Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- 2####.####.35
- a####.####.cn
- a####.####.cn:8382
- a####.####.com
- d####.####.cn
- e####.####.cn
- h####.####.com
- l####.####.com
HTTP GET requests:
- 2####.####.35/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/lvs.jar?wsiphost...
- a####.####.cn/tiguas3/bookversionstores?token=####&usrid=####
- a####.####.cn:8382/tiguas3/books?bookstoreversion=####&token=####&usrid=...
- d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
HTTP POST requests:
- a####.####.com/app_logs
- a####.####.com/snsconf
- e####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- h####.####.com/app.gif
- l####.####.com/sdk.php
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/-2206427831403348994
- <Package Folder>/cache/####/-57027780-1105609021
- <Package Folder>/cache/####/-57027780-1865438919
- <Package Folder>/cache/####/-884974564-99607454
- <Package Folder>/cache/####/18925035521154092389
- <Package Folder>/cache/####/18925037381240135777
- <Package Folder>/cache/####/924217744-1362171430
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/sharesdk.db-journal
- <Package Folder>/databases/tigudatabase
- <Package Folder>/databases/tigudatabase-journal
- <Package Folder>/files/####/DVDirectory.cfg
- <Package Folder>/files/####/DVHotMap.cfg
- <Package Folder>/files/####/DVHotcity.cfg
- <Package Folder>/files/####/DVVersion.cfg
- <Package Folder>/files/####/ResPack.rs
- <Package Folder>/files/####/firll.dat
- <Package Folder>/files/####/mapstyle.sty
- <Package Folder>/files/.imprint
- <Package Folder>/files/CMRequire.dat
- <Package Folder>/files/VerDatset.dat
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/mobclick_agent_cached_<Package>2017031414
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/ver.dat
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/authStatus_<Package>.xml
- <Package Folder>/shared_prefs/authStatus_<Package>;remote.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/share_sdk_0.xml
- <Package Folder>/shared_prefs/share_sdk_0.xml.bak
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Download/####/4.6_lvs.jar.tmp
- <SD-Card>/ShareSDK/.ba
- <SD-Card>/ShareSDK/.dk
- <SD-Card>/backups/####/.cuid
- <SD-Card>/baidu/####/conlts.dat
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/####/yoh.dat
- <SD-Card>/baidu/####/yol.dat
- <SD-Card>/baidu/####/yom.dat
- <SD-Card>/baidu/.cuid
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /sys/class/net/wlan0/address
