Android.Xiny.1633

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) aserver####.m.ta####.com:80
TCP(HTTP/1.1) mo####.b####.com:80
TCP(HTTP/1.1) m.gzu####.com:80
TCP(HTTP/1.1) wc.find####.cc.####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) cm.pos.b####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) map####.y####.com.cn:80
TCP(HTTP/1.1) si####.jom####.com:80
TCP(HTTP/1.1) c####.jd.com:80
TCP(HTTP/1.1) i####.51.la:80
TCP(HTTP/1.1) js.u####.51.la:80
TCP(HTTP/1.1) m.zu####.org.cn:80
TCP(HTTP/1.1) s.un####.com:80
TCP(HTTP/1.1) wn.pos.b####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) s.c####.b####.com:80
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) mbd.n.sh####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) ss3.b####.com:443
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) ss0.b####.com:443
TCP(TLS/1.0) ss0.bdst####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) wap.n.sh####.com:443
TCP(TLS/1.0) si####.jom####.com:443
TCP(TLS/1.0) cambria####.cdn.bc####.####.com:443

DNS requests:

a####.u####.com
c####.b####.com
c####.b####.com
c####.baidust####.com
c####.baidust####.com
c####.jd.com
cambria####.cdn.bc####.com
cm.miao####.atm.####.com
cm.pos.b####.com
dup.baidust####.com
ec####.b####.com
ext.b####.com
f10.b####.com
f11.b####.com
f12.b####.com
g####.bdst####.com
hm.b####.com
i####.51.la
js.u####.51.la
m.b####.com
m.gzu####.com
m.zu####.org.cn
map####.y####.com.cn
mo####.b####.com
mobads-####.b####.com
pos.b####.com
s.bdst####.com
s.c####.b####.com
s.un####.com
sp0.b####.com
sp1.b####.com
ss0.b####.com
ss0.bdst####.com
ss1.b####.com
ss2.b####.com
ss3.b####.com
t10.b####.com
t11.b####.com
t12.b####.com
wc.find####.cc
wn.pos.b####.com
www.zu####.org.cn

HTTP GET requests:

aserver####.m.ta####.com/cm.gif?dspid=####
c####.baidust####.com/cpro/ui/cm.js
c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
c####.baidust####.com/sync.htm?cproid=####
c####.jd.com/du?&baidu_user_id=####&cookie_version=####&timestamp=####&e...
cm.pos.b####.com/pixel?dspid=####
cm.pos.b####.com/youku?mzid=####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.js?0653032####
i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
js.u####.51.la/18738872.js
m.gzu####.com/
m.gzu####.com/ernianjizuowen/
m.gzu####.com/pic/151101/20180428/214-1P42Q40246234.jpg
m.gzu####.com/sitemap.html
m.gzu####.com/www/css/app.css
m.gzu####.com/www/css/art.css
m.gzu####.com/www/imgs/z-ico1.png
m.gzu####.com/www/js/jquery.min.js
m.gzu####.com/www/js/mad.js
m.gzu####.com/xiaoxuezuowen/
m.gzu####.com/yinianjishuqing/
m.gzu####.com/yinianjixushi/201801/1517205014146066.html
m.gzu####.com/yinianjizhuangwu/
m.gzu####.com/yinianjizhuangwu/201608/1470471373111680.html
m.zu####.org.cn/sitemap.html
m.zu####.org.cn/sitemaps.html
m.zu####.org.cn/www/css/common.css
m.zu####.org.cn/www/css/list.css
m.zu####.org.cn/www/imgs/z-ico5.png
m.zu####.org.cn/www/js/jquery.min.js
m.zu####.org.cn/www/js/jquery.min1.js
m.zu####.org.cn/yinianjithyy/
map####.y####.com.cn/s/mapping/?baidu_error=####&timestamp=####
mo####.b####.com/ads/ads.appcache
mo####.b####.com/ads/css/min/main.css
mo####.b####.com/ads/index.htm
mo####.b####.com/ads/js/ads.trunk.js
mo####.b####.com/ads/js/c.js
mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7043.jar
mo####.b####.com/cpro/ui/mads.php?code2=####&b1525672789473=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1525672819765=####
pos.b####.com/dcrm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/iccm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/scpm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/scpm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/sync_pos.htm?cproid=####
pos.b####.com/sync_pos.htm?cproid=####&t=####
pos.b####.com/xcrm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/yczm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/yczm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/zcjm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
s.c####.b####.com/s.htm?cproid=####&t=####
si####.jom####.com/it/u=1067202985,1445559114&fm=76
si####.jom####.com/it/u=107753503,181275158&fm=76
si####.jom####.com/it/u=1290228074,436258670&fm=76
si####.jom####.com/it/u=1344957095,12611258&fm=76
si####.jom####.com/it/u=1361276640,1907636526&fm=76
si####.jom####.com/it/u=145486076,4125360639&fm=76
si####.jom####.com/it/u=1532369419,1032918301&fm=76
si####.jom####.com/it/u=1599686278,495131910&fm=76
si####.jom####.com/it/u=1731106803,2507023088&fm=76
si####.jom####.com/it/u=1787728580,2258219358&fm=76
si####.jom####.com/it/u=1789519269,1052323278&fm=76
si####.jom####.com/it/u=1838919676,1017938361&fm=76
si####.jom####.com/it/u=1862046031,2698700929&fm=76
si####.jom####.com/it/u=2041446303,2986590210&fm=76
si####.jom####.com/it/u=206559122,3092245477&fm=76
si####.jom####.com/it/u=2943070796,2749569130&fm=76
si####.jom####.com/it/u=3020441218,3980127665&fm=76
si####.jom####.com/it/u=311296304,1900733025&fm=76
si####.jom####.com/it/u=3118428872,3071454351&fm=76
si####.jom####.com/it/u=3405998294,3484193259&fm=76
si####.jom####.com/it/u=364370451,4232451809&fm=76
si####.jom####.com/it/u=3666905670,3636195512&fm=76
si####.jom####.com/it/u=3698601844,1066823458&fm=76
si####.jom####.com/it/u=385132995,669498755&fm=76
si####.jom####.com/it/u=4034067330,3971343317&fm=76
si####.jom####.com/it/u=4154401951,4215729478&fm=76
si####.jom####.com/it/u=416178739,3115995123&fm=76
si####.jom####.com/it/u=449848416,4104026111&fm=76
si####.jom####.com/it/u=480230388,1875070067&fm=76
si####.jom####.com/it/u=509827831,3061346639&fm=76
si####.jom####.com/it/u=598775401,1445984355&fm=76
si####.jom####.com/it/u=638085556,2285136908&fm=76
si####.jom####.com/it/u=684957616,3910403245&fm=76
si####.jom####.com/it/u=803506627,1088895114&fm=76
si####.jom####.com/it/u=83344015,3936628562&fm=76
si####.jom####.com/it/u=929873207,4223707204&fm=76
si####.jom####.com/it/u=933289105,65835159&fm=76
si####.jom####.com/it/u=981281673,1150612314&fm=76
wc.find####.cc.####.com/2011/rio.jar
wn.pos.b####.com/adx.php?c=####

HTTP POST requests:

a####.u####.com/app_logs
s.un####.com/cw/cp.action?requestId=####&g=####
s.un####.com/cw/interface!u2.action?protocol=####&version=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/ApplicationCache.db-journal
/data/data/####/CachedGeoposition.db
/data/data/####/CachedGeoposition.db-journal
/data/data/####/W_Key.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__ddd728bd-1bee-4d09-9b7...f2.jar
/data/data/####/__xadsdk_downloaded__version__.xml
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/downloadswc
/data/data/####/downloadswc-journal
/data/data/####/exchangeIdentity.json
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/http_m.zuowen.org.cn_0.localstorage-journal
/data/data/####/http_mobads.baidu.com_0.localstorage-journal
/data/data/####/https_m.baidu.com_0.localstorage-journal
/data/data/####/index
/data/data/####/st.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/3.6_rio.jar.tmp
/data/media/####/assetstime.dat

Miscellaneous:

Loads the following dynamic libraries:

Uses the following algorithms to decrypt data:

RSA-ECB-PKCS1Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial