Android.Xiny.1633

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.20

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) aserver####.m.ta####.com:80
TCP(HTTP/1.1) mo####.b####.com:80
TCP(HTTP/1.1) m.gzu####.com:80
TCP(HTTP/1.1) wc.find####.cc.####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) cm.pos.b####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) map####.y####.com.cn:80
TCP(HTTP/1.1) si####.jom####.com:80
TCP(HTTP/1.1) c####.jd.com:80
TCP(HTTP/1.1) i####.51.la:80
TCP(HTTP/1.1) js.u####.51.la:80
TCP(HTTP/1.1) m.zu####.org.cn:80
TCP(HTTP/1.1) s.un####.com:80
TCP(HTTP/1.1) wn.pos.b####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) s.c####.b####.com:80
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) mbd.n.sh####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) ss3.b####.com:443
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) ss0.b####.com:443
TCP(TLS/1.0) ss0.bdst####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) wap.n.sh####.com:443
TCP(TLS/1.0) si####.jom####.com:443
TCP(TLS/1.0) cambria####.cdn.bc####.####.com:443

DNS requests:

a####.u####.com
c####.b####.com
c####.b####.com
c####.baidust####.com
c####.baidust####.com
c####.jd.com
cambria####.cdn.bc####.com
cm.miao####.atm.####.com
cm.pos.b####.com
dup.baidust####.com
ec####.b####.com
ext.b####.com
f10.b####.com
f11.b####.com
f12.b####.com
g####.bdst####.com
hm.b####.com
i####.51.la
js.u####.51.la
m.b####.com
m.gzu####.com
m.zu####.org.cn
map####.y####.com.cn
mo####.b####.com
mobads-####.b####.com
pos.b####.com
s.bdst####.com
s.c####.b####.com
s.un####.com
sp0.b####.com
sp1.b####.com
ss0.b####.com
ss0.bdst####.com
ss1.b####.com
ss2.b####.com
ss3.b####.com
t10.b####.com
t11.b####.com
t12.b####.com
wc.find####.cc
wn.pos.b####.com
www.zu####.org.cn

HTTP GET requests:

aserver####.m.ta####.com/cm.gif?dspid=####
c####.baidust####.com/cpro/ui/cm.js
c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
c####.baidust####.com/sync.htm?cproid=####
c####.jd.com/du?&baidu_user_id=####&cookie_version=####&timestamp=####&e...
cm.pos.b####.com/pixel?dspid=####
cm.pos.b####.com/youku?mzid=####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.js?0653032####
i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
js.u####.51.la/18738872.js
m.gzu####.com/
m.gzu####.com/ernianjizuowen/
m.gzu####.com/pic/151101/20180428/214-1P42Q40246234.jpg
m.gzu####.com/sitemap.html
m.gzu####.com/www/css/app.css
m.gzu####.com/www/css/art.css
m.gzu####.com/www/imgs/z-ico1.png
m.gzu####.com/www/js/jquery.min.js
m.gzu####.com/www/js/mad.js
m.gzu####.com/xiaoxuezuowen/
m.gzu####.com/yinianjishuqing/
m.gzu####.com/yinianjixushi/201801/1517205014146066.html
m.gzu####.com/yinianjizhuangwu/
m.gzu####.com/yinianjizhuangwu/201608/1470471373111680.html
m.zu####.org.cn/sitemap.html
m.zu####.org.cn/sitemaps.html
m.zu####.org.cn/www/css/common.css
m.zu####.org.cn/www/css/list.css
m.zu####.org.cn/www/imgs/z-ico5.png
m.zu####.org.cn/www/js/jquery.min.js
m.zu####.org.cn/www/js/jquery.min1.js
m.zu####.org.cn/yinianjithyy/
map####.y####.com.cn/s/mapping/?baidu_error=####&timestamp=####
mo####.b####.com/ads/ads.appcache
mo####.b####.com/ads/css/min/main.css
mo####.b####.com/ads/index.htm
mo####.b####.com/ads/js/ads.trunk.js
mo####.b####.com/ads/js/c.js
mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7043.jar
mo####.b####.com/cpro/ui/mads.php?code2=####&b1525672789473=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1525672819765=####
pos.b####.com/dcrm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/iccm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/scpm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/scpm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/sync_pos.htm?cproid=####
pos.b####.com/sync_pos.htm?cproid=####&t=####
pos.b####.com/xcrm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/yczm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/yczm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/zcjm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
s.c####.b####.com/s.htm?cproid=####&t=####
si####.jom####.com/it/u=1067202985,1445559114&fm=76
si####.jom####.com/it/u=107753503,181275158&fm=76
si####.jom####.com/it/u=1290228074,436258670&fm=76
si####.jom####.com/it/u=1344957095,12611258&fm=76
si####.jom####.com/it/u=1361276640,1907636526&fm=76
si####.jom####.com/it/u=145486076,4125360639&fm=76
si####.jom####.com/it/u=1532369419,1032918301&fm=76
si####.jom####.com/it/u=1599686278,495131910&fm=76
si####.jom####.com/it/u=1731106803,2507023088&fm=76
si####.jom####.com/it/u=1787728580,2258219358&fm=76
si####.jom####.com/it/u=1789519269,1052323278&fm=76
si####.jom####.com/it/u=1838919676,1017938361&fm=76
si####.jom####.com/it/u=1862046031,2698700929&fm=76
si####.jom####.com/it/u=2041446303,2986590210&fm=76
si####.jom####.com/it/u=206559122,3092245477&fm=76
si####.jom####.com/it/u=2943070796,2749569130&fm=76
si####.jom####.com/it/u=3020441218,3980127665&fm=76
si####.jom####.com/it/u=311296304,1900733025&fm=76
si####.jom####.com/it/u=3118428872,3071454351&fm=76
si####.jom####.com/it/u=3405998294,3484193259&fm=76
si####.jom####.com/it/u=364370451,4232451809&fm=76
si####.jom####.com/it/u=3666905670,3636195512&fm=76
si####.jom####.com/it/u=3698601844,1066823458&fm=76
si####.jom####.com/it/u=385132995,669498755&fm=76
si####.jom####.com/it/u=4034067330,3971343317&fm=76
si####.jom####.com/it/u=4154401951,4215729478&fm=76
si####.jom####.com/it/u=416178739,3115995123&fm=76
si####.jom####.com/it/u=449848416,4104026111&fm=76
si####.jom####.com/it/u=480230388,1875070067&fm=76
si####.jom####.com/it/u=509827831,3061346639&fm=76
si####.jom####.com/it/u=598775401,1445984355&fm=76
si####.jom####.com/it/u=638085556,2285136908&fm=76
si####.jom####.com/it/u=684957616,3910403245&fm=76
si####.jom####.com/it/u=803506627,1088895114&fm=76
si####.jom####.com/it/u=83344015,3936628562&fm=76
si####.jom####.com/it/u=929873207,4223707204&fm=76
si####.jom####.com/it/u=933289105,65835159&fm=76
si####.jom####.com/it/u=981281673,1150612314&fm=76
wc.find####.cc.####.com/2011/rio.jar
wn.pos.b####.com/adx.php?c=####

HTTP POST requests:

a####.u####.com/app_logs
s.un####.com/cw/cp.action?requestId=####&g=####
s.un####.com/cw/interface!u2.action?protocol=####&version=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/ApplicationCache.db-journal
/data/data/####/CachedGeoposition.db
/data/data/####/CachedGeoposition.db-journal
/data/data/####/W_Key.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__ddd728bd-1bee-4d09-9b7...f2.jar
/data/data/####/__xadsdk_downloaded__version__.xml
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/downloadswc
/data/data/####/downloadswc-journal
/data/data/####/exchangeIdentity.json
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/http_m.zuowen.org.cn_0.localstorage-journal
/data/data/####/http_mobads.baidu.com_0.localstorage-journal
/data/data/####/https_m.baidu.com_0.localstorage-journal
/data/data/####/index
/data/data/####/st.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/3.6_rio.jar.tmp
/data/media/####/assetstime.dat

Miscellaneous:

Loads the following dynamic libraries:

Uses the following algorithms to decrypt data:

RSA-ECB-PKCS1Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial