Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Prompts to install third-party applications.
Network activity:
Connecting to:
- s####.####.com
- g####.####.cn
- d####.####.cn
- 7x####.####.com
- o####.####.com
- z####.####.com
- c####.####.cn
- a####.####.com
HTTP GET requests:
- c####.####.cn/game/icon/s/1491572718210.png
- c####.####.cn/game/icon/s/1491028697133.png
- c####.####.cn/game/icon/s/1474962642244.png
- c####.####.cn/game/icon/s/1494568241977.png
- c####.####.cn/game/icon/s/1455766922912.png
- c####.####.cn/apk/xxhtc_jolo20170324141832196!bjjl
- c####.####.cn/game/icon/s/1484302255606.png
- c####.####.cn/resources/gj.png
- c####.####.cn/game/icon/2938958624765.jpg
- c####.####.cn/game/icon/s/1463402090528.png
- c####.####.cn/game/icon/s/1484551984450.png
- c####.####.cn/game/icon/s/1479193094554.png
- c####.####.cn/game/pic/2017-02-24/1487906789136.jpg
- c####.####.cn/game/icon/s/1484121875715.png
- c####.####.cn/game/icon/s/1487127061563.png
- c####.####.cn/49acdd95a4981978e996c00518b003d0.png
- c####.####.cn/game/icon/s/1483093449496.png
- c####.####.cn/game/icon/s/1446461029626.png
- c####.####.cn/game/icon/s/1461638287833.png
- c####.####.cn/game/icon/s/1495077217794.png
- 7x####.####.com/d/jquery-1.10.1.min.js
- c####.####.cn/game/icon/s/1482214855544.png
- c####.####.cn/game/icon/s/1490586805994.png
- c####.####.cn/game/icon/s/1467185152802.png
- c####.####.cn/file/20170521/6d0f0f8c-a8a3-45d4-a871-8c65e51a362f.gz
- c####.####.cn/a662f1e51d9d2ee7987c9e1f1d983504.png
- c####.####.cn/game/icon/s/1478745416488.png
- c####.####.cn/game/icon/s/1493203656485.png
- c####.####.cn/game/icon/s/1459178363000.png
- c####.####.cn/game/icon/s/1390209186009.png
- c####.####.cn/game/icon/s/1495077692344.png
- c####.####.cn/game/pic/2016-04-26/1461638289739.jpg
- c####.####.cn/game/icon/s/1492687616975.png
- c####.####.cn/game/icon/s/1495188149882.png
- c####.####.cn/game/icon/s/1495182145571.png
- c####.####.cn/game/icon/2986984944419.jpg
- c####.####.cn/game/pic/2016-04-26/1461638289231.jpg
- c####.####.cn/game/icon/2958570535082.jpg
- c####.####.cn/game/icon/s/1468291860661.png
- c####.####.cn/game/icon/s/1487563257299.png
- c####.####.cn/game/icon/2975134770228.png
- c####.####.cn/game/pic/2017-04-20/1492658157438.jpg
- c####.####.cn/game/icon/s/1484906335275.png
- c####.####.cn/game/icon/s/1493730705903.png
- c####.####.cn/game/icon/s/1474600883892.png
- c####.####.cn/e3c2edf79bc125617e347dfdde027f15.jpg
- c####.####.cn/game/icon/2975134698687.png
- c####.####.cn/game/icon/s/1490955455890.png
- c####.####.cn/game/icon/s/1481708146425.png
- c####.####.cn/game/icon/s/1494416582105.png
- c####.####.cn/resources/internet.png
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- c####.####.cn/game/icon/1477665774734.png
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- c####.####.cn/game/icon/s/1441597833121.png
- s####.####.com/core.php?web_id=####&t=####
- c####.####.cn/game/icon/s/1487560832931.png
- s####.####.com/z_stat.php?id=####&web_id=####
- c####.####.cn/game/icon/s/1488855906340.png
- c####.####.cn/resources/tx.png
- c####.####.cn/game/icon/s/1481770141495.png
- c####.####.cn/game/pic/2017-05-12/1494568288805.jpg
- c####.####.cn/game/icon/s/1428388180224.PNG
- c####.####.cn/game/icon/s/1478568746902.png
- c####.####.cn/game/icon/s/1491889960167.png
- c####.####.cn/game/icon/2938958591174.jpg
- c####.####.cn/game/icon/s/1492658141504.png
- c####.####.cn/game/icon/s/1477046966703.png
- c####.####.cn/game/pic/2017-02-24/1487906777889.jpg
- c####.####.cn/game/icon/s/1487678840587.png
- c####.####.cn/game/icon/2975134778067.png
- c####.####.cn/game/icon/2938973024836.png
- c####.####.cn/game/icon/2988195793666.jpg
- g####.####.cn/css/main.css?f=####
- c####.####.cn/game/pic/2016-04-26/1461638288388.jpg
- c####.####.cn/game/icon/s/1447311557827.png
- c####.####.cn/game/pic/2017-05-12/1494568295398.jpg
- c####.####.cn/game/icon/s/1483068945762.png
- c####.####.cn/game/icon/s/1487819053331.png
- c####.####.cn/game/icon/s/1470208181587.png
- g####.####.cn/tactics.htm?m=####&gamecode=####
- c####.####.cn/game/icon/2939153776925.jpg
- c####.####.cn/resources/datapackage.png
- c####.####.cn/game/icon/s/1467702192004.png
- c####.####.cn/game/icon/2958570153254.jpg
- c####.####.cn/game/icon/s/1488689707525.png
- c####.####.cn/game/icon/s/1481272765738.png
- c####.####.cn/game/pic/2016-04-26/1461638291173.jpg
- c####.####.cn/resources/noadvert.png
- c####.####.cn/game/icon/s/1472527094924.png
- c####.####.cn/image/spic/2/1/201711752128.png
- c####.####.cn/game/icon/s/1486265438051.png
- c####.####.cn/image/spic/3/1/2016121632346.png
- c####.####.cn/game/icon/s/1491451269713.png
- c####.####.cn/game/pic/2017-02-24/1487906783352.jpg
- c####.####.cn/game/icon/s/1488362702625.png
- c####.####.cn/game/icon/2938958611092.jpg
- c####.####.cn/game/icon/s/1492078881394.png
- c####.####.cn/game/icon/2987698694276.png
- c####.####.cn/game/icon/s/1484900335455.png
- c####.####.cn/game/icon/s/1473404301131.png
- c####.####.cn/game/pic/2017-05-12/1494568285096.jpg
- c####.####.cn/game/icon/s/1486277308656.png
- c####.####.cn/game/pic/2017-02-24/1487906780490.jpg
- c####.####.cn/game/icon/s/1489124514190.png
- c####.####.cn/game/pic/2017-05-12/1494568276092.jpg
- c####.####.cn/772fa90efc1281cbd79d69f6c17306d5.png
- c####.####.cn/game/icon/2975134745737.png
- c####.####.cn/game/pic/2017-05-12/1494568280305.jpg
- c####.####.cn/game/icon/s/1486622890167.png
- c####.####.cn/game/icon/s/1493284793763.jpg
- c####.####.cn/image/spic/9/8/201610100524.png
- c####.####.cn/game/icon/s/1461840342202.png
- c####.####.cn/game/icon/s/1493263394645.png
- c####.####.cn/game/icon/2988105341485.jpg
- c####.####.cn/game/pic/2016-04-26/1461638290270.jpg
- c####.####.cn/game/icon/s/1482981582992.png
- c####.####.cn/846f5d586a38998a0359bf03423c0e34.png
- c####.####.cn/game/icon/s/1493724768958.png
- c####.####.cn/game/icon/s/1493182337577.png
- c####.####.cn/game/icon/2975134753076.png
- c####.####.cn/game/icon/s/1492580695300.png
- c####.####.cn/game/icon/2938958573523.jpg
- c####.####.cn/game/icon/s/1495101385579.png
- c####.####.cn/game/icon/s/1495013560004.png
HTTP POST requests:
- g####.####.cn/getgamedetail
- g####.####.cn/getgamegiftlist
- g####.####.cn/getgamelist
- g####.####.cn/getwapgameconfig
- g####.####.cn/getplatbasicinfo
- s####.####.com/cw/cp.action?requestId=####&g=####
- o####.####.com/v2/get_update_time
- g####.####.cn/gettooltip
- g####.####.cn/getapkupgrade
- g####.####.cn/uploaduserapksinfo
- o####.####.com/v2/check_config_update
- a####.####.com/app_logs
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- g####.####.cn/getrelativegames
- g####.####.cn/getgamecommentlist
- g####.####.cn/getpushlist
- g####.####.cn/uploadeventlog
Modified file system:
Creates the following files:
- <Package Folder>/files/online_below_list
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/rank_title
- <Package Folder>/shared_prefs/Jolo_play.xml
- <Package Folder>/databases/DownloadManager.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/Jolo_play.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/online_banner
- <Package Folder>/files/rank_first_lc
- <Package Folder>/files/home_notice
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/home_list
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/hot_games
- <Package Folder>/files/online_game_info
- <Package Folder>/files/jolo_play_img
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/files/jolo_play_games
- <Package Folder>/files/mygames_cache
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/game_type_c
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/mobclick_agent_cached_<Package>5200031
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/files/home_recommand
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- su
- getprop ro.product.cpu.abi
- sh
- app_process /system/bin com.android.commands.pm.Pm install -r /storage/emulated/0/joloplay/download/1447311557827.apk
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2351 --user 0
- <dexopt>
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
