Android.Xiny.4547

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.1.origin
Android.Xiny.53.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ad.lanji####.com:80
TCP(HTTP/1.1) api.is.13####.com:80
TCP(HTTP/1.1) apk.d.ad.####.com:80
TCP(HTTP/1.1) a####.co####.com:80
UDP(NTP) 2.and####.p####.####.org:123
TCP(TLS/1.0) sto####.l####.com:443
TCP(TLS/1.0) api.openf####.com:443
TCP pu1.ju####.com:9801
UDP 2####.255.255.255:67
TCP ps1.ju####.com:9701
TCP ps1.ju####.com:9803
TCP ps1.ju####.com:9703
TCP ps1.ju####.com:9802

DNS requests:

2.and####.p####.####.org
a####.co####.com
ad.lanji####.com
api.is.13####.com
api.openf####.com
apk.d.ad.####.com
mt####.go####.com
pa1.ju####.com
ps1.ju####.com
pu1.ju####.com
sp1.ju####.com
sp3.ju####.com
sto####.l####.com

HTTP GET requests:

apk.d.ad.####.com/ad/20181204/201812041054103.png

HTTP POST requests:

a####.co####.com/cooguogw/iris.action?g=####
ad.lanji####.com/lanjingke/iris.action?g=####
api.is.13####.com/is/info.jsp
api.is.13####.com/is/init.jsp

File system changes:

Creates the following files:

/data/data/####/.md5
/data/data/####/.sec_version
/data/data/####/L_Key.xml
/data/data/####/SuperMarioPrefs.xml
/data/data/####/adwords_bg.png
/data/data/####/arrow_down.png
/data/data/####/arrow_up.png
/data/data/####/bottom_bg.png
/data/data/####/bottom_btn_cache.png
/data/data/####/bottom_btn_cancel.png
/data/data/####/bottom_btn_install.png
/data/data/####/btn_install.png
/data/data/####/classes.dex
/data/data/####/classes.jar
/data/data/####/com.daydayup.supermar
/data/data/####/com.daydayup.supermar.xml
/data/data/####/coo_id.xml
/data/data/####/d_adwords_bg
/data/data/####/d_appsc_an
/data/data/####/d_arrow_down
/data/data/####/d_arrow_up
/data/data/####/d_bottom_bg
/data/data/####/d_bottom_btn_cancel
/data/data/####/d_bottom_btn_install
/data/data/####/d_btn_install
/data/data/####/d_btnbg_blue
/data/data/####/d_btnbg_green
/data/data/####/d_btnbg_orange
/data/data/####/d_btnbg_yellow
/data/data/####/d_cloesbtn_top
/data/data/####/d_cp_more_btn
/data/data/####/d_cp_other_btn
/data/data/####/d_default_bg
/data/data/####/d_dtop_closebtn
/data/data/####/d_img_bg
/data/data/####/d_install_btn
/data/data/####/d_list_title_bg
/data/data/####/d_listcloseBtn
/data/data/####/d_listview_bg
/data/data/####/d_m_star
/data/data/####/d_page_normol
/data/data/####/d_page_selecte_blue
/data/data/####/d_page_selecte_green
/data/data/####/d_page_selecte_orange
/data/data/####/d_page_selecte_yellow
/data/data/####/d_pop_back
/data/data/####/d_pop_bottom_btn
/data/data/####/d_safe_icon
/data/data/####/d_safe_line
/data/data/####/d_sc_circle
/data/data/####/d_shortcutad_bg
/data/data/####/d_tj_line
/data/data/####/d_top_bg
/data/data/####/dydCfgPref.xml
/data/data/####/dydTimePref.xml
/data/data/####/dyd_push.xml
/data/data/####/fconf_pre.xml
/data/data/####/fp_download.db-journal
/data/data/####/fs_download.db-journal
/data/data/####/fsappInfo_pre.xml
/data/data/####/fsconf_pre.xml
/data/data/####/fstrategy_pre.xml
/data/data/####/ghkn.zip
/data/data/####/img_bg.png
/data/data/####/item_btn.png
/data/data/####/ki.xml
/data/data/####/kp_shortcut.xml
/data/data/####/lcdownloads
/data/data/####/lcdownloads-journal
/data/data/####/ldownloads
/data/data/####/ldownloads-journal
/data/data/####/libsecexe.x86.so
/data/data/####/libsecmain.x86.so
/data/data/####/ljk.xml
/data/data/####/m_star.png
/data/data/####/new_l_req_st.xml
/data/data/####/of_prefs
/data/data/####/pdownloads
/data/data/####/pdownloads-journal
/data/data/####/pop_back.png
/data/data/####/pop_bottom_btn.png
/data/data/####/popad_share.xml
/data/data/####/pushapp.png
/data/data/####/request_prefs.xml
/data/data/####/safe_icon.png
/data/data/####/safe_line.png
/data/data/####/sc_circle.png
/data/data/####/tj_line.png
/data/data/####/toggle_flag_pref.xml
/data/data/####/top_bg.png
/data/data/####/webview.db-journal
/data/data/####/zkl.jar
/data/media/####/KI.DAT
/data/media/####/clst.dat
/data/media/####/http+apk+d+ad+yuanfenup+com+ad+20181204+201812...03+png
/data/media/####/ljk.dat
/data/media/####/log.txt
/data/media/####/manifest.db
/data/media/####/manifest.db-journal
/data/media/####/reqt.dat
/data/media/####/rt.dat
/data/media/####/spt.dat
/data/media/####/st.dat

Miscellaneous:

Executes the following shell scripts:

<Package> <Package> -1836483368 0 /data/app/<Package>-1.apk 42 <Package> 47 48
chmod 755 <Package Folder>/.cache/<Package>

Loads the following dynamic libraries:

libsecexe.x86

Uses the following algorithms to encrypt data:

PBEWithSHA256And256BitAES-CBC-BC

Uses the following algorithms to decrypt data:

PBEWithSHA256And256BitAES-CBC-BC

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial