Android.Xiny.1648

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.65.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) f####.info:80
TCP pya.jy####.com:7701
TCP so3.yo####.com:7703
TCP pyc.jy####.com:7803
TCP pya.jy####.com:7801
TCP pya.jy####.com:7702
TCP pya.jy####.com:7802

DNS requests:

d####.flur####.com
f####.info
pya.jy####.com
pyb.jy####.com
pyc.jy####.com
ru.dn####.com
so1.yo####.com
so2.yo####.com
so3.yo####.com

HTTP GET requests:

f####.info/draw/app111/bg_h4d.png
f####.info/draw/app111/lesson01.zip
f####.info/draw/app111/lesson02.zip
f####.info/draw/app111/lesson03.zip
f####.info/draw/app111/lesson04.zip
f####.info/draw/app111/lesson05.zip
f####.info/draw/app111/lesson06.zip
f####.info/draw/app111/lesson07.zip
f####.info/draw/app111/lesson08.zip
f####.info/draw/app111/lesson09.zip
f####.info/draw/app111/lesson10.zip
f####.info/draw/app111/lesson11.zip
f####.info/draw/app111/lesson12.zip
f####.info/draw/app111/lesson13.zip
f####.info/draw/app111/lesson14.zip
f####.info/draw/app111/lesson15.zip
f####.info/draw/app111/lesson16.zip
f####.info/draw/app111/lesson17.zip
f####.info/draw/app111/lesson18.zip
f####.info/draw/app111/lesson19.zip
f####.info/draw/app111/lesson20.zip
f####.info/draw/app111/lesson21.zip
f####.info/draw/app111/lesson22.zip
f####.info/draw/app111/listdata.xml
f####.info/draw/app151/bg.png
f####.info/draw/app151/bg_h4d.png
f####.info/draw/app151/icon.png
f####.info/draw/app151/icon_h4d.png
f####.info/draw/app151/listdata.xml
f####.info/draw/app189/bg.png
f####.info/draw/app189/bg_h4d.png
f####.info/draw/app189/icon.png
f####.info/draw/app189/icon_h4d.png
f####.info/draw/app189/listdata.xml
f####.info/draw/app207/bg.png
f####.info/draw/app207/bg_h4d.png
f####.info/draw/app207/icon.png
f####.info/draw/app207/icon_h4d.png
f####.info/draw/app207/listdata.xml
f####.info/draw/app220/bg.png
f####.info/draw/app220/bg_h4d.png
f####.info/draw/app220/icon.png
f####.info/draw/app220/icon_h4d.png
f####.info/draw/app220/listdata.xml
f####.info/draw/app251/bg.png
f####.info/draw/app251/bg_h4d.png
f####.info/draw/app251/icon.png
f####.info/draw/app251/icon_h4d.png
f####.info/draw/app251/listdata.xml
f####.info/draw/app257/bg.png
f####.info/draw/app257/bg_h4d.png
f####.info/draw/app257/icon.png
f####.info/draw/app257/icon_h4d.png
f####.info/draw/app257/listdata.xml
f####.info/draw/app261/bg.png
f####.info/draw/app261/bg_h4d.png
f####.info/draw/app261/icon.png
f####.info/draw/app261/icon_h4d.png
f####.info/draw/app261/listdata.xml
f####.info/draw/app262/bg.png
f####.info/draw/app262/bg_h4d.png
f####.info/draw/app262/icon.png
f####.info/draw/app262/icon_h4d.png
f####.info/draw/app262/listdata.xml
f####.info/draw/app265/icon.png
f####.info/draw/app265/listdata.xml
f####.info/draw/app269/bg.png
f####.info/draw/app269/bg_h4d.png
f####.info/draw/app269/icon.png
f####.info/draw/app269/icon_h4d.png
f####.info/draw/app269/listdata.xml
f####.info/draw/app28/listdata.xml
f####.info/draw/app286/bg.png
f####.info/draw/app286/bg_h4d.png
f####.info/draw/app286/icon.png
f####.info/draw/app286/icon_h4d.png
f####.info/draw/app286/listdata.xml
f####.info/draw/app287/bg.png
f####.info/draw/app287/bg_h4d.png
f####.info/draw/app287/icon.png
f####.info/draw/app287/icon_h4d.png
f####.info/draw/app287/listdata.xml
f####.info/draw/app330/bg.png
f####.info/draw/app330/bg_h4d.png
f####.info/draw/app330/icon.png
f####.info/draw/app330/icon_h4d.png
f####.info/draw/app330/listdata.xml
f####.info/draw/app332/bg.png
f####.info/draw/app332/bg_h4d.png
f####.info/draw/app332/icon.png
f####.info/draw/app332/icon_h4d.png
f####.info/draw/app332/listdata.xml
f####.info/draw/app336/bg.png
f####.info/draw/app336/bg_h4d.png
f####.info/draw/app336/icon.png
f####.info/draw/app336/icon_h4d.png
f####.info/draw/app336/listdata.xml
f####.info/draw/app337/bg.png
f####.info/draw/app337/bg_h4d.png
f####.info/draw/app337/icon.png
f####.info/draw/app337/icon_h4d.png
f####.info/draw/app337/listdata.xml
f####.info/draw/app338/bg.png
f####.info/draw/app338/bg_h4d.png
f####.info/draw/app338/icon.png
f####.info/draw/app338/icon_h4d.png
f####.info/draw/app338/listdata.xml
f####.info/draw/app340/bg.png
f####.info/draw/app340/bg_h4d.png
f####.info/draw/app340/icon.png
f####.info/draw/app340/icon_h4d.png
f####.info/draw/app340/listdata.xml
f####.info/draw/app347/bg.png
f####.info/draw/app347/bg_h4d.png
f####.info/draw/app347/icon.png
f####.info/draw/app347/icon_h4d.png
f####.info/draw/app347/listdata.xml
f####.info/draw/app90/listdata.xml
f####.info/draw/categorylist.xml
f####.info/draw/maindatalist.xml

Modified file system:

Creates the following files:

/data/data/####/.FlurrySenderIndex.info.AnalyticsData_F65BCRV5F...VX_171
/data/data/####/.FlurrySenderIndex.info.AnalyticsMain
/data/data/####/.flurryagent.-31a3933e
/data/data/####/.flurrydatasenderblock.8a418a35-a0f3-4b7c-afbd-...23af35
/data/data/####/ads307341729.jar
/data/data/####/classLDDUBN.xml
/data/data/####/webview.db-journal
/data/data/####/yo_conf_pre.xml
/data/data/####/yoo_fsappnfo_pre.xml
/data/data/####/yoo_fsconf_pre.xml
/data/data/####/yoo_fstrategy_pre.xml
/data/data/####/yoo_p_download.db-journal
/data/data/####/yoo_r_common_pre.xml
/data/data/####/yoo_s_download.db-journal
/data/data/####/yops.jar
/data/data/####/yyj.jar
/data/media/####/.nomedia
/data/media/####/bg.png
/data/media/####/bg_h10d.png
/data/media/####/bg_h9d.png
/data/media/####/cat_00.png
/data/media/####/cat_01.png
/data/media/####/cat_02.png
/data/media/####/cat_03.png
/data/media/####/cat_04.png
/data/media/####/cat_05.png
/data/media/####/cat_07.png
/data/media/####/cat_08.png
/data/media/####/cat_09.png
/data/media/####/cat_10.png
/data/media/####/cat_11.png
/data/media/####/cat_12.png
/data/media/####/cat_13.png
/data/media/####/cat_dn.png
/data/media/####/cat_up.png
/data/media/####/categorylist.xml
/data/media/####/colors.xml
/data/media/####/data.dat
/data/media/####/dimens.xml
/data/media/####/ico_list_new.png
/data/media/####/ico_list_upd.png
/data/media/####/ico_loaded.png
/data/media/####/ico_lock.png
/data/media/####/ico_lock_buy.png
/data/media/####/ico_lock_poll.png
/data/media/####/ico_lock_rate.png
/data/media/####/ico_lock_video.png
/data/media/####/ico_menu_more.png
/data/media/####/ico_menu_rate.png
/data/media/####/ico_not_loaded.png
/data/media/####/icon.png
/data/media/####/icon_default.png
/data/media/####/icon_h10d.png
/data/media/####/icon_h4d.png
/data/media/####/icon_moreapps.png
/data/media/####/lesson01.zip
/data/media/####/lesson02.zip
/data/media/####/lesson03.zip
/data/media/####/lesson04.zip
/data/media/####/lesson05.zip
/data/media/####/lesson06.zip
/data/media/####/lesson07.zip
/data/media/####/lesson08.zip
/data/media/####/lesson09.zip
/data/media/####/lesson10.zip
/data/media/####/lesson11.zip
/data/media/####/lesson12.zip
/data/media/####/lesson13.zip
/data/media/####/lesson14.zip
/data/media/####/lesson15.zip
/data/media/####/lesson16.zip
/data/media/####/lesson17.zip
/data/media/####/lesson18.zip
/data/media/####/lesson19.zip
/data/media/####/lesson20.zip
/data/media/####/lesson21.zip
/data/media/####/lesson22.zip
/data/media/####/line_10.png
/data/media/####/line_2.png
/data/media/####/line_20.png
/data/media/####/line_40.png
/data/media/####/line_5.png
/data/media/####/listdata.xml
/data/media/####/maindatalist.xml
/data/media/####/maindatalist_fix.xml
/data/media/####/rate0.png
/data/media/####/rate1.png
/data/media/####/rate2.png
/data/media/####/rate3.png
/data/media/####/rate4.png
/data/media/####/rate5.png
/data/media/####/separator.png
/data/media/####/step_00.png
/data/media/####/step_01.png
/data/media/####/step_02.png
/data/media/####/step_03.png
/data/media/####/step_04.png
/data/media/####/step_05.png
/data/media/####/step_06.png
/data/media/####/step_07.png
/data/media/####/step_08.png
/data/media/####/step_09.png
/data/media/####/step_10.png
/data/media/####/step_11.png
/data/media/####/step_12.png
/data/media/####/step_13.png
/data/media/####/step_14.png
/data/media/####/step_15.png
/data/media/####/step_16.png
/data/media/####/step_17.png
/data/media/####/step_18.png
/data/media/####/step_19.png
/data/media/####/step_20.png
/data/media/####/step_21.png
/data/media/####/step_22.png
/data/media/####/step_23.png
/data/media/####/step_24.png
/data/media/####/step_25.png
/data/media/####/step_26.png
/data/media/####/step_27.png
/data/media/####/step_28.png
/data/media/####/step_29.png
/data/media/####/step_30.png
/data/media/####/step_31.png
/data/media/####/step_32.png
/data/media/####/step_33.png
/data/media/####/step_34.png
/data/media/####/strings.xml
/data/media/####/tl_back.png
/data/media/####/tl_back_on.png
/data/media/####/tl_brush.png
/data/media/####/tl_brush_on.png
/data/media/####/tl_clear.png
/data/media/####/tl_clear_on.png
/data/media/####/tl_colorpick.png
/data/media/####/tl_colorpick2.png
/data/media/####/tl_colorpick2_on.png
/data/media/####/tl_colorpick_on.png
/data/media/####/tl_drag.png
/data/media/####/tl_drag_on.png
/data/media/####/tl_edit.png
/data/media/####/tl_edit_on.png
/data/media/####/tl_editor.png
/data/media/####/tl_editor_on.png
/data/media/####/tl_erase.png
/data/media/####/tl_erase_on.png
/data/media/####/tl_menu.png
/data/media/####/tl_menu_on.png
/data/media/####/tl_next.png
/data/media/####/tl_next_on.png
/data/media/####/tl_redu.png
/data/media/####/tl_redu_on.png
/data/media/####/tl_save.png
/data/media/####/tl_save_on.png
/data/media/####/tl_share.png
/data/media/####/tl_share_on.png
/data/media/####/tl_show.png
/data/media/####/tl_show_on.png
/data/media/####/tl_trans.png
/data/media/####/tl_trans_on.png
/data/media/####/tl_undo.png
/data/media/####/tl_undo_on.png
/data/media/####/tl_zoom.png
/data/media/####/tl_zoom_on.png

Miscellaneous:

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial