Android.Packed.23857

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.HiddenAds.125.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.HiddenAds.125.origin

Сетевая активность:

Подключается к:

a####.####.com
as####.####.com
cdn-hig####.####.com
d####.####.com
m####.####.com
pl####.####.com
s####.####.com
u####.####.com

Запросы HTTP GET:

a####.####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=####&sd...
as####.####.com/oc67f5cd/8e771fd6b198bb8d0a8d9b21b1b1741c85d0d2b3_v23_ph...
cdn-hig####.####.com/impact/videos/96806/a488a9a869f301e6/heroes-30s-v1-...
d####.####.com/M01/01/AB/CvJMDVlCXICAY6YrAAVgxKJvq9E665.zip
u####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&prod...

Запросы HTTP POST:

d####.####.com/aar.do
m####.####.com/detail/getOfferListNew?enc=####
pl####.####.com/ad_dex.php
s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.mbj/####/classes.zip
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/.flurryagent.546874fe
<Package Folder>/files/UnityAdsCache-109f6ad75655c01ee48a43fb94f6f64c702d0b71759e56846db8ca152db82e55.jpg
<Package Folder>/files/UnityAdsCache-81736e0b7ba7cc13388eb489e937f9e124562042ee695384a6865d12fdaf7822.jpg
<Package Folder>/files/UnityAdsCache-921966dfbebe765096335b61eb5988e15656cdd159c728ae4014e9cf2c7a2537.mp4
<Package Folder>/files/UnityAdsCache-99df5bc1fe24ab2f0806c9c4cd5410c4ad4e6792df88cde020214c375e8da4be.png
<Package Folder>/files/UnityAdsStorage-private-data.json
<Package Folder>/files/UnityAdsStorage-public-data.json
<Package Folder>/files/UnityAdsTest.txt
<Package Folder>/files/UnityAdsWebApp.html
<Package Folder>/files/google.db
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml.bak
<Package Folder>/shared_prefs/AppleShootSaveData.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/aps.xml.bak
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apsad.xml.bak
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml.bak
<SD-Card>/.androidsystem/####/49.x-3.0.1.apk
<SD-Card>/.androidsystem/####/PlugShareData
<SD-Card>/.androidsystem/####/files.db
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/.androidsystem/####/plugxml.xml
<SD-Card>/.androidsystem/####/syncfiles.db
<SD-Card>/.androidsystem/Plugin.zip
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/1380229154.js
<SD-Card>/Android/####/8e771fd6b198bb8d0a8d9b21b1b1741c85d0d2b3_v23_phone.mp4
<SD-Card>/Android/####/jquery-1.9.1.min.js
<SD-Card>/Android/####/jquery.knob.js
<SD-Card>/Android/####/oc67f5cd_a7e9e9cfb930d221ff3a28c938c22947c6a5cecd_v21_phone.jpeg
<SD-Card>/Android/####/oc67f5cd_ba04cb633865dc0c6775bb61b10f03ab6ed523d0_v21_phone.jpeg
<SD-Card>/Android/####/sound_off.png
<SD-Card>/Android/####/sound_on.png
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid