Android.DownLoader.2500

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

s####.####.com
d####.####.cn

HTTP GET requests:

d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar

HTTP POST requests:

s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
s####.####.com/cw/cp.action?requestId=####&g=####

Modified file system:

Creates the following files:

<Package Folder>/app_avl/libm/libavlm.so
<Package Folder>/shared_prefs/antivirus.preferences.xml.bak
<Package Folder>/app_avl/avl/conf/liscense.conf
<Package Folder>/shared_prefs/admob.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/app_avl/native_log/com_jiandan_shadushaispgai_sajgipwet_scanService_PROFILE_AVL_LOG_.log
<Package Folder>/cache/ads-1079003963.jar
<Package Folder>/app_avl/avl/android/avlpk_herui.avl
<Package Folder>/files/gaClientId
<Package Folder>/shared_prefs/a.xml
<Package Folder>/app_avl/libm/libavlm_x86-v23.so
<Package Folder>/databases/downloadswc-journal
<Package Folder>/cache/webviewCacheChromium/index
<Package Folder>/files/INSTALLATION_UUID
<Package Folder>/app_avl/avl/android/avlpk_kw.avl
<Package Folder>/cache/webviewCacheChromium/f_000001
<Package Folder>/cache/webviewCacheChromium/f_000003
<Package Folder>/cache/webviewCacheChromium/f_000002
<Package Folder>/cache/webviewCacheChromium/f_000005
<Package Folder>/cache/webviewCacheChromium/f_000004
<Package Folder>/files/vulnerabilities.xml
<Package Folder>/shared_prefs/antivirus.preferences.xml
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/files/blacklist_files.xml
<Package Folder>/databases/downloadswc
<Package Folder>/shared_prefs/st.xml
<Package Folder>/app_avl/libm/libavlm-v23.so
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/shared_prefs/avl_conf.xml
<Package Folder>/app_avl/avl/android/avlpk_white.avl
<Package Folder>/app_avl/sdk/conf/url.conf
<Package Folder>/files/blacklist_apps.xml
<Package Folder>/databases/webview.db-journal
<Package Folder>/app_avl/avl/conf/avllib.conf
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/app_avl/libm/libavlm_x86.so
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/cache/webviewCacheChromium/data_3
<Package Folder>/cache/webviewCacheChromium/data_2
<Package Folder>/cache/webviewCacheChromium/data_1
<Package Folder>/cache/webviewCacheChromium/data_0