Android.Packed.18859

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.155.origin
Android.SmsSend.1848.origin

Сетевая активность:

Подключается к:

1####.####.34:19000
i####.####.com
c####.com
a####.####.site
p####.####.com
1####.####.18
apm-col####.####.com
p####.####.cn

Запросы HTTP GET:

i####.####.com/a/3f6ec4da684547211e371a67946d85757
a####.####.site/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
p####.####.com/cityjson?ie=####
c####.com/

Запросы HTTP POST:

1####.####.34:19000/v2/chis
1####.####.18/amb/rhi.php
p####.####.com/api/q/a/3f6ec4da684547211e371a67946d85757
apm-col####.####.com/cpi/crash
p####.####.cn/index.php/API

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/baea/tmb.jar
/data/data/####/shared_prefs/TestinCrash.xml.bak
/data/data/####/shared_prefs/ma_data.xml
/data/data/####/files/mj.apk
/data/data/####/shared_prefs/ma_call.xml
/data/data/####/shared_prefs/edition.xml
/data/data/####/shared_prefs/device_id.xml.xml
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/grT5GOUt7QIkVb6gyiNvRw==/1M7KZIAoM47xOZ_g
/data/data/####/shared_prefs/cpMsg.xml
/data/data/####/shared_prefs/new_vvsion.xml
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/1zf6rp_LKduAWGJDIsqkrg==
/data/data/####/files/mpush_gateway_preferences_file
/data/data/####/shared_prefs/td_pefercen_profile.xml.bak
/data/data/####/files/mpush_version_preferences_file
/data/data/####/shared_prefs/zzconfig.xml
/data/data/####/files/rdata.new
/data/data/####/databases/TestinAgent.db-journal
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/1zf6rp_LKduAWGJDIsqkrg==.new
/data/data/####/databases/mpush_game.db-journal
/data/data/####/databases/bil_db-journal
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/G7S-4snWchAdto1hc--bhg==/puX-ws-UjRy8QvCK.zip
/sdcard/.tcookieid
/data/data/####/files/rdata
/data/data/####/files/mj.dex
/data/data/####/databases/webview.db-journal
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/Oi7UyNcmr8xchHWGGkPCHA==/data.dat.tmp
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
/data/data/####/databases/TestinAgent.db
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/38x4a0tMIArnVI_KlDzHWw==
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/databases/MA_epay_db
/data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
/data/data/####/databases/mp.db-journal
/data/data/####/shared_prefs/b_setting.xml
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/38x4a0tMIArnVI_KlDzHWw==.new
/data/data/####/databases/MA_epay_db-journal
/data/data/####/shared_prefs/td_pefercen_profile.xml
/data/data/####/databases/mp.db
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/files/srckaq_d/srckaq_f.zip
/data/data/####/files/wy-qzY4PKEioggpwjpBm5XbcnD5EfcAelFOrHQ==/grT5GOUt7QIkVb6gyiNvRw==/UQDMj0jqVMQfeRfc79k1Dw==
/data/data/####/shared_prefs/getFlag.xml
/data/data/####/databases/bil_db
/data/data/####/shared_prefs/TestinCrash.xml