Android.Packed.24893

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.451.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.DownLoader.451.origin

Изменения в файловой системе:

Создает следующие файлы:

/data/<Package>/####/classes.dex (deleted)
/data/<Package>/####/libsdkpaplat.sinfo
/data/<Package>/####/sdkpaplugin.jar.lock
/data/anr/traces.txt
<Package Folder>/.platformcache/####/classes.dex
<Package Folder>/.platformcache/####/classes.dex (deleted)
<Package Folder>/.platformcache/####/libapmeplt.so
<Package Folder>/.platformcache/####/libapmeplt.so (deleted)
<Package Folder>/.platformcache/####/libsdkpaplat.sinfo
<Package Folder>/.platformcache/####/libsdkpaplat.sinfo (deleted)
<Package Folder>/.platformcache/####/libsdkpaplat.so
<Package Folder>/.platformcache/####/libsdkpaplat.so (deleted)
<Package Folder>/.platformcache/####/tmp-1204305019tmp (deleted)
<Package Folder>/.platformcache/####/tmp-1706512671tmp (deleted)
<Package Folder>/.platformcache/####/tmp-1911547257tmp (deleted)
<Package Folder>/.platformcache/####/tmp-318709201tmp (deleted)
<Package Folder>/.platformcache/####/tmp-598571953tmp (deleted)
<Package Folder>/.platformcache/####/tmp-659932384tmp (deleted)
<Package Folder>/.platformcache/####/tmp-790077924tmp (deleted)
<Package Folder>/.platformcache/####/tmp1316188173tmp (deleted)
<Package Folder>/.platformcache/####/tmp1525992235tmp (deleted)
<Package Folder>/.platformcache/####/tmp1889533631tmp (deleted)
<Package Folder>/.platformcache/####/tmp1936603316tmp (deleted)
<Package Folder>/.platformcache/####/tmp2006443341tmp (deleted)
<Package Folder>/.platformcache/####/tmp338309835tmp (deleted)
<Package Folder>/.platformcache/####/tmp455481385tmp (deleted)
<Package Folder>/.platformcache/####/tmp479660575tmp (deleted)
<Package Folder>/.platformcache/####/tmp738340795tmp (deleted)
<Package Folder>/.platformcache/####/tmp983735078tmp (deleted)
<Package Folder>/.platformcache/main.jar
<Package Folder>/.platformcache/sdkpaplugin.jar.lock
<Package Folder>/shared_prefs/bootStart.xml
<Package Folder>/shared_prefs/platform.xml
<Package Folder>/shared_prefs/platform.xml.bak
<SD-Card>/.<Package>/####/compVersion
<SD-Card>/.<Package>/####/verinfo.cfg

Другие:

Запускает следующие shell-скрипты:

<dexopt>
chmod 755 /data/data/com.android.ptns.da.zc.zyt.en/.platformcache/main.jar
chmod 755 /data/data/com.android.ptns.da.zc.zyt.en/.platformcache/sdkpaplugin.jar
chmod 755 <Package Folder>/.platformcache/main.jar
chmod 755 <Package Folder>/.platformcache/sdkpaplugin.jar