Android.Packed.22283

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Xiny.78.origin

Сетевая активность:

Подключается к:

a####.####.cn
cl####.####.com
sta####.####.com
a####.####.com
cl####.####.com:9110

Запросы HTTP GET:

a####.####.cn/ad/20170510/201705101716626.apk
a####.####.com/is/init.jsp?appid=####
sta####.####.com/attached/formal/adv/7572566/1028/20170526185712_258.png
a####.####.cn/ad/20160908/201609081732238.png
sta####.####.com/attached/formal/adv/7572566/1066/20170525154856_117.jpg
sta####.####.com/attached/formal/adv/7572566/202/20170522174712_188.png

Запросы HTTP POST:

a####.####.com/app_logs
a####.####.com/is/info.jsp
a####.####.cn/is/info.jsp
a####.####.cn/is/list.jsp
a####.####.cn/is/init.jsp
a####.####.cn/is/show.jsp
cl####.####.com/terminal/ad/getAdList.do?t=####
a####.####.com/is/init.jsp
cl####.####.com:9110/terminal/ad/getAdList.do?t=####
a####.####.cn/app/down.jsp
a####.####.cn/is/click.jsp

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_feiwo_simg.jar/META-INF/MANIFEST.MF
<Package Folder>/databases/amb_dl.db-journal
<Package Folder>/files/ycom
<Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
<Package Folder>/shared_prefs/Ijd5F3DN0kqRu3gUcVNi3myfItrDtmY0.xml
<Package Folder>/shared_prefs/khshares.xml.bak
<Package Folder>/files/.mocy/oqiangzhanjihu.jar
<Package Folder>/app_feiwo_simg.jar/by_safety_certification.png
<Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
<Package Folder>/cache/web_image_cache/http+static2+ad+anzhi+com+attached+formal+adv+7572566+202+20170522174712_188+png
<Package Folder>/shared_prefs/khshares.xml
<Package Folder>/shared_prefs/totalcount.xml
<Package Folder>/app_feiwo_simg.jar/icom_bg.png
<Package Folder>/databases/feiwo_bai-db-journal
<Package Folder>/shared_prefs/5qkMaKdY98lXUGeW0cHslQ==.xml
<Package Folder>/app_feiwo_simg.jar/by_surprise.png
<Package Folder>/shared_prefs/mappcfg.xml
<Package Folder>/shared_prefs/bayiSharedPrferences.xml
<Package Folder>/cache/web_image_cache/http+static2+ad+anzhi+com+attached+formal+adv+7572566+1066+20170525154856_117+jpg
<Package Folder>/app_feiwo_simg.jar/back.png
<Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
<Package Folder>/databases/amb_dl.db
<Package Folder>/app_feiwo_simg.jar/by_mark.png
<Package Folder>/cache/web_image_cache/http+static2+ad+anzhi+com+attached+formal+adv+7572566+1028+20170526185712_258+png
<Package Folder>/app_feiwo_simg.jar/by_rloding_2.png
<Package Folder>/shared_prefs/feiwo_checkerConfig.xml
<Package Folder>/app_feiwo_simg.jar/by_rloding_4.png
<Package Folder>/files/afc.pro
<Package Folder>/app_feiwo_simg.jar/by_right_arrow.png
<Package Folder>/app_feiwo_simg.jar/dm_cover_close.png
<Package Folder>/shared_prefs/mappcfg.xml.bak
<Package Folder>/shared_prefs/youturn.xml
<Package Folder>/files/pqiangzhanjihuco.jar
<Package Folder>/app_feiwo_simg.jar/by_rloding_1.png
<Package Folder>/app_feiwo_simg.jar/by_rloding_3.png
<Package Folder>/shared_prefs/listfs.xml