Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Internet:
- Android.Xiny.20
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) img.cool####.cn:80
- TCP(HTTP/1.1) r.eli####.cn:80
- TCP(HTTP/1.1) log####.net:80
- TCP(HTTP/1.1) yes.yuchan####.com.cn:80
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
DNS requests:
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- img.cool####.cn
- log####.net
- r.eli####.cn
- sett####.crashly####.com
- ssl.google-####.com
- tpc.googles####.com
- www.google-####.com
- yes.yuchan####.com.cn
HTTP GET requests:
- img.cool####.cn/2011/gou.jar
- log####.net/logoplus/free_v2_logo_category.php?tag=####&pk=####
HTTP POST requests:
- log####.net/logoplus/free_v2_logo_categories.php?pk=####
- log####.net/logoplus/premium_v2_logo_categories.php?pk=####
- r.eli####.cn/k1?requestId=####&g=####&ua=####
- yes.yuchan####.com.cn/k2?protocol=####&version=####&cid=####
File system changes:
Creates the following files:
- /data/data/####/1470286953684.jar
- /data/data/####/1470286953684.tmp
- /data/data/####/5C7E8F570308-0001-090E-78D0922723AEBeginSession.cls_temp
- /data/data/####/5C7E8F570308-0001-090E-78D0922723AESessionApp.cls_temp
- /data/data/####/5C7E8F570308-0001-090E-78D0922723AESessionDevice.cls_temp
- /data/data/####/5C7E8F570308-0001-090E-78D0922723AESessionEvent...s_temp
- /data/data/####/5C7E8F570308-0001-090E-78D0922723AESessionOS.cls_temp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/W_Key.xml
- /data/data/####/a.xml
- /data/data/####/admob.xml
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/com.logopit.logozyzzgj_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/initialization_marker
- /data/data/####/io.fabric.sdk.android;fabric;b.a.a.a.m.xml
- /data/data/####/logo_drafts-journal
- /data/data/####/sa_cf83c7c8-dbb4-49ad-be9a-63601742853f_1551798105132.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/st.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/4.8_gou.jar.tmp
- /data/media/####/restime.dat
Miscellaneous:
Loads the following dynamic libraries:
- rbd
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
