Android.Packed.24863

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Backdoor.332.origin
Android.MulDrop.99.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.Backdoor.332.origin
Android.MulDrop.99.origin

Сетевая активность:

Подключается к:

9####.####.162
9####.####.162:9090
co####.####.com
s####.####.com

Запросы HTTP GET:

9####.####.162/rpdisp/reportredirect?imei=####&imsi=####&phonetype=####&...
9####.####.162:9090/rpdisp/reportredirect?imei=####&imsi=####&phonetype=...

Запросы HTTP POST:

co####.####.com/appstore/fa.scmd
s####.####.com/dc/fa.scmd

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.rom1863940393.jar
<Package Folder>/.rom2141390323.jar
<Package Folder>/app_uitq/.tocr.t
<Package Folder>/app_uitq/.tostr.t
<Package Folder>/databases/JSONIMGDB2
<Package Folder>/databases/JSONIMGDB2-journal
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/databases/monitor_apps.db
<Package Folder>/databases/monitor_apps.db-journal
<Package Folder>/databases/traffic_statistics.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/wifi_connect.db-journal
<Package Folder>/files/####/592E6EF30217-0001-0835-3088F0792F6BBeginSession.cls_temp
<Package Folder>/files/####/592E6EF30217-0001-0835-3088F0792F6BSessionApp.cls_temp
<Package Folder>/files/####/592E6EF30217-0001-0835-3088F0792F6BSessionDevice.cls_temp
<Package Folder>/files/####/592E6EF30217-0001-0835-3088F0792F6BSessionOS.cls_temp
<Package Folder>/files/####/com.crashlytics.settings.json
<Package Folder>/files/####/initialization_marker
<Package Folder>/files/####/sa_58ffda4a-faf1-4fe2-ad4e-4a6bcb8d4b1c_1496215284543.tap
<Package Folder>/files/####/sa_cae5ab34-b5e3-44fe-9b20-4b3559116205_1496215283632.tap
<Package Folder>/files/####/session_analytics.tap
<Package Folder>/files/####/session_analytics.tap.tmp
<Package Folder>/files/AF_INSTALLATION
<Package Folder>/files/AdjustIoActivityState
<Package Folder>/files/AdjustIoPackageQueue
<Package Folder>/files/gaClientId
<Package Folder>/rpc.cmd
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/WkUserSettings.xml
<Package Folder>/shared_prefs/WkUserSettings.xml.bak
<Package Folder>/shared_prefs/appsflyer-data.xml
<Package Folder>/shared_prefs/appsflyer-data.xml.bak
<Package Folder>/shared_prefs/biosConfig.xml
<Package Folder>/shared_prefs/biosConfig.xml.bak
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
<Package Folder>/shared_prefs/conf_guard_asc.xml
<Package Folder>/shared_prefs/conf_guard_msc.xml
<Package Folder>/shared_prefs/conf_guard_nssb.xml
<Package Folder>/shared_prefs/conf_guard_ssb.xml
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.p.xml
<Package Folder>/shared_prefs/push_conf.xml
<Package Folder>/shared_prefs/sdk_dc_005010.xml
<Package Folder>/shared_prefs/sdk_dc_005012.xml
<Package Folder>/shared_prefs/sdk_dc_005012.xml.bak
<Package Folder>/shared_prefs/sdk_device.xml
<Package Folder>/shared_prefs/sdk_upgrade.xml
<Package Folder>/shared_prefs/sdk_upgrade.xml.bak
<SD-Card>/.wkchannel_overseas
<SD-Card>/.wkcid_overseas