Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- 2####.####.31
- d####.####.cn
- mon####.####.com
- pmi####.####.com
- r####.####.cn
HTTP GET requests:
- 2####.####.31/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/wet4.jar?wsiphos...
- d####.####.cn/jarFile/SDKAutoUpdate/wet4.jar
HTTP POST requests:
- mon####.####.com/analytics/rqdsync
- pmi####.####.com/
- r####.####.cn/k1?requestId=####&g=####&ua=####
Modified file system:
Creates the following files:
- /system/etc/install-recovery.sh
- /system/usr/####/ikmsu
- /system/usr/attrch
- <Package Folder>/app_permission/ipme_2x
- <Package Folder>/app_permission/solo_km.10
- <Package Folder>/applib/attrch
- <Package Folder>/applib/busybox
- <Package Folder>/applib/kd
- <Package Folder>/applib/kd.tmp
- <Package Folder>/applib/libNativeRQD.so
- <Package Folder>/applib/libxy.so
- <Package Folder>/applib/p_monitor2_x
- <Package Folder>/applib/supolicy
- <Package Folder>/applib/tools
- <Package Folder>/cache/MLFiletr.conf
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/eup_db
- <Package Folder>/databases/eup_db-journal
- <Package Folder>/databases/perform.db
- <Package Folder>/databases/perform.db-journal
- <Package Folder>/databases/pure_log.db
- <Package Folder>/databases/pure_log.db-journal
- <Package Folder>/databases/ss.db
- <Package Folder>/databases/ss.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/data
- <Package Folder>/files/21_wod.jar
- <Package Folder>/files/40263.dat
- <Package Folder>/files/40264.dat
- <Package Folder>/files/40270.dat
- <Package Folder>/files/SuTimeCtrl.dat
- <Package Folder>/files/e_config
- <Package Folder>/files/firewall-2.0.2.dat
- <Package Folder>/files/k_ul
- <Package Folder>/files/kulibs.conf
- <Package Folder>/files/sc01
- <Package Folder>/files/sh.tmp
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/accessSDKProperties.xml
- <Package Folder>/shared_prefs/accessSDKProperties.xml.bak
- <Package Folder>/shared_prefs/accessSDKProperties.xml.bak (deleted)
- <Package Folder>/shared_prefs/actionStats.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak (deleted)
- <Package Folder>/shared_prefs/common_setting.xml
- <Package Folder>/shared_prefs/engine_config.xml
- <Package Folder>/shared_prefs/engine_config.xml.bak
- <Package Folder>/shared_prefs/first_enable_script.xml
- <Package Folder>/shared_prefs/fk_applyRoot.xml
- <Package Folder>/shared_prefs/fk_applyRootByOther.xml
- <Package Folder>/shared_prefs/fk_reportRoot.xml
- <Package Folder>/shared_prefs/km.conf.xml
- <Package Folder>/shared_prefs/km_access_setting.xml
- <Package Folder>/shared_prefs/km_setting.xml
- <Package Folder>/shared_prefs/km_su.xml
- <Package Folder>/shared_prefs/km_update_setting.xml
- <Package Folder>/shared_prefs/mulDataStats.xml
- <Package Folder>/shared_prefs/pmDataStats.xml
- <Package Folder>/shared_prefs/pmSmsDataStats.xml
- <Package Folder>/shared_prefs/pr02.xml
- <Package Folder>/shared_prefs/pure_state.xml
- <Package Folder>/shared_prefs/setting_fast_report.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/stringDataStats.xml
- <Package Folder>/shared_prefs/stringDataStatsNew.xml
- <Package Folder>/shared_prefs/switchStats.xml
- <Package Folder>/shared_prefs/switchStats.xml.bak
- <Package Folder>/shared_prefs/tombstone.xml
- <SD-Card>/Download/####/4.8_wet4.jar.tmp
- <SD-Card>/dt/restime.dat
- <SD-Card>/e_config
Miscellaneous:
Executes next shell scripts:
- /data/data/com.dianling.youhua.dashisssaaogewxtsgnt/applib/kd
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/sh -c getprop ro.board.platform
- <dexopt>
- <su-internal:request>
- <su-internal:result>
- chcon u:object_r:system_file:s0 /system/etc/install-recovery.sh
- chcon u:object_r:system_file:s0 /system/usr/attrch
- chmod 0755 /system/etc/install-recovery.sh
- chmod 0755 /system/usr/attrch
- chmod 0755 /system/usr/ikm
- chmod 0755 <Package Folder>/applib/kd
- chmod 0755 <Package Folder>/applib/p_monitor2_x
- chmod 0755 <Package Folder>/files/21_wod.jar
- chmod 0764 <Package Folder>/applib/attrch
- chmod 0764 <Package Folder>/applib/busybox
- chmod 0764 <Package Folder>/applib/libNativeRQD.so
- chmod 0764 <Package Folder>/applib/libxy.so
- chmod 0764 <Package Folder>/applib/supolicy
- chmod 0764 <Package Folder>/applib/tools
- chmod 0771 <Package Folder>/applib
- chmod 6755 /system/usr/ikm/ikmsu
- chmod 755 /dev/p_monitor2_x
- chmod 755 <Package Folder>/app_permission/ipme_2x
- chmod 755 <Package Folder>/app_permission/solo_km.10
- chmod 755 <Package Folder>/files/k_ul
- chown 0.0 /system/etc/install-recovery.sh
- chown 0.0 /system/usr/attrch
- daemonsu
- dumpsys activity -a provider com.kingroot.common.framework.task.provider.KTaskProvider
- getprop ro.board.platform
- id
- ku.sud
- mkdir /system/usr/ikm
- mount -o remount -rw /system
- mount -o ro,remount /system /system
- ps
- ps k_ul
- rm /dev/p_monitor2_x
- rm /system/usr/attrch
- rm /system/usr/ikm/ikmsu
- rm <Package Folder>/files/sh.tmp
- service list
- sh
- sh <Package Folder>/applib/kd
- su
- su -v
Uses elevated priveleges.
