Android.DownLoader.3013

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Downloads the following detected threats from the Web:

Android.Xiny.20

Network activity:

Connecting to:

2####.####.31
a####.####.com
d####.####.cn
r####.####.cn

HTTP GET requests:

2####.####.31/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/wet4.jar?wsiphos...
d####.####.cn/jarFile/SDKAutoUpdate/wet4.jar

HTTP POST requests:

a####.####.com/situp
r####.####.cn/k2?protocol=####&version=####&cid=####

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/ApplicationCache.db-journal (deleted)
<Package Folder>/cache/ads1743540823.jar
<Package Folder>/databases/SitUps_Mos.db-journal
<Package Folder>/databases/downloadswc
<Package Folder>/databases/downloadswc-journal
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/1.1496215445472.000000002
<Package Folder>/files/####/1.1496215445472.000000003
<Package Folder>/files/####/1.1496215445472.000000004
<Package Folder>/files/####/1.1496215445472.000000005
<Package Folder>/files/####/1.1496215445472.000000006
<Package Folder>/files/####/1.1496215445472.000000007
<Package Folder>/files/####/1.1496215445472.000000009
<Package Folder>/files/####/1.1496215445472.000000010
<Package Folder>/files/####/1.1496215445472.000000011
<Package Folder>/files/####/1.1496215445472.000000012
<Package Folder>/files/####/1.1496215445472.000000013
<Package Folder>/files/####/1.1496215445472.000000014
<Package Folder>/files/####/1.1496215445472.000000015
<Package Folder>/files/####/1.1496215445472.000000016
<Package Folder>/files/####/1.1496215445472.000000017
<Package Folder>/files/####/1.1496215445472.000000018
<Package Folder>/files/####/1.1496215445472.000000019
<Package Folder>/files/####/1.1496215445472.000000020
<Package Folder>/files/####/1.1496215445472.000000021
<Package Folder>/files/####/1.1496215445472.000000022
<Package Folder>/files/####/1.1496215445472.000000023
<Package Folder>/files/####/1.1496215445472.000000024
<Package Folder>/files/####/1.1496215445472.000000025
<Package Folder>/files/####/1.1496215445472.000000026
<Package Folder>/files/gaClientId
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/ServerConfig.xml
<Package Folder>/shared_prefs/ServerConfig.xml.bak
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/shared_prefs/a.xml
<Package Folder>/shared_prefs/a.xml.bak
<Package Folder>/shared_prefs/com.crittercism.52db670c46b7c23172000003.usermetadata.xml
<Package Folder>/shared_prefs/com.crittercism.52db670c46b7c23172000003.usermetadata.xml.bak
<Package Folder>/shared_prefs/com.crittercism.optmz.config.xml
<Package Folder>/shared_prefs/com.crittercism.ratemyapp.xml
<Package Folder>/shared_prefs/com.crittercism.txn.config.xml
<Package Folder>/shared_prefs/com.crittercism.usersettings.xml
<Package Folder>/shared_prefs/dropbox-credentials.xml
<Package Folder>/shared_prefs/st.xml
<SD-Card>/Download/####/4.8_wet4.jar.tmp
<SD-Card>/dt/restime.dat