Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.16.origin
- Android.Mixi.13.origin
Network activity:
Connecting to:
- g####.####.com
- 2####.####.1
- d####.####.cn
- o####.####.com
- h####.####.cn
- d####.####.com
- tb####.####.cn
- t####.####.cn
- a####.####.com
HTTP GET requests:
- tb####.####.cn/img/view/id/69454139/sz/src
- tb####.####.cn/img/view/id/80555713/sz/480x120
- tb####.####.cn/topic/cover/id/355064/sz/280
- tb####.####.cn/img/view/id/69454139/sz/228
- tb####.####.cn/topic/cover/id/100441/sz/280
- tb####.####.cn/topic/cover/id/100440/sz/280
- tb####.####.cn/img/view/id/63238829/sz/480x120
- tb####.####.cn/account/avatar/id/5734922
- tb####.####.cn/img/view/id/69431469/sz/228
- tb####.####.cn/img/view/id/65908149/sz/228
- tb####.####.cn/account/avatar/id/66423353
- tb####.####.cn/img/view/id/69426889/sz/480x120
- tb####.####.cn/account/avatar/id/24505026
- tb####.####.cn/img/view/id/65900044/sz/480x120
- tb####.####.cn/img/view/id/69457521/sz/228
- tb####.####.cn/img/view/id/80394781
- tb####.####.cn/account/avatar/id/43636500
- tb####.####.cn/img/view/id/69347640/sz/228
- tb####.####.cn/topic/cover/id/100105/sz/280
- tb####.####.cn/account/avatar/id/53694011
- h####.####.cn/launchconfig?t=####&p=NmY5d####
- tb####.####.cn/img/view/id/80555934/sz/480x120
- tb####.####.cn/account/avatar/id/62003710
- tb####.####.cn/img/view/id/67111634/sz/480x120
- tb####.####.cn/img/view/id/80087840
- tb####.####.cn/account/avatar/id/61744042
- tb####.####.cn/download/splash/3442455a7be50a69a32de0fb77a3e180.jpg
- tb####.####.cn/account/avatar/id/80554734
- tb####.####.cn/account/avatar/id/63304754
- tb####.####.cn/topic/cover/id/100477/sz/280
- g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
- tb####.####.cn/account/avatar/id/55429487
- tb####.####.cn/account/avatar/id/44868174
- tb####.####.cn/img/view/id/69454130/sz/228
- tb####.####.cn/img/view/id/80340429/sz/228
- tb####.####.cn/topic/cover/id/80087705/sz/280
- tb####.####.cn/img/view/id/69309160/sz/480x120
- tb####.####.cn/img/view/id/69454149/sz/src
- tb####.####.cn/img/view/id/80353234/sz/480x120
- t####.####.cn/s/route/route
- tb####.####.cn/img/view/id/68131715/sz/480x120
- tb####.####.cn/img/view/id/69454130/sz/src
- 2####.####.1/184840/d?host=####
- tb####.####.cn/account/avatar/id/2156673
- tb####.####.cn/topic/cover/id/355044/sz/280
- tb####.####.cn/account/avatar/id/69310734
- tb####.####.cn/img/view/id/69457521/sz/src
- tb####.####.cn/img/view/id/69454149/sz/228
HTTP POST requests:
- g####.####.com/cr/sv/getEPList
- t####.####.cn/version/check?sign=####
- t####.####.cn/ad/meizu1116?sign=####
- d####.####.cn/index.php/clientrequest/clientcollect/isCollect
- t####.####.cn/topic/detail?sign=####
- d####.####.com/mmsdk/mmsdk?func=####&appkey=####&channel=####&code=####
- t####.####.cn/topic/attention?sign=####
- t####.####.cn/config/splash?sign=####
- t####.####.cn/topic/recommend_v3?sign=####
- t####.####.cn/assessor/check_permission?sign=####
- t####.####.cn/topic/posts?sign=####
- t####.####.cn/config/get?sign=####
- t####.####.cn/rank/review?sign=####
- a####.####.com/man/api?ak=####&s=####
- o####.####.com/check_config_update
- a####.####.com/app_logs
- t####.####.cn/index/recommend?sign=####
- t####.####.cn/stat/save_device_info?sign=####
- t####.####.cn/topic/cancel_attention?sign=####
- t####.####.cn/topic/banner?sign=####
- t####.####.cn/my/profile?sign=####
- t####.####.cn/account/register_guest?sign=####
- t####.####.cn/bind/bind_clientid?sign=####
- t####.####.cn/topic/categories?sign=####
- t####.####.cn/stat/action?sign=####
- t####.####.cn/stat/report_user_info?sign=####
- t####.####.cn/user/getblock?sign=####
Modified file system:
Creates the following files:
- <Package Folder>/files/data/video_post_recommend_list.dat
- <Package Folder>/shared_prefs/lxdMoblieAgent_sys_config.xml.bak
- <Package Folder>/PreExcuModsInfo.txt
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/ifly_launch_lib.xml
- <Package Folder>/cache/volley/67390690-2008132746
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/data/chatmsg/tbmsgcache/0/journal
- <Package Folder>/cache/volley/1835755482522118403
- <Package Folder>/files/data/TopicAttentionList.dat
- <Package Folder>/ReadyHost.txt
- <Package Folder>/shared_prefs/lxdMoblieAgent_upload_<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/hotfix.xml
- <Package Folder>/XmSmLockFile.txt
- <Package Folder>/files/data/topic_categories.0.tmp
- <Package Folder>/cache/volley/9441610221908277170
- <Package Folder>/shared_prefs/com.iflytek.id.xml
- <Package Folder>/shared_prefs/_andfix_.xml
- <Package Folder>/files/splash_v155.png
- <Package Folder>/shared_prefs/spref4067690.xml
- <Package Folder>/cache/volley/-220270033-1396383222
- <Package Folder>/files/data/chatmsg/tbmsgcache/4067690/journal
- <Package Folder>/files/data/index_imgtxt_post_list.dat
- <Package Folder>/cache/volley/-120918011647548254
- <Package Folder>/files/1495005852788_cgr.so
- <Package Folder>/shared_prefs/lxdMoblieAgent_event_<Package>.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/common_lib.xml
- <Package Folder>/shared_prefs/lxdMoblieAgent_config_<Package>.xml
- <Package Folder>/files/IZoicdmWV.jar
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/safe_patch.xml
- <Package Folder>/shared_prefs/lxdMoblieAgent_sys_config.xml
- <Package Folder>/files/data/sysmsg/journal
- <Package Folder>/files/data/sysmsg/systemmsgkey.0.tmp
- <Package Folder>/shared_prefs/lxdMoblieAgent_upload_<Package>.xml.bak
- <Package Folder>/files/data/post_recommend_list.dat
- <Package Folder>/files/data/chatmsg/tbmsgcache/4067690/msgready.0.tmp
- <Package Folder>/shared_prefs/lxdMoblieAgent_event_<Package>.xml
- <Package Folder>/shared_prefs/iflytek_state_<Package>.xml
- <Package Folder>/files/data/journal
- <Package Folder>/app_file_dex/MasterControl.jar
- <Package Folder>/cache/volley/874032377-1623573058
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/common.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/splash_config.xml
- <Package Folder>/shared_prefs/common.xml.bak
- <Package Folder>/cache/volley/890665728328828190
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ifly_launch_lib.xml.bak
- <Package Folder>/files/us.IZoicdmWVTB9121egA744Z2MjFi4w
- <Package Folder>/files/data/chatmsg/tbmsgcache/0/journal.tmp
- <Package Folder>/files/mobclick_agent_cached_<Package>32300
- <Package Folder>/files/evnlxd0
- <Package Folder>/shared_prefs/push.xml
- <Package Folder>/files/1495005858563.jar
- <Package Folder>/files/data/OnlineConfig.dat
- <Package Folder>/cache/volley/-220270033-422375229
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
Miscellaneous:
Executes next shell scripts:
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.IZoicdmWVTB9121egA744Z2MjFi4w > /dev/null 2>&1
- getenforce
- chmod 0771 /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/IZoicdmWV.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/IZoicdmWV.jar > /dev/null 2>&1
- chmod 0771 <Package Folder>/.syslib-
- /data/data/####/files/us.IZoicdmWVTB9121egA744Z2MjFi4w -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh <Package Folder>/files/us.IZoicdmWVTB9121egA744Z2MjFi4w -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- <dexopt>
Contains functionality to send SMS messages automatically.
