Android.Packed.20588

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.246.origin

Сетевая активность:

Подключается к:

s####.####.com
n####.####.com:10091
p####.####.com
b####.####.com

Запросы HTTP POST:

p####.####.com/jiagu/msgs
n####.####.com:10091/opaService/link
b####.####.com/jiagu/mark/upgrade
s####.####.com/pkl16.html
b####.####.com/jiagu/t/infos

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/files/.jiagu.lock
/data/data/####/.jiagu/libjiagu.so
/sdcard/Books/.FBReader/13.ncache.zi2098
/data/data/####/files/.jglogs/.log3
/sdcard/Books/.FBReader/2.ncache.Zb2098
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/590DJ301dyO1897156hMFw==/data.dat.tmp
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/MvotLLQO3kv2JrKoXoNcnQ==/jjl_pBq_HxAZ5xvQ
/sdcard/Books/.FBReader/5.ncache.Iw2098
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/NVbyy0Hh2X-KfV7Nhj_QTg==/SZvOLwF8v3IPWYu9.zip
/data/data/####/databases/cc/cc.db
/data/data/####/shared_prefs/jg_core_setting.xml.bak
/sdcard/Books/.FBReader/16.ncache.TA2098
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/4t03lBGO86r-nigeqRMjxw==
/data/data/####/databases/readerbook.db-journal
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/4t03lBGO86r-nigeqRMjxw==.new
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/MvotLLQO3kv2JrKoXoNcnQ==/Hv_ow4S_OohhnDdpNugI_g==
/sdcard/Books/.FBReader/1.ncache.Qw2098
/data/data/####/databases/cc/cc.db-journal
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/l3ynHBqNaU1UdVnPunMp3Q==
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/localbooks/全职高手.txt
/sdcard/Books/.FBReader/9.ncache.lB2098
/data/data/####/files/.jglogs/.jg.ri
/sdcard/Books/.FBReader/8.ncache
/data/data/####/files/icfn.jar
/sdcard/Books/.FBReader/6.ncache.jg2098
/sdcard/Books/.FBReader/0.ncache
/sdcard/Books/.FBReader/12.ncache.TN2098
/sdcard/Books/.FBReader/10.ncache.En2098
/data/data/####/app_jgls/.log.lock
/data/data/####/files/.jglogs/.jg.ac
/data/data/####/files/rdata_comnmrtdsnm.new
/sdcard/Books/.FBReader/7.ncache.Ak2098
/sdcard/Books/.FBReader/15.ncache.cJ2098
/data/data/####/files/icfn.png
/data/data/####/databases/config.db-journal
/data/data/####/files/hxjbvg_d/hxjbvg_f.zip
/data/data/####/shared_prefs/cuf_config.xml
/sdcard/Books/.FBReader/3.ncache.oc2098
/data/data/####/app_jgls/.log.ls
/data/data/####/files/.jglogs/.jg.ic
/sdcard/Books/.FBReader/14.ncache.Ay2098
/sdcard/Books/.FBReader/4.ncache.xR2098
/sdcard/Books/.FBReader/11.ncache.aN2098
/data/data/####/databases/books.db-journal
/data/data/####/shared_prefs/jg_core_setting.xml
/data/data/####/files/_CLepWtjVaWfsvkHokZdhZZoNTNJO8Rg/l3ynHBqNaU1UdVnPunMp3Q==.new
/data/data/####/files/icfn