1) ping####.qq.com:80
TCP(HTTP/1.1) t####.qq.com:80
TCP(HTTP/1.1) www.ish####.net:80
TCP(HTTP/1.1) yes.yuchan####.com.cn:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) 1####.131.192.22:80
TCP(TLS/1.0) 2####.58.212.142:443
TCP 1####.92.22.206:8618

DNS requests:

a####.u####.com
c.c####.com
d.weixu####.com.cn
fb.u####.com
i####.ish####.com
i####.ish####.com
nav.cn.ron####.com
p####.ish####.com
ping####.qq.com
pv.s####.com
q14.c####.com
r.eli####.cn
s####.cn.ron####.com
st####.duo####.com
t####.qq.com
w.c####.com
www.ish####.net
yes.yuchan####.com.cn

HTTP GET requests:

c.c####.com/core.php?web_id=####&l=####&t=####
c.c####.com/q_stat.php?id=####&l=####
d.weixu####.com.####.com/2011/gou.jar
gdv.a.s####.com/cityjson?ie=####
i####.ish####.com/bojin/20/bjs.png
i####.ish####.com/cartoon/book-1/4/121-8154/00.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/01.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/02.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/03.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/04.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/05.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/06.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/07.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/08.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/09.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/10.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/11.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/12.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/13.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/14.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/15.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/16.png?5430####
i####.ish####.com/cartoon/book-1/4/121-8154/17.png?5430####
i####.ish####.com/comic/fenxi/fm.jpg
i####.ish####.com/ft/545/fts.jpg
i####.ish####.com/gin/678/gins.png
i####.ish####.com/hero/121/yxs.png
i####.ish####.com/hxh/380/hxhs.png
i####.ish####.com/op/901/ops.png
i####.ish####.com/pq/298/pqs.png
i####.ish####.com/toriko/396/mss.jpg
i####.ish####.com/yz/921/yzs.png
ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=####...
q.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
t####.qq.com/stats?sId=####
www.ish####.net/ComicBooks/ReadComicBooksToIso/5619.html
www.ish####.net/ComicBooks/ReadComicBooksToIsoV1/5619.html
www.ish####.net/Content/scripts/jq.js
www.ish####.net/ReadComicBooksToIsoV2/5619
yes.yuchan####.com.cn/k2?protocol=####&version=####&cid=####

HTTP POST requests:

a####.u####.com/app_logs
nav.cn.ron####.com/navipush.json
www.ish####.net/ComicBooks/GetAllBook?ClassifyId=####&Size=####&PageInde...
www.ish####.net/ComicBooks/GetChapterList?id=####&PageIndex=####
yes.yuchan####.com.cn/k1?requestId=####&g=####&ua=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/02710aa15a35bcdd8a978e067d59727597e8b145ce749d7....0.tmp
/data/data/####/240848e3b04b07756aa3b5c19c47054795afc0de720bfd3....0.tmp
/data/data/####/4527feb593a307b275e1957134980b7ad603ad6cb663b10....0.tmp
/data/data/####/633af6756e2d0907009cf147f4b9c2d0fed2ab18e229015....0.tmp
/data/data/####/695664d231e3b4c9d05edf98f1d08f6dcfbc13b382799c8....0.tmp
/data/data/####/84c11312f8e8b2ad5629270463410daa8909f35377a6611....0.tmp
/data/data/####/AppStore.xml
/data/data/####/COUNTLY_STORE.xml
/data/data/####/Statistics.xml
/data/data/####/W_Key.xml
/data/data/####/a.xml
/data/data/####/acbeb6ff0a6a30913d77bdc60705ccf8532d36bc55b2ad7....0.tmp
/data/data/####/c593e0db851645698ebcc2b4c5db8da5e197aaf28b382ab....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.ishsshui.comdeqi_preferences.xml
/data/data/####/comic.db-journal
/data/data/####/d56f72b7f9835b9c06f60f44c3f80daf5b6a2a83be7cbc1....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/downloadswc
/data/data/####/downloadswc-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/index
/data/data/####/journal.tmp
/data/data/####/rc_navigation_info.xml
/data/data/####/recent_list.xml
/data/data/####/recent_list.xml.bak
/data/data/####/rong_version.db
/data/data/####/rong_version.db-journal
/data/data/####/st.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_feedback_user_info.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/4.8_gou.jar.tmp
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/restime.dat

Miscellaneous:

Loads the following dynamic libraries:

RongIMLib
dub

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial