Android.Packed.23986

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.502.origin
Android.DownLoader.502.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.DownLoader.502.origin
Android.DownLoader.502.origin

Сетевая активность:

Подключается к:

a####.####.com
o####.####.com
p####.com
qiniu####.####.com

Запросы HTTP GET:

qiniu####.####.com/0ecf2f500be493d10de60dc585a38dbd.apk?e=####&attname=#...

Запросы HTTP POST:

a####.####.com/app_logs
o####.####.com/check_config_update
p####.com/apiv1/sdkstat/launch

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/databases/a1.db-journal
<Package Folder>/databases/sd.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/.imprint
<Package Folder>/files/1496215285427p.jar
<Package Folder>/files/1496215285556s.jar
<Package Folder>/files/1496215285722a.jar
<Package Folder>/files/libjiagu.so
<Package Folder>/files/umake.conf
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/a.xml
<Package Folder>/shared_prefs/a1.xml
<Package Folder>/shared_prefs/a1<IMEI>.xml
<Package Folder>/shared_prefs/a1<IMEI>.xml.bak
<Package Folder>/shared_prefs/a<IMEI>.xml
<Package Folder>/shared_prefs/a<IMEI>.xml.bak
<Package Folder>/shared_prefs/b1<IMEI>.xml
<Package Folder>/shared_prefs/b<IMEI>.xml
<Package Folder>/shared_prefs/c1<IMEI>.xml
<Package Folder>/shared_prefs/c1<IMEI>.xml.bak
<Package Folder>/shared_prefs/c<IMEI>.xml
<Package Folder>/shared_prefs/c<IMEI>.xml.bak
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak (deleted)
<Package Folder>/shared_prefs/pa.xml
<Package Folder>/shared_prefs/pa<IMEI>.xml
<Package Folder>/shared_prefs/pa<IMEI>.xml.bak
<Package Folder>/shared_prefs/pgyersdk.xml
<Package Folder>/shared_prefs/umeng_feedback_conversations.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<SD-Card>/Download/03cf84db-3f91-4707-88f3-9b59b5008318.apk
<SD-Card>/com.kingsfsb/zwdq.sqlite
<SD-Card>/com.kingsfsb/zwdq.sqlite-journal