Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- d####.####.cn
HTTP GET requests:
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
HTTP POST requests:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/share_preference.xml.bak
- <Package Folder>/shared_prefs/total_solution.xml
- <Package Folder>/res_files/ic_notification.png
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1099439983.zip
- <Package Folder>/app_CTmodule/pubkey
- <Package Folder>/databases/marsquerycache.dat-journal
- <Package Folder>/databases/MessageCall.db-journal
- <Package Folder>/shared_prefs/share_preference.xml
- <Package Folder>/databases/google_analytics_v2.db-journal
- <Package Folder>/shared_prefs/cobranding_preference.xml
- <Package Folder>/res_files/bg_main_ui_action_bar_mu_zh_TW.9.png
- <Package Folder>/Library/pattern.properties
- <Package Folder>/res_files/icon_oem_trueyou.png
- <Package Folder>/shared_prefs/secondary_email_preference.xml
- <Package Folder>/Library/AU_Data/AU_Cache/mobilesecurity.activeupdate.trendmicro.com/server.ini.etag
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/feedback.prefs.xml
- <Package Folder>/res_files/banner_loading_zh_TW.png
- <Package Folder>/res_files/ico_tm_logo.png
- <Package Folder>/shared_prefs/whoscallSDK.xml.bak
- <Package Folder>/shared_prefs/SCAN_AU_SHARED.xml.bak
- <Package Folder>/Library/librtpatch.so
- <Package Folder>/Library/publickey
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/databases/anti-spam.db-journal
- <Package Folder>/shared_prefs/mpa_preference.xml.bak
- <Package Folder>/shared_prefs/callsms_preference.xml.bak
- <Package Folder>/databases/mpa.dat-journal
- <Package Folder>/app_CTmodule/index.json
- <Package Folder>/Library/libtmactupdate.so
- <Package Folder>/Library/aucfg.ini
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/res_files/image_tm_logo_loading.png
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/callsms_preference.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/res_files/ico_action_bar_tball.png
- <Package Folder>/shared_prefs/NETWORK_PREF_MUP.xml
- <Package Folder>/shared_prefs/shared_preference.xml
- <Package Folder>/res_files/bg_main_ui_action_bar_zh_TW.9.png
- <Package Folder>/res_files/bg_main_ui_action_bar.9.png
- <Package Folder>/shared_prefs/ReferralParamsFile.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/wtp.db-journal
- <Package Folder>/Library/AuPatch
- <Package Folder>/databases/marsresult.db-journal
- <Package Folder>/Library/AU_Data/AU_Cache/mobilesecurity.activeupdate.trendmicro.com/server.ini
- <Package Folder>/res_files/img_product_name_zh_TW.png
- <Package Folder>/databases/usage_counter.db-journal
- <Package Folder>/shared_prefs/dr_level_share_pref.xml
- <Package Folder>/shared_prefs/NETWORK_PREF.xml.bak
- <Package Folder>/databases/anti-spam.db
- <Package Folder>/shared_prefs/mpa_preference.xml
- <Package Folder>/shared_prefs/mpa_data_collect_preference.xml
- <Package Folder>/res_files/bg_popup_header_zh_TW.png
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/res_files/bg_main_ui_action_bar_mu.9.png
- <Package Folder>/databases/scanresult.db-journal
- <Package Folder>/res_files/img_product_name.png
- <Package Folder>/databases/MessageCall.db
- <Package Folder>/res_files/bg_popup_header.png
- <Package Folder>/shared_prefs/SCAN_AU_SHARED.xml
- <Package Folder>/databases/updatelog.db-journal
- <Package Folder>/shared_prefs/LICENSE_SHARED.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/scannedapp.dat-journal
- <Package Folder>/Library/pattern/msothaos.625
- <Package Folder>/res_files/banner_about.png
- <Package Folder>/res_files/banner_loading.png
- <Package Folder>/databases/notification_center_db-journal
- <Package Folder>/Library/AU_Data/AU_Log/TmuDump.txt
- <Package Folder>/shared_prefs/event_share_preference.xml
- <Package Folder>/shared_prefs/RB_DEFAULT.xml
- <Package Folder>/databases/jobStore.db-journal
- <Package Folder>/databases/notification_center_db
- <Package Folder>/res_files/img_trend_micro_logo.png
- <Package Folder>/res_files/icon_oem_asus.png
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/whoscallSDK.xml
- <Package Folder>/Library/AU_Data/AU_Cache/mobilesecurity.activeupdate.trendmicro.com/server.ini.lock
- <Package Folder>/shared_prefs/NETWORK_PREF.xml
Miscellaneous:
Executes next shell scripts:
- ps
- <dexopt>
Contains functionality to send SMS messages automatically.
