Technical information
Malicious functions:
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- h####.####.com
- i####.####.com
- 7j####.####.com
- c-h####.####.com
- d####.####.com
- a####.####.cn
- inter####.####.com
- a####.####.com
HTTP GET requests:
- s####.####.com/config/hz-hzv3.conf
- inter####.####.com/api/start
- 7j####.####.com/tdata_Hhd935
- inter####.####.com/api/ranking?type=####&page=####
- inter####.####.com/api/index?pagesize=####&page=####
- d####.####.com/api/game/getrescnt?package=####&app_id=####&channel_id=####&cuid=####&svr=####&ovr=####&device=####&app_id=####&channel_id=####&sdk=###...
- inter####.####.com/api/clients/releases/latest
- inter####.####.com/api/popup
- inter####.####.com/api/v2/group/search/by_game_id/84281
- i####.####.com/uploads/icons/d/3/d39e2967828d238b508019b7bcfd345b.png
- i####.####.com/launch/5/e/5e9311333f7e80b5174ae8ea91e8651a.jpg
- 7j####.####.com/tdata_Oxl942
- i####.####.com/gcenter.json
- inter####.####.com/api/games/84281/comments?page=####
- inter####.####.com/api/search
- i####.####.com/uploads/icons/8/c/8c406de522b447cf1838b024b4e21e67.png
- inter####.####.com/api/games/84281
- inter####.####.com/api/search/autocomplete?q=####
- a####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
HTTP POST requests:
- a####.####.cn/cw/cp.action?requestId=####&g=####
- a####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- h####.####.com/app.gif
- s####.####.com/api.php?format=####&t=####
- inter####.####.com/
- d####.####.com/api/sdk/reportactive?cuid=####&svr=####&ovr=####&device=####&app_id=####&channel_id=####&sdk=####
- a####.####.com/app_logs
- d####.####.com/api/sdk/activate?cuid=####&svr=####&ovr=####&device=####&app_id=####&channel_id=####&sdk=####
- c-h####.####.com/api.php?format=####&t=####
- inter####.####.com/api/games/manage
Modified file system:
Creates the following files:
- /data/data/####/databases/hjdata.db-journal
- /data/data/####/shared_prefs/TrineaAndroidCommon.xml
- /sdcard/backups/system/.confd
- /data/data/####/files/push.pid
- /data/data/####/files/init.pid
- /data/data/####/databases/download.db
- /data/data/####/files/run.pid
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/databases/wakeup_silence_user.db-journal
- /sdcard/backups/.SystemConfig/.cuid
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/image_manager_disk_cache/9f34e0eb8d830bf7fa78f7af2edfc99452563b38ebe5c2d85b90370f7aa9cbb7.0.tmp
- /sdcard/Download/fts/4.3_hyjwan.jar
- /data/data/####/files/tdata_Oxl942
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/files/.imprint
- /data/data/####/databases/Staistics
- /data/data/####/files/gdaemon_20161017
- /data/data/####/shared_prefs/tbs_download_config.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/pushext.db-journal
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/setting.xml.bak
- /data/data/####/shared_prefs/configs.xml
- /sdcard/Android/data/.nomedia
- /sdcard/backups/system/.timestamp
- /data/data/####/files/libcuid.so
- /data/data/####/shared_prefs/version.xml
- /data/data/####/files/__local_stat_cache.json
- /data/data/####/databases/pushsdk.db-journal
- /sdcard/dt/restime.dat
- /data/data/####/files/tdata_Hhd935.jar
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/shared_prefs/packverson.xml
- /data/data/####/shared_prefs/versionUpdate.xml
- /data/data/####/databases/favorite
- /sdcard/backups/system/.confd-journal
- /data/data/####/shared_prefs/hj_datasdk_settings.xml.bak
- /data/data/####/shared_prefs/a.xml
- /data/data/####/databases/download.db-journal
- /sdcard/system/tmp/local/tdata_Oxl942
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/files/__local_last_session.json
- /data/data/####/databases/pushg.db-journal
- /data/data/####/shared_prefs/requisite.xml
- /data/data/####/files/__local_ap_info_cache.json
- /data/data/####/shared_prefs/loadingImg.xml
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/app_tbs/core_private/tbslock.txt
- /data/data/####/databases/Staistics-journal
- /data/data/####/cache/image_manager_disk_cache/journal.tmp
- /data/data/####/shared_prefs/loadingImg.xml.bak
- /sdcard/libs/####.db
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/shared_prefs/tbs_download_config.xml
- /data/data/####/shared_prefs/st.xml
- /sdcard/libs/app.db
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- /data/data/####/shared_prefs/TrineaAndroidCommon.xml.bak
- /sdcard/huanju/data/config.properties
- /sdcard/TiantianGame/cachePic/5ce3dd5ff3c894982824812a3ddd0de0
- /sdcard/.xy
- /data/data/####/files/umeng_it.cache
- /data/data/####/cache/image_manager_disk_cache/319df768c60f6214877913b86456bd26612bd3779b98a676d687d17f0c8d2069.0.tmp
- /data/data/####/databases/hjdata.db
- /data/data/####/databases/favorite-journal
- /data/data/####/shared_prefs/LTBL_Game.xml
- /data/data/####/files/tdata_Hhd935
- /data/data/####/databases/increment.db-journal
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/app_tbs/share/core_info
- /data/data/####/files/init_c.pid
- /data/data/####/files/tdata_Oxl942.jar
- /data/data/####/app_tbs/core_private/tbscoreinstall.txt
- /sdcard/system/tmp/local/tdata_Hhd935
- /data/data/####/databases/downloadswc
- /sdcard/huanju/.cuid
- /data/data/####/shared_prefs/hj_datasdk_settings.xml
- /data/data/####/files/__send_data_1485415657639
Miscellaneous:
Executes next shell scripts:
- chmod 700 /data/data/####/files/gdaemon_20161017
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24271 300 0
Contains functionality to send SMS messages automatically.
