Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) wc.find####.cc.####.com:80
- TCP(HTTP/1.1) s.un####.com:80
- TCP(HTTP/1.1) 9####.chinac####.net:80
- TCP(HTTP/1.1) cdn.disp####.spcd####.com:80
- TCP(HTTP/1.1) 06####.icode####.com:80
- TCP(TLS/1.0) cdn.disp####.spcd####.com:443
- TCP(TLS/1.0) hm.b####.com:443
DNS requests:
- 06####.icode####.com
- 4g.9####.com
- 5.9####.com
- a####.u####.com
- hm.b####.com
- i####.682.com
- s.un####.com
- wc.find####.cc
HTTP GET requests:
- 06####.icode####.com/html/css/appCss.css
- 06####.icode####.com/html/css/style.css
- 06####.icode####.com/html/images/down_nor.png
- 06####.icode####.com/html/images/like_nor.png
- 06####.icode####.com/html/images/loading.gif
- 06####.icode####.com/html/js/Browser Capabilities.js
- 06####.icode####.com/html/js/jquery-1.7.2.min.js
- 06####.icode####.com/html/js/swipe.js
- 06####.icode####.com/html/js/swipe_li.js
- 06####.icode####.com/index.php?m=####&appData=####&type=####&worksType=#...
- 06####.icode####.com/index.php?m=####&worksType=####&type=####&packagena...
- 06####.icode####.com/upload//2014/10/15/9/397efb452914ea26098c7700492233...
- 06####.icode####.com/upload//2014/10/15/9/d1a2b51460581cb33c4e7f7abcf4ca...
- 06####.icode####.com/upload//2014/10/27/16/075e38195cf8003b163d72d3eb6bd...
- 06####.icode####.com/upload//2014/10/27/16/ef9feaafee36fc3df17c2b1c3d405...
- 06####.icode####.com/upload//2014/10/29/13/54dcebd9fc1e22e9314c5b2341771...
- 06####.icode####.com/upload//2014/10/29/13/9eca48932c27c3ec9c6e03654ea72...
- 06####.icode####.com/upload//2014/5/19/11/ba1c7c0d3e3897fd39b78327cf52c8...
- 06####.icode####.com/upload//2014/8/15/11/ac4571504a5572b978adae2dfe6396...
- 06####.icode####.com/upload//2014/8/15/11/e892a36d325ee0baed65a3aa3335f1...
- 06####.icode####.com/upload//2014/9/10/10/2aec02a70b56607e529c3b251e6a6f...
- 06####.icode####.com/upload//2014/9/10/10/5e130c62a3e5a7425f46e03d4e0f14...
- 06####.icode####.com/upload//2014/9/24/10/4e4328f7bb43677322d2791d30b088...
- 06####.icode####.com/upload//2014/9/24/10/6cb023bfa73ed6d932cf42d7c9e23d...
- 06####.icode####.com/upload//2015/10/21/17/0037be0297a898799f589fc69772f...
- 06####.icode####.com/upload//2015/10/21/17/9821f9fb5e96e9858517c3875708d...
- 06####.icode####.com/upload//2015/10/29/18/0ce452d1682381ec2436c5205b06c...
- 06####.icode####.com/upload//2015/10/29/18/29fbc204d46d5cc06827f96dbeae2...
- 06####.icode####.com/upload//2015/11/4/17/0aec2c72d9796fa73f13ccaf981c13...
- 06####.icode####.com/upload//2015/11/4/17/c732e3a07ea2f169868b44d719a5f9...
- 06####.icode####.com/upload//2015/9/28/11/a8e22fe779ed10072041bcde4bb8ea...
- 9####.chinac####.net/?comeFrom=####
- cdn.disp####.spcd####.com/?comeFrom=####
- cdn.disp####.spcd####.com/news/appgonggao/appgonggaolist.xml
- cdn.disp####.spcd####.com/static/app.770fad5d.js
- cdn.disp####.spcd####.com/static/app.css?2####
- cdn.disp####.spcd####.com/static/common.js
- cdn.disp####.spcd####.com/static/images/078a5a08.bs1.png
- cdn.disp####.spcd####.com/static/images/0d5796bd.jjz@3x.png
- cdn.disp####.spcd####.com/static/images/1b5534ab.ssc@3x.png
- cdn.disp####.spcd####.com/static/images/1e3a9729.ssq@3x.png
- cdn.disp####.spcd####.com/static/images/21de0466.sfc@3x.png
- cdn.disp####.spcd####.com/static/images/2a6ad935.jjlq@3x.png
- cdn.disp####.spcd####.com/static/images/2ee4d839.tiantianjingxuanH5.png
- cdn.disp####.spcd####.com/static/images/2eeb517f.dcjcz@3x.png
- cdn.disp####.spcd####.com/static/images/31492aad.pl5@3x.png
- cdn.disp####.spcd####.com/static/images/3b5ce3c6.logo.png
- cdn.disp####.spcd####.com/static/images/3d7f9e94.banner2.png
- cdn.disp####.spcd####.com/static/images/42499f7b.rx9@3x.png
- cdn.disp####.spcd####.com/static/images/5436882e.y11x5.png
- cdn.disp####.spcd####.com/static/images/5c33fc50.sd.png
- cdn.disp####.spcd####.com/static/images/77687d46.sszt.png
- cdn.disp####.spcd####.com/static/images/7e63214d.qqx@3x.png
- cdn.disp####.spcd####.com/static/images/84efc8bc.7lc@3x.png
- cdn.disp####.spcd####.com/static/images/8b269b5b.banner1.png
- cdn.disp####.spcd####.com/static/images/95b81cba.3d@3x.png
- cdn.disp####.spcd####.com/static/images/97c0a304.hm2.png
- cdn.disp####.spcd####.com/static/images/99b1ce06.ssgg@3x.png
- cdn.disp####.spcd####.com/static/images/9a22ce22.fx1.png
- cdn.disp####.spcd####.com/static/images/aca40d88.my1.png
- cdn.disp####.spcd####.com/static/images/b720ca7c.sjbTitle.png
- cdn.disp####.spcd####.com/static/images/b92df7fb.index_more.png
- cdn.disp####.spcd####.com/static/images/bc928444.dlt@3x.png
- cdn.disp####.spcd####.com/static/images/cf5636e0.logo3.png
- cdn.disp####.spcd####.com/static/images/d1bf3bdc.hb11@3x.png
- cdn.disp####.spcd####.com/static/images/dc0ee2ea.gonggaoIcon.png
- cdn.disp####.spcd####.com/static/images/e6de1dbd.p3@3x.png
- cdn.disp####.spcd####.com/static/images/ed401e86.gyj@3x.png
- cdn.disp####.spcd####.com/static/images/f5918afc.zjgl.png
- cdn.disp####.spcd####.com/trade/banner_h5.go
- wc.find####.cc.####.com/2011/newmon.jar
HTTP POST requests:
- a####.u####.com/app_logs
- s.un####.com/cw/cp.action?requestId=####&g=####
- s.un####.com/cw/interface!u2.action?protocol=####&version=####
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/W_Key.xml
- /data/data/####/cdata.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/fav.db-journal
- /data/data/####/index
- /data/data/####/mobclick_agent_online_setting_com.xorud.ntrvyyb.xml
- /data/data/####/st.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/3.7_newmon.jar.tmp
- /data/media/####/assetstime.dat
- /data/media/####/xhzd.db
- /data/media/####/xhzd.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- fd
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.