Android.Packed.21729

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.MobiDash.1.origin

Сетевая активность:

Подключается к:

a####.####.com

Запросы HTTP GET:

a####.####.com/api/values.php

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.a.a.a.m.xml
<Package Folder>/shared_prefs/branch_referral_shared_pref.xml
<Package Folder>/shared_prefs/instabug.xml.bak
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionDevice.cls_temp
<Package Folder>/app_app_apk/amdroid.dat.jar
<Package Folder>/cache/conversations.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/branch_referral_shared_pref.xml.bak
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_8aaf40df-ca45-4bf4-aeb9-11c48b739052_1495006106672.tap
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
<Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
<Package Folder>/cache/sessions.cache
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionOS.cls_temp
<Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-1542642610.zip
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CBeginSession.cls_temp
<Package Folder>/files/file
<Package Folder>/files/gaClientId
<Package Folder>/shared_prefs/BNC_Server_Request_Queue.xml
<Package Folder>/databases/alarmDb.db-journal
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/nextAlarmNotification.xml
<Package Folder>/shared_prefs/alarm.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionApp.cls_temp
<Package Folder>/shared_prefs/alarm.xml.bak
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionEvent0000000000.cls_temp
<Package Folder>/cache/issues.cache
<Package Folder>/shared_prefs/instabug.xml
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/app_outdex/amdroid.dat.dex
<Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
<Package Folder>/shared_prefs/nextAlarmNotification.xml.bak
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
<Package Folder>/code_cache/secondary-dexes/MultiDex.lock
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/cache/read_queue.cache
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_c4913e99-5b17-4ee8-b9c4-58c2b993abc1_1495006104569.tap
<Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml