Android.DownLoader.3007

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

2####.####.35
d####.####.cn
e####.####.cn
remoro-####.com

HTTP GET requests:

2####.####.35/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/lvs.jar?wsiphost...
d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
remoro-####.com/images/endless_hills_icon.png

HTTP POST requests:

e####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####

Modified file system:

Creates the following files:

<Package Folder>/cache/####/3d7f941c16576e652efb33b5aa5bc450.0
<Package Folder>/cache/####/3d7f941c16576e652efb33b5aa5bc450.1
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f1de76b2b96f5b4dbef018150e554ef4.0.tmp
<Package Folder>/cache/####/f1de76b2b96f5b4dbef018150e554ef4.1.tmp
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/1468357373244.jar
<Package Folder>/cache/1468357373244.tmp
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/ApplicationCache.db-journal (deleted)
<Package Folder>/databases/downloadswc
<Package Folder>/databases/downloadswc-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/592E7BEE031B-0001-0833-735A1CF7339FBeginSession.cls_temp
<Package Folder>/files/####/592E7BEE031B-0001-0833-735A1CF7339FSessionApp.cls_temp
<Package Folder>/files/####/592E7BEE031B-0001-0833-735A1CF7339FSessionDevice.cls_temp
<Package Folder>/files/####/592E7BEE031B-0001-0833-735A1CF7339FSessionOS.cls_temp
<Package Folder>/files/####/com.crashlytics.settings.json
<Package Folder>/files/####/initialization_marker
<Package Folder>/files/####/sa_07c6b98d-bb80-4cb6-95b0-f3f1455dc161_1496218608841.tap
<Package Folder>/files/####/session_analytics.tap
<Package Folder>/files/####/session_analytics.tap.tmp
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/LUMIS_PREF.xml
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/shared_prefs/a.xml
<Package Folder>/shared_prefs/a.xml.bak
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;com.crashlytics.android.answers.Answers.xml
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.Onboarding.xml
<Package Folder>/shared_prefs/ion-cookies.xml
<Package Folder>/shared_prefs/st.xml
<SD-Card>/Download/####/4.6_lvs.jar.tmp
<SD-Card>/dt/restime.dat
<SD-Card>/mcskineditor/autosave.png