Android.Packed.22459

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Click.136.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.Click.136.origin

Сетевая активность:

Подключается к:

p####.####.com:8066
r####.####.net
l####.####.cn
l####.####.cn:88

Запросы HTTP GET:

l####.####.cn/m/7vW52mta4PPv2SPsX1A8G-U73d0WMsNRVxPZJQ
l####.####.cn/t?r=####&p=####
r####.####.net/update/7.3.5

Запросы HTTP POST:

p####.####.com:8066/s/
l####.####.cn/i/lv/v1/3577912485867544359?t=####
l####.####.cn:88/i/nu/v1/3577912485867544359?t=####
l####.####.cn/i/ls/v1/3577912485867544359?t=####
l####.####.cn/g?r=####

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.wn/databases/apk_install_sc_db
<Package Folder>/.wn/databases/download.db-journal
<Package Folder>/.wn/files/ext4-snail-5
<Package Folder>/.wn/shared_prefs/locconfig
<Package Folder>/.wn/files/ad_temp/run_status_hb_request.gz
<Package Folder>/.wn/databases/statistics.db
<Package Folder>/.wn/shared_prefs/common_cfg.prefs
<Package Folder>/.wn/databases/apk_install_tip.db-journal
<Package Folder>/.wn/files/ad_temp/run_status_hb_response.gz
<Package Folder>/shared_prefs/loader_wn.xml
<Package Folder>/files/.wn_temp/ad9ebca9-990f-4b5b-912f-336ad9d8c3f5.a
<Package Folder>/.wn/shared_prefs/lconfig
<Package Folder>/.wn/files/ad_temp/server_req_hb_response.gz
<Package Folder>/databases/dbbfe-journal
<Package Folder>/.wn/databases/app_track.db
<Package Folder>/files/qdcycz
<Package Folder>/.wn/shared_prefs/common_rundata.prefs
<Package Folder>/.wn/databases/log_temp.db-journal
<Package Folder>/.wn/shared_prefs/extra
<Package Folder>/files/R4vx1Qlp6xQ=
<Package Folder>/.wn/shared_prefs/log_cfg.prefs
<Package Folder>/.wn/databases/log_temp.db
<Package Folder>/.wn/databases/apk_install_sc_db-journal
<Package Folder>/.wn/databases/statistics.db-journal
<Package Folder>/.wn/shared_prefs/main.prefs
<Package Folder>/.wn/databases/apk_install_tip.db
<Package Folder>/.wn/databases/download.db
<Package Folder>/files/.wn_temp/4127195282787200314.a
<Package Folder>/.wn/shared_prefs/exception
<Package Folder>/files/.wn_data/.c2.e4.zip
<Package Folder>/.wn/shared_prefs/run_status.prefs
<Package Folder>/.wn/databases/log_index.db
<Package Folder>/.wn/shared_prefs/sconfig.bak
<Package Folder>/.wn/snail_lib/libsnail_c2_e4_zip.so
<Package Folder>/.wn/files/prop_file/phone_dataer.prop
<Package Folder>/.wn/databases/app_stats.db
<Package Folder>/files/.wn_temp/ad9ebca9-990f-4b5b-912f-336ad9d8c3f5.a.de
<Package Folder>/.wn/databases/log_index.db-journal
<Package Folder>/.wn/shared_prefs/sconfig
<Package Folder>/.wn/databases/win_ad.db
<Package Folder>/files/.wn_data/.ad9ebca9-990f-4b5b-912f-336ad9d8c3f5.a.zip
<Package Folder>/.wn/databases/win_ad.db-journal
<Package Folder>/.wn/files/ad_data/download_temp/ad9ebca9-990f-4b5b-912f-336ad9d8c3f5.a
<Package Folder>/.wn/databases/app_stats.db-journal
<Package Folder>/.wn/databases/app_track.db-journal
<Package Folder>/.wn/shared_prefs/lconfig.bak
<Package Folder>/app_hmkho/classes.jar
<Package Folder>/.wn/shared_prefs/common_rundata.prefs.bak