Android.Xiny.5753

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.95

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) hpd.b####.com:80
TCP(HTTP/1.1) t####.talking####.net:80
TCP(HTTP/1.1) a####.u####.com.####.com:80
TCP(HTTP/1.1) a####.b####.com:80
TCP(HTTP/1.1) box.jom####.com:80
TCP(HTTP/1.1) www.a.sh####.com:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) rr5---s####.g####.com:443
TCP(TLS/1.0) b.bdst####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) ssls####.jom####.com:443
TCP(TLS/1.0) gmscomp####.google####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) 1####.251.36.46:443
TCP(TLS/1.0) hectors####.b####.com.####.com:443
TCP(TLS/1.0) search-####.cdn.bc####.####.com:443
TCP(TLS/1.0) sslb####.jom####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) rr4---s####.g####.com:443
TCP(TLS/1.0) hpd.b####.com:443
TCP(TLS/1.0) box.jom####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.251.39.99:443
TCP(TLS/1.2) 1####.251.39.99:443
TCP(TLS/1.2) p####.google####.com:443
UDP rr3---s####.g####.com:443
UDP rr5---s####.g####.com:443
UDP p####.google####.com:443

DNS requests:

1####.i####.com
1####.i####.com.####.8
1.cn.p####.####.org
a####.b####.com
a####.u####.com
ad.qinglvs####.com
ad.qinglvs####.com.####.8
and####.a####.go####.com
and####.google####.com
b.bdst####.com
f####.b####.com
g####.b####.com
g####.bdst####.com
g.p####.com
g.p####.com.####.8
gmscomp####.google####.com
he####.b####.com
hectors####.b####.com
hpd.b####.com
i####.cn
id1.cn.8.####.8
int.d####.s####.####.8
int.d####.s####.####.cn
jic.talking####.com
m.b####.com
p####.google####.com
rr3---s####.g####.com
rr4---s####.g####.com
rr5---s####.g####.com
s.bdst####.com
search-####.cdn.bc####.com
sm.b####.com
ss0.b####.com
ss1.b####.com
ss2.b####.com
t####.talking####.net
td.m####.cn
td.m####.cn.####.8
www.b####.com

HTTP GET requests:

a####.b####.com/apistore/mobilenumber/mobilenumber?phone=####
box.jom####.com/common/openjs/openBox.js?_v=####
hpd.b####.com/v.gif?tid=####&ct=####&cst=####&logFrom=####&logInfo=####&...
www.a.sh####.com/
www.a.sh####.com/se/static/img/iphone/logo.png
www.a.sh####.com/se/static/img/iphone/tab_loading__bg_logo.png
www.a.sh####.com/static/index/plus/public/icon_police.png
www.a.sh####.com/static/index/plus/public/tab_news.png
www.a.sh####.com/static/search/clear.png
www.a.sh####.com/tc?tcreq4log=####&r=####&logid=####&from=####&pu=####&c...

HTTP POST requests:

a####.u####.com.####.com/app_logs
t####.talking####.net/g/d?crc=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/0204275f616ff6b8_0
/data/data/####/0204275f616ff6b8_1
/data/data/####/061099884dd7467a_0
/data/data/####/08ecb96262072aee_0
/data/data/####/0ab1c4642018559a_0
/data/data/####/0bb5823b31d6337b_0
/data/data/####/0c38fb1a2bc80b3d_0
/data/data/####/0c533dbadc5aa9f4_0
/data/data/####/0c8094a5ca231731_0
/data/data/####/152a8a178dbf3fe6_0
/data/data/####/17ff5287d0b4d382_0
/data/data/####/1e82276182256948_0
/data/data/####/2397d37b3aab3424_0
/data/data/####/27fd10c2fc29ad2a_0
/data/data/####/27fd10c2fc29ad2a_1
/data/data/####/28b94ba7714d9f3b_0
/data/data/####/28c1f5d94468824b_0
/data/data/####/2aaaa86467c8e1e3_0
/data/data/####/2da61641ca1b0f5c_0
/data/data/####/301d89ab1628b462_0
/data/data/####/37a6bb9b365b3d55_0
/data/data/####/3b150adb754a57bc_0
/data/data/####/3b150adb754a57bc_1
/data/data/####/3df32d0aa386d5a5_0
/data/data/####/3eab770ec1d0f72b_0
/data/data/####/407a65d172cc9183_0
/data/data/####/40c932471b481a02_0
/data/data/####/40c932471b481a02_1
/data/data/####/427d505b6476c723_0
/data/data/####/4abb04b8704a1140_0
/data/data/####/4fc420446759f95b_0
/data/data/####/60cc9c1cb24406cd_0
/data/data/####/61e3ade5547f4ab8_0
/data/data/####/68f67fd5dafe1f46_0
/data/data/####/6972784726f67578_0
/data/data/####/6b7dd1f3289ce500_0
/data/data/####/76f530fffe5a18f6_0
/data/data/####/7ff81ffc7052df9b_0
/data/data/####/80f113ce33b88d3c_0
/data/data/####/8191eb18520f21c0_0 (deleted)
/data/data/####/885c20792ac9c307_0
/data/data/####/887bdb255256582c_0
/data/data/####/8be6acdf4e38bb03_0
/data/data/####/8fafc4a7b7f1ed73_0
/data/data/####/943e5de7badf1fa2_0
/data/data/####/9bd8ea4e037b2c2b_0
/data/data/####/9c3d82a5f62666ba_0
/data/data/####/9c3d82a5f62666ba_1
/data/data/####/9db62d11b0d38071_0
/data/data/####/Anf3NGF01m7_payload.apk
/data/data/####/Cookies-journal
/data/data/####/HCj4io42D6a_payload.apk
/data/data/####/Signature_0.key
/data/data/####/TDCloudSettingsConfigC8F9371CCA81453492A7DCEBB5C379AE.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml.bak
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/Web Data
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a353d3528d476eee_0
/data/data/####/a42ce4e12d8e405f_0
/data/data/####/a42ce4e12d8e405f_0 (deleted)
/data/data/####/a5f9b0cb36e88afd_0
/data/data/####/a5f9b0cb36e88afd_1
/data/data/####/base-1.apk
/data/data/####/base-1.dex
/data/data/####/base-1.dex.flock (deleted)
/data/data/####/c666e4be124e74f5_0
/data/data/####/cb2aca8945142569_0
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cc3ac51847055b1d_0
/data/data/####/d280b565a3ea2a42_0
/data/data/####/d280b565a3ea2a42_1
/data/data/####/d391cac824346b04_0
/data/data/####/d997ec0f00bdd4a9_0
/data/data/####/d997ec0f00bdd4a9_1
/data/data/####/e4c6855d8ce50146_0
/data/data/####/ee56169dc10e0c21_0
/data/data/####/ee56169dc10e0c21_1
/data/data/####/exchangeIdentity.json
/data/data/####/f94ece0c376f3054_0
/data/data/####/fae6153bfbebaed7_0
/data/data/####/firstStart.xml
/data/data/####/hlg.cwe.mcs_preferences.xml
/data/data/####/index
/data/data/####/metrics_guid
/data/data/####/mi_first.xml
/data/data/####/mpush_app.db-journal
/data/data/####/mpush_gateway_preferences_file
/data/data/####/mpush_version_preferences_file
/data/data/####/phoneTest.xml
/data/data/####/plugins.serviceMapping.xml
/data/data/####/pref.xml
/data/data/####/recordInfo-journal
/data/data/####/result.xml
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/the-real-index
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview_data.lock
/data/media/####/.tcookieid
/data/misc/####/primary.prof

Miscellaneous:

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
DES

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about running apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial