Android.Packed.22878

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.HiddenAds.76.origin
Android.RemoteCode.71.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.HiddenAds.76.origin
Android.RemoteCode.71.origin

Сетевая активность:

Подключается к:

a####.####.com
a####.####.com:9090
cu####.com
go####.com
p####.####.com
pag####.####.com
virendr####.####.in
zfr####.com

Запросы HTTP GET:

a####.####.com/sdkcp/ibsbill.php?pushId=####&lpId=####&linkId=####&imsi=...
a####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&plugVersi...
a####.####.com:9090/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=...
cu####.com/20170605180414.NgpNewDex_520_06051800.zip
go####.com/images/icons/ui/gprofile_button-16.png
pag####.####.com/pagead/js/r20170605/r20170110/show_ads_impl.js
virendr####.####.in/2017/06/8th-makardhwaja-was-not-his-son-reveals.html

Запросы HTTP POST:

p####.####.com/api/q/a/315432f0c34a6005ff1c18a57a27f742e
zfr####.com/up.do

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/index
<Package Folder>/cache/a.log
<Package Folder>/cache/b.log
<Package Folder>/databases/mpush_game.db-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/sklead.dataBase
<Package Folder>/databases/sklead.dataBase-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/U924.apk
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/ob.zip
<Package Folder>/files/playerData
<Package Folder>/shared_prefs/315432f0c34a6005ff1c18a57a27f742e|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/SSPPrefe.xml
<Package Folder>/shared_prefs/SSPPrefe.xml.bak
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/bill.xml.xml
<Package Folder>/shared_prefs/bill.xml.xml.bak
<Package Folder>/shared_prefs/kokId.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/m_cfg.xml.bak
<Package Folder>/shared_prefs/m_cfg.xml.bak (deleted)
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<SD-Card>/.tcookieid
<SD-Card>/kokfiles/aaa.jar
<SD-Card>/kokfiles/bbb.jar