Android.Packed.19249

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.SmsSend.1848.origin

Сетевая активность:

Подключается к:

1####.####.18
i####.####.com
p####.####.com
a####.####.site:8090
1####.####.34:19000
apm-col####.####.com
p####.####.cc

Запросы HTTP GET:

p####.####.com/cityjson?ie=####
a####.####.site:8090/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
i####.####.com/a/35313985d3b9ccc38ab579d35065afe66

Запросы HTTP POST:

1####.####.34:19000/v2/chis
p####.####.com/api/q/a/35313985d3b9ccc38ab579d35065afe66
1####.####.18/amb/rhi.php
apm-col####.####.com/cpi/crash
p####.####.cc/index.php/API

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/baea/tmb.jar
/data/data/####/files/rdata_comhkjerfasshnwef.new
/data/data/####/shared_prefs/TestinCrash.xml.bak
/data/data/####/shared_prefs/ma_data.xml
/data/data/####/files/SOIk7BnV3wk4Vdwljugk0x6Ii1rflAVZX6LnTA==/AQ9Hyy14qW3GtqgZXYPOWw==.new
/data/data/####/files/mj.apk
/data/data/####/files/SOIk7BnV3wk4Vdwljugk0x6Ii1rflAVZX6LnTA==/z44IufOYOnRx-pjQd1c5MA==/Gx_gf3cTJJhCl4LiXV9FMQ==
/data/data/####/shared_prefs/edition.xml
/data/data/####/shared_prefs/device_id.xml.xml
/data/data/####/shared_prefs/b_share.xml
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml
/data/data/####/shared_prefs/cpMsg.xml
/data/data/####/shared_prefs/new_vvsion.xml
/data/data/####/files/mpush_gateway_preferences_file
/data/data/####/shared_prefs/td_pefercen_profile.xml.bak
/data/data/####/files/mpush_version_preferences_file
/data/data/####/files/SOIk7BnV3wk4Vdwljugk0x6Ii1rflAVZX6LnTA==/z44IufOYOnRx-pjQd1c5MA==/e43faXpraAL592mm
/data/data/####/shared_prefs/zzconfig.xml
/data/data/####/shared_prefs/35313985d3b9ccc38ab579d35065afe66|account_file.xml
/data/data/####/databases/TestinAgent.db-journal
/data/data/####/databases/mpush_game.db-journal
/data/data/####/databases/TestinAgent.db
/data/data/####/files/SOIk7BnV3wk4Vdwljugk0x6Ii1rflAVZX6LnTA==/2TtO83Gkgpf0UFtIsACAlA==.new
/data/data/####/files/SOIk7BnV3wk4Vdwljugk0x6Ii1rflAVZX6LnTA==/zNtQ-cIlWpe9Y6dh7AFaEA==/data.dat.tmp
/sdcard/.tcookieid
/data/data/####/databases/webview.db-journal
/data/data/####/files/SOIk7BnV3wk4Vdwljugk0x6Ii1rflAVZX6LnTA==/dLlzdzXMn-HqrrmQlM3IzA==/wHoT0aMrpPMDYST9.zip
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/files/tbvabq_d/tbvabq_f.zip
/data/data/####/databases/MA_epay_db
/data/data/####/databases/mp.db-journal
/data/data/####/shared_prefs/b_setting.xml
/data/data/####/shared_prefs/ma_call.xml
/data/data/####/shared_prefs/tdid.xml
/data/data/####/baea/entrance.jar
/data/data/####/shared_prefs/td_pefercen_profile.xml
/data/data/####/databases/mp.db
/data/data/####/files/rdata_comhkjerfasshnwef
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/databases/bil_db-journal
/data/data/####/files/SOIk7BnV3wk4Vdwljugk0x6Ii1rflAVZX6LnTA==/AQ9Hyy14qW3GtqgZXYPOWw==
/data/data/####/shared_prefs/getFlag.xml
/data/data/####/databases/bil_db
/data/data/####/databases/MA_epay_db-journal
/data/data/####/shared_prefs/TestinCrash.xml