Android.Xiny.470

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.110.origin
Android.RemoteCode.93.origin
Android.Xiny.1.origin
Android.Xiny.197
Android.Xiny.232.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) d.billyaf####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) dts.startap####.com.####.net:80
TCP(HTTP/1.1) clinkad####.com:80
TCP(HTTP/1.1) clk.ar####.co:80
TCP(HTTP/1.1) star####.edges####.net:80
TCP(HTTP/1.1) trac####.suma####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:8088
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) k####.club:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) offer####.online:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) a####.bat####.net:80
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) akw.e####.space:80
TCP(HTTP/1.1) t####.z####.xyz:80
TCP(HTTP/1.1) va.or####.startap####.com:80
TCP(HTTP/1.1) www.jp####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) c####.gowa####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) cpgnrot####.com:80
TCP(HTTP/1.1) st####.startap####.edges####.net:80
UDP(NTP) p####.ntp.org:123
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) ma####.bootstr####.com:443
TCP(TLS/1.0) dsa.startap####.edg####.net:443
TCP(TLS/1.0) 2####.58.212.206:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) g####.gl:443
TCP(TLS/1.0) www.addro####.com:443
TCP(TLS/1.0) s3.us-ea####.amazo####.com:443
TCP(TLS/1.0) ws.tapjo####.com:443
TCP(TLS/1.0) smarto####.site:443
TCP(TLS/1.0) con####.ta####.com:443
TCP(TLS/1.0) placem####.ta####.com:443
TCP(TLS/1.0) rpc.ta####.com:443
TCP(TLS/1.0) billmsc####.com:443

DNS requests:

a####.bat####.net
akw.e####.space
ali.f####.cdn.####.com
api.migh####.com
api.mob####.b####.com
aws.smarter####.net
billmsc####.com
c####.gowa####.com
cl####.ads####.com
clinkad####.com
clk.ar####.co
con####.ta####.com
con####.ta####.com
cpgnrot####.com
d.billyaf####.com
dts.startap####.com
ea.sno####.1####.com
en.sno####.1####.com
g####.gl
googl####.g.doublec####.net
i####.st####.startap####.com
i####.startap####.com
im####.startap####.com
imp.startap####.com
k####.club
ma####.bootstr####.com
mo.freeind####.com
offer####.online
p####.lead####.com
p####.ntp.org
placem####.ta####.com
req.startap####.com
rpc.ta####.com
s####.mob####.b####.com
s3.us-ea####.amazo####.com
smarto####.site
t####.hxc####.com
t####.z####.xyz
trac####.suma####.com
va.or####.startap####.com
ws.tapjo####.com
www.addro####.com
www.admobim####.com
www.cu####.com
www.jp####.com
www.mmmmmm####.com
www.startap####.com
www.trac####.site
www.zfr####.com

HTTP GET requests:

a####.bat####.net/call/v2/ad/click?recommend_id=####&ads_id=####&aff_id=...
akw.e####.space/index.php?r=####
akw.e####.space/index.php?r=####&al=####&l=####&p=####&hp=####&lc=####&s...
akw.e####.space/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pr...
ali.f####.cdn.####.com/20171229183033-snowfox_v19i154b.jar
aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
c####.gowa####.com/click?transaction_id=wadogo_WAdvPubNativeNewAPI_30359...
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
clinkad####.com/tracking?camp=####&pubid=####&sid1=####&gaid=####&idfa=#...
clk.ar####.co/aff_c?offer_id=####&aff_id=####&aff_sub=####&sub_channel=#...
clk.ar####.co/click?campid=####&gid=####&imei=####&android=####&sub_chan...
cpgnrot####.com/campaign/8741|656?tag=####&token1=####&_uu=####
d.billyaf####.com/d/11685513e11bcfa62?sub=####&sub2=####
d.billyaf####.com/d/11685513e11bcfa62?sub=####&sub2=####&code=####
d.billyaf####.com/gw?url=https://billmscurlrev.com/c/0e3d3438-e3bf-11e6-...
dts.startap####.com.####.net/image/fetch/f_auto,q_80,w_48,h_48/http://lh...
dts.startap####.com.####.net/static/images/banner_rt_2d_rays_base/downlo...
dts.startap####.com.####.net/static/images/close-btn-infra.png
dts.startap####.com.####.net/static/images/fullscreen_xmas2017/elements/...
dts.startap####.com.####.net/static/images/fullscreen_xmas2017/top_decor...
dts.startap####.com.####.net/static/images/star_full_big.png
dts.startap####.com.####.net/static/images/star_half_big.png
dts.startap####.com.####.net/styles/compressed/banner_rt_2d_rays_infra.2...
dts.startap####.com.####.net/styles/compressed/fullscreen_xmas2017_eleme...
dts.startap####.com.####.net/styles/compressed/fullscreen_xmas2017_topde...
k####.club/www/delivery/clk.php?zoneid=####&pub_siteid=####&pub_clickid=...
offer####.online/r/2671851e-ed3e-11e7-99e4-11431cad6be3/0/
offer####.online/r/2671851e-ed3e-11e7-99e4-11431cad6be3/1/
offer####.online/r/274a51e6-ed3e-11e7-91cf-114335ad3a3e/0/
offer####.online/r/274a51e6-ed3e-11e7-91cf-114335ad3a3e/1/
offer####.online/r/27b35d08-ed3e-11e7-b8cd-114381406f23/0/
offer####.online/r/27b35d08-ed3e-11e7-b8cd-114381406f23/1/
st####.startap####.edges####.net/InApp/resources/back_.png
st####.startap####.edges####.net/InApp/resources/back_dark.png
st####.startap####.edges####.net/InApp/resources/browser_icon_dark.png
st####.startap####.edges####.net/InApp/resources/close_button.png
st####.startap####.edges####.net/InApp/resources/empty_star.png
st####.startap####.edges####.net/InApp/resources/filled_star.png
st####.startap####.edges####.net/InApp/resources/forward_.png
st####.startap####.edges####.net/InApp/resources/forward_dark.png
st####.startap####.edges####.net/InApp/resources/half_star.png
st####.startap####.edges####.net/InApp/resources/info_ex_l.png
st####.startap####.edges####.net/InApp/resources/info_ex_s.png
st####.startap####.edges####.net/InApp/resources/info_l.png
st####.startap####.edges####.net/InApp/resources/info_s.png
st####.startap####.edges####.net/InApp/resources/logo.png
st####.startap####.edges####.net/InApp/resources/x_dark.png
star####.edges####.net/1.4/trackdownload?publisherId=####&productId=####...
t####.z####.xyz/click?campid=####&gid=####&imei=####&android=####&sub_ch...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_s...
trac####.suma####.com/aff_r?offer_id=328149&aff_id=3599&url=http://click...
va.or####.startap####.com/1.4/gethtmlad?publisherId=####&productId=####&...
va.or####.startap####.com/favicon.ico
va.or####.startap####.com/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFXVlcWFN...
va.or####.startap####.com/tracking/adImpression?d=####&clientSessionId=#...
va.or####.startap####.com/tracking/adImpression?d=####&position=####&cli...
va.or####.startap####.com/tracking/adImpression?d=IAAAA####&clientSessio...
www.cu####.com/20171212103437.201712121030.zip
www.jp####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=####&...
www.jp####.com/error.html

HTTP POST requests:

ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/checklib
ea.sno####.1####.com:18088/sdk/api/regclient
ea.sno####.1####.com:8088/sdk/api/ad/hull_v2
ea.sno####.1####.com:8088/sdk/api/log/record
mo.freeind####.com/detail/getOfferListNew?enc=####
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
www.admobim####.com/surl/api2_reg.action?ecy=####
www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.zfr####.com/up.do?enc=####

Modified file system:

Creates the following files:

<Package Folder>/app_Parse/installationId
<Package Folder>/app_fiverocks/events2-journal
<Package Folder>/app_fiverocks/install
<Package Folder>/app_lib/libsouwe.so
<Package Folder>/app_sslcache/www.addroider.com.443
<Package Folder>/cache/####/0d3f5251b435303c9cc062823d380925_Pa...5.json
<Package Folder>/cache/####/applicationId
<Package Folder>/cache/####/c2982a35b2a03e1eae73834a60fe24c8_gp...r.html
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/index
<Package Folder>/cache/1478228129219.jar
<Package Folder>/cache/1478228129219.tmp
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/databases/ParseOfflineStore
<Package Folder>/databases/ParseOfflineStore-journal
<Package Folder>/databases/adblib.db
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/-61621199
<Package Folder>/files/####/-61621199.data
<Package Folder>/files/####/_1410597251
<Package Folder>/files/StartappAdInfoMetadata
<Package Folder>/files/StartappBannerMetadata
<Package Folder>/files/StartappCacheMetadata
<Package Folder>/files/StartappMetadata
<Package Folder>/files/StartappSplashMetadata
<Package Folder>/files/back_.png
<Package Folder>/files/back_dark.png
<Package Folder>/files/browser_icon_dark.png
<Package Folder>/files/close_button.png
<Package Folder>/files/d.dex
<Package Folder>/files/d.dex (deleted)
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/empty_star.png
<Package Folder>/files/f.dex
<Package Folder>/files/f.zip
<Package Folder>/files/filled_star.png
<Package Folder>/files/forward_.png
<Package Folder>/files/forward_dark.png
<Package Folder>/files/google.db
<Package Folder>/files/half_star.png
<Package Folder>/files/lib.dat
<Package Folder>/files/logo.png
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/ob.dex
<Package Folder>/files/ob.zip
<Package Folder>/files/shared_prefs_sdk_ad_prefs
<Package Folder>/files/snowfox_v19i.jar
<Package Folder>/files/x_dark.png
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/D824hunter_config.xml
<Package Folder>/shared_prefs/D824other_config.xml
<Package Folder>/shared_prefs/D824service_config.xml
<Package Folder>/shared_prefs/D824service_config.xml.bak
<Package Folder>/shared_prefs/D824sp_config.xml
<Package Folder>/shared_prefs/D824upgrade_config.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/admob.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.Cook...le.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/fiverocks.xml
<Package Folder>/shared_prefs/isupdate.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/s_sdk_pro_pref.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/startapp_prefs_file.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/tjcPrefrences.xml
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/dev_f53bc04.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/pid
<SD-Card>/Android/####/ua.dat
<SD-Card>/IndianMoneyPhotoFrame/####/.nomedia
<SD-Card>/LogN/####/sp
<SD-Card>/baidu/####/journal
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.lhi.uxr.Ic
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 777 <Package Folder>/bsouwe
dd if=<Package Folder>/lib/libsouwe.so of=<Package Folder>/bsouwe
sh

Loads the following dynamic libraries:

libsouwe

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial