Android.Xiny.2128

Malicious functions:

Executes code of the following detected threats:

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 45.79.1####.241:80
TCP(HTTP/1.1) 45.33.1####.188:80
TCP(HTTP/1.1) ggg.koapk####.com:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) www.koapk####.com:8081

DNS requests:

HTTP POST requests:

Modified file system:

Creates the following files:

Miscellaneous:

Executes next shell scripts:

c201806081450.apk -c <Package>:qmydp
chmod -R 777 <Package Folder>/com.init.env/app_abz /storage/emulated/0/abz
chmod 0755 <Package Folder>/com.init.env
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk926/files/forever.sh
chmod 0777 <Package Folder>/p.dk926/files/krmain
chmod 0777 <Package Folder>/p.dk926/files/krsdk.cert
chmod 0777 <Package Folder>/p.dk952/files/forever.sh
chmod 0777 <Package Folder>/p.dk952/files/krmain
chmod 777 <Package Folder>/p.dk926/files/krcfg.txt
chmod 777 <Package Folder>/p.dk952/files/krcfg.txt
dcz <Package Folder>/com.init.env/app_abz/dc1 <Package Folder>/com.init.env/app_abz/dc2
id
logcat -d -v time
ls -l /system/bin/su
ps
sh
sh <Package Folder>/com.init.env/app_abz/dcz <Package Folder>/com.init.env/app_abz/dc1 <Package Folder>/com.init.env/app_abz/dc2
su
su -c id

Loads the following dynamic libraries:

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

Uses elevated priveleges.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.