Android.Xiny.643

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.3.origin
Android.Xiny.78.origin

Prompts to install third-party applications.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) oth.eve.mdt.####.com:8080
TCP(HTTP/1.1) api.is.yuanf####.com:80
TCP(HTTP/1.1) allre####.3g.qq.com:80
TCP(HTTP/1.1) cl####.adf####.com:9110
TCP(HTTP/1.1) oth.str.mdt.####.com:8080
TCP(HTTP/1.1) api.cp.16####.cn:80
TCP(HTTP/1.1) apk.d.ad.####.net:80
TCP(HTTP/1.1) mon####.uu.qq.com:80
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) www.q####.cn:80
TCP(TLS/1.0) m.i####.com:443

DNS requests:

a####.u####.com
allre####.3g.qq.com
api.cp.16####.cn
api.is.yuanf####.com
apk.d.ad.####.cn
cl####.adf####.com
m.i####.com
mon####.uu.qq.com
oth.eve.mdt.####.com
oth.str.mdt.####.com
www.q####.cn
www.qchann####.cn

HTTP GET requests:

api.is.yuanf####.com/is/init.jsp?appid=####
apk.d.ad.####.net/ad/20170705/201707051157602.png
apk.d.ad.####.net/ad/20171207/20171207111067.png
apk.d.ad.####.net/ad/20171207/201712071116111.png
apk.d.ad.####.net/ad/20171207/201712071130342.png
apk.d.ad.####.net/ad/20171229/201712291049180.apk
apk.d.ad.####.net/ad/20180102/201801021309162.apk
www.q####.cn/n/dpz/?app=####&uid=####&sv=####&appver=####&osver=####&cve...

HTTP POST requests:

a####.u####.com/app_logs
allre####.3g.qq.com/handleall
api.cp.16####.cn/app/down.jsp
api.cp.16####.cn/app/install.jsp
api.cp.16####.cn/is/click.jsp
api.cp.16####.cn/is/info.jsp
api.cp.16####.cn/is/init.jsp
api.cp.16####.cn/is/list.jsp
api.cp.16####.cn/is/show.jsp
api.is.yuanf####.com/is/info.jsp
api.is.yuanf####.com/is/init.jsp
cl####.adf####.com:9110/terminal/ad/getAdList.do?t=####
mon####.uu.qq.com/analytics/rqdsync
oth.eve.mdt.####.com:8080/analytics/upload?rid=####&sid=####
oth.str.mdt.####.com:8080/analytics/upload
oth.str.mdt.####.com:8080/analytics/upload?sid=####
www.qchann####.cn/center/adj?ak=####&uid=####&offline=####
www.qchann####.cn/center/adj?appkey=####&uid=####&sdk=####&did=####&type...

Modified file system:

Creates the following files:

/data/data/####/BIZ_CONFIG.xml
/data/data/####/Beacon_sig_1.lock
/data/data/####/DENGTA_META.xml
/data/data/####/HMTAGENT_INFO.xml
/data/data/####/QT.xml
/data/data/####/READ_CONFIG.xml
/data/data/####/REPORT.xml
/data/data/####/SETTING.xml
/data/data/####/SYS_CONFIG.xml
/data/data/####/arch.xml
/data/data/####/beacon_db-journal
/data/data/####/com.qq.reader-1.apk.classes1040973297.zip
/data/data/####/config
/data/data/####/config.gz
/data/data/####/config.xml
/data/data/####/default.db
/data/data/####/default.db-journal
/data/data/####/eup_db
/data/data/####/eup_db-journal
/data/data/####/hmt_agent_commonutill_com.qq.reader.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting.xml
/data/data/####/hmt_analytics
/data/data/####/hmt_analytics-journal
/data/data/####/hmt_init_savetime.xml
/data/data/####/hmt_irsuid.xml
/data/data/####/hmt_session_id_savetime.xml
/data/data/####/multidex.version.xml
/data/data/####/online.db
/data/data/####/online.db-journal
/data/data/####/openudid_prefs.xml
/data/data/####/qtsession.xml
/data/data/####/remarks.db
/data/data/####/remarks.db-journal
/data/data/####/theme.xml
/data/data/####/webversion.xml
<Package Folder>/app_feiwo_simg.jar/####/MANIFEST.MF
<Package Folder>/app_feiwo_simg.jar/back.png
<Package Folder>/app_feiwo_simg.jar/by_mark.png
<Package Folder>/app_feiwo_simg.jar/by_right_arrow.png
<Package Folder>/app_feiwo_simg.jar/by_rloding_1.png
<Package Folder>/app_feiwo_simg.jar/by_rloding_2.png
<Package Folder>/app_feiwo_simg.jar/by_rloding_3.png
<Package Folder>/app_feiwo_simg.jar/by_rloding_4.png
<Package Folder>/app_feiwo_simg.jar/by_safety_certification.png
<Package Folder>/app_feiwo_simg.jar/by_surprise.png
<Package Folder>/app_feiwo_simg.jar/dm_cover_close.png
<Package Folder>/app_feiwo_simg.jar/icom_bg.png
<Package Folder>/databases/amb_dl.db
<Package Folder>/databases/amb_dl.db-journal
<Package Folder>/databases/feiwo_bai-db-journal
<Package Folder>/files/####/oyouxidao.jar
<Package Folder>/files/afc.pro
<Package Folder>/files/pyouxidaoco.jar
<Package Folder>/files/ycom
<Package Folder>/shared_prefs/5qkMaKdY98lXUGeW0cHslQ==.xml
<Package Folder>/shared_prefs/Ijd5F3DN0kqRu3gUcVNi3myfItrDtmY0.xml
<Package Folder>/shared_prefs/bayiSharedPrferences.xml
<Package Folder>/shared_prefs/feiwo_checkerConfig.xml
<Package Folder>/shared_prefs/khshares.xml
<Package Folder>/shared_prefs/listfs.xml
<Package Folder>/shared_prefs/mappcfg.xml
<Package Folder>/shared_prefs/mappcfg.xml.bak
<Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
<Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
<Package Folder>/shared_prefs/tinapp.xml
<Package Folder>/shared_prefs/totalcount.xml
<Package Folder>/shared_prefs/youturn.xml
<SD-Card>/.Android/071cb814429c539831f71709c70ff621
<SD-Card>/.qmt/####/app
<SD-Card>/Android/####/-1068739203.0
<SD-Card>/Android/####/-1095004204.0
<SD-Card>/Android/####/-1158882563.0
<SD-Card>/Android/####/-1196477945.0
<SD-Card>/Android/####/-1277835294.0
<SD-Card>/Android/####/-1325560664.0
<SD-Card>/Android/####/-1681810218.0
<SD-Card>/Android/####/-1705499485.0
<SD-Card>/Android/####/-1967192738.0
<SD-Card>/Android/####/-2039091584.0
<SD-Card>/Android/####/-2066664503.0
<SD-Card>/Android/####/-2139159264.0
<SD-Card>/Android/####/-279988536.0
<SD-Card>/Android/####/-285661441.0
<SD-Card>/Android/####/-285661442.0
<SD-Card>/Android/####/-285661443.0
<SD-Card>/Android/####/-285661444.0
<SD-Card>/Android/####/-285661445.0
<SD-Card>/Android/####/-355051955.0
<SD-Card>/Android/####/-418930314.0
<SD-Card>/Android/####/-61648948.0
<SD-Card>/Android/####/-712333321.0
<SD-Card>/Android/####/-801601197.0
<SD-Card>/Android/####/-820856655.0
<SD-Card>/Android/####/-872225698.0
<SD-Card>/Android/####/-938312507.0
<SD-Card>/Android/####/-941857969.0
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/1396589703.0
<SD-Card>/Android/####/201707051157602#png.tmp
<SD-Card>/Android/####/20171207111067#png
<SD-Card>/Android/####/20171207111067#png.tmp
<SD-Card>/Android/####/201712071116111#png
<SD-Card>/Android/####/201712071116111#png (deleted)
<SD-Card>/Android/####/201712071116111#png.tmp
<SD-Card>/Android/####/201712071130342#png.tmp
<SD-Card>/Android/####/434147411.0
<SD-Card>/Android/####/530369258.0
<SD-Card>/Android/####/964029037.0
<SD-Card>/Android/####/afc.pro
<SD-Card>/Android/####/egnaro_etceles_egap_d
<SD-Card>/Android/####/egnaro_gbntb_d
<SD-Card>/Android/####/ehcac_ntb_mottob
<SD-Card>/Android/####/elcric_cs_d
<SD-Card>/Android/####/enil_efas
<SD-Card>/Android/####/enil_efas_d
<SD-Card>/Android/####/enil_jt_d
<SD-Card>/Android/####/erahs_ntb_mottob
<SD-Card>/Android/####/eulb_gbntb_d
<SD-Card>/Android/####/gb_datuctrohs_d
<SD-Card>/Android/####/gb_gmi
<SD-Card>/Android/####/gb_gmi_d
<SD-Card>/Android/####/gb_mottob
<SD-Card>/Android/####/gb_pot
<SD-Card>/Android/####/gb_pot_d
<SD-Card>/Android/####/gb_sdrowda
<SD-Card>/Android/####/gb_tluafed_d
<SD-Card>/Android/####/journal.rl
<SD-Card>/Android/####/journal.tmp
<SD-Card>/Android/####/kcab_pop
<SD-Card>/Android/####/kcab_pop_d
<SD-Card>/Android/####/lecnac_ntb_mottob_d
<SD-Card>/Android/####/llatsni_ntb
<SD-Card>/Android/####/llatsni_ntb_d
<SD-Card>/Android/####/llatsni_ntb_mottob
<SD-Card>/Android/####/lomron_egap_d
<SD-Card>/Android/####/na_csppa_d
<SD-Card>/Android/####/neerg_gbntb_d
<SD-Card>/Android/####/noci_efas
<SD-Card>/Android/####/noci_efas_d
<SD-Card>/Android/####/ntb_erom_pc_d
<SD-Card>/Android/####/ntb_meti
<SD-Card>/Android/####/ntb_mottob_pop
<SD-Card>/Android/####/ntb_mottob_pop_d
<SD-Card>/Android/####/ntb_rehto_pc_d
<SD-Card>/Android/####/ntbesolc_pot_x
<SD-Card>/Android/####/ntbesolc_potd_d
<SD-Card>/Android/####/nwod_worra
<SD-Card>/Android/####/nwod_worra_d
<SD-Card>/Android/####/pot_ntbseolc_d
<SD-Card>/Android/####/pu_worra
<SD-Card>/Android/####/pu_worra_d
<SD-Card>/Android/####/rats_m
<SD-Card>/Android/####/tnetnocppa
<SD-Card>/Android/####/wolley_gbntb_d
<SD-Card>/Android/fc7c16608a164f476b25d843a3425dca
<SD-Card>/Download/####/201712291049180.apk.tmp
<SD-Card>/Download/####/201801021309162.apk.tmp
<SD-Card>/MQ/uuid
<SD-Card>/QQReader/####/11_3_c.png
<SD-Card>/QQReader/####/12_4_c.png
<SD-Card>/QQReader/####/14_5_c.png
<SD-Card>/QQReader/####/1_1_c.png
<SD-Card>/QQReader/####/1_c.png
<SD-Card>/QQReader/####/25_6_c.png
<SD-Card>/QQReader/####/29_7_c.png
<SD-Card>/QQReader/####/2_c.png
<SD-Card>/QQReader/####/3_c.png
<SD-Card>/QQReader/####/4_c.png
<SD-Card>/QQReader/####/5_c.png
<SD-Card>/QQReader/####/6_c.png
<SD-Card>/QQReader/####/7_c.png
<SD-Card>/QQReader/####/skinlist.db
<SD-Card>/QQReader/####/skinlist.db-journal
<SD-Card>/QQReader/.nomedia
<SD-Card>/QQReader/account.db
<SD-Card>/QQReader/adv.db
<SD-Card>/QQReader/adv.db-journal
<SD-Card>/QQReader/plugin.db
<SD-Card>/QQReader/record.db
<SD-Card>/QQReader/tid.db
<SD-Card>/QQReader/webcolumn.db
<SD-Card>/at/uuid
<SD-Card>/bayimob/sec.iso
<SD-Card>/ddad/####/<Package>.txt
<SD-Card>/qmt/4a<SMS Address>ad0f92efb63f829cc538e68cf68
<SD-Card>/qt/####/qt.csv.1510833554699.txt
<SD-Card>/setup/93792b7b39426006fd974d2219ff521f
<SD-Card>/sitemp/uuid
<SD-Card>/tencent/####/meta.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
cat /proc/cpuinfo
cat /proc/version
chmod 777 /storage/emulated/0/download/nfile//201712291049180.apk.tmp
chmod 777 /storage/emulated/0/download/nfile//201801021309162.apk.tmp
getprop androVM.vbox_dpi
getprop androVM.vbox_graph_mode
getprop init.svc.droid4x
getprop init.svc.microvirtd
getprop init.svc.noxd
getprop init.svc.qemud
getprop init.svc.su_kpbs_daemon
getprop init.svc.ttVM_x86-setup
getprop init.svc.vbox86-setup
getprop init.svc.xxkmsg
getprop ro.kernel.android.qemud
getprop ro.product.manufacturer

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial