Android.Packed.25437

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.204.origin
Android.DownLoader.205.origin
Android.DownLoader.205.origin
Android.DownLoader.205.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.DownLoader.204.origin
Android.DownLoader.205.origin
Android.DownLoader.205.origin
Android.DownLoader.205.origin

Сетевая активность:

Подключается к:

a####.####.com
a####.####.com:38080
ad####.####.cn
c####.####.net
k####.####.cn
s####.####.cn

Запросы HTTP GET:

ad####.####.cn/20160324053034gk.png

Запросы HTTP POST:

a####.####.com/CD382781B46D648D05B8C219784B4DD1
a####.####.com/app_logs
a####.####.com:38080/8018DAF55F3FB325C0EF07F6C62DC787
c####.####.net/dc/sync_adr
k####.####.cn/702619E220213D3BFE64AC4C86FBECF1
s####.####.cn/702619E220213D3BFE64AC4C86FBECF1
s####.####.cn/70F5024058DC2E24DFD61302050EEED3

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/databases/ab_new.db
<Package Folder>/databases/ab_new.db-journal
<Package Folder>/databases/ab_old.db
<Package Folder>/databases/ab_old.db-journal
<Package Folder>/databases/bb_new.db
<Package Folder>/databases/bb_new.db-journal
<Package Folder>/databases/bb_old.db
<Package Folder>/databases/bb_old.db-journal
<Package Folder>/databases/dataeye_database_158905636DFDE07F6399B6B39688E7A6.db
<Package Folder>/databases/dataeye_database_158905636DFDE07F6399B6B39688E7A6.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/.imprint
<Package Folder>/files/JARD_-1937922600.zip
<Package Folder>/files/JARD_1858066477.zip
<Package Folder>/files/JARD_723475729.zip
<Package Folder>/files/JARD_975195084.zip
<Package Folder>/files/JNID_-463693142.so
<Package Folder>/files/JNID_1722629846.so
<Package Folder>/files/JNID_1858061708.so
<Package Folder>/files/JNID_733434762.so
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/admainlib.xml
<Package Folder>/shared_prefs/admainlib.xml.bak
<Package Folder>/shared_prefs/admainlib_new.xml
<Package Folder>/shared_prefs/admainlib_new.xml.bak
<Package Folder>/shared_prefs/dc.158905636DFDE07F6399B6B39688E7A6.preferences.xml
<Package Folder>/shared_prefs/lib_names.xml
<Package Folder>/shared_prefs/lib_names_new.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/share_adview_name.xml
<Package Folder>/shared_prefs/shared_lib_info.xml
<Package Folder>/shared_prefs/shared_lib_info.xml.bak
<Package Folder>/shared_prefs/shared_lib_info_new.xml
<Package Folder>/shared_prefs/shared_lib_info_new.xml.bak
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/tx_shell/libshella-0.0.2.so
<SD-Card>/.SystemService/####/2D7F07BB6125DEB407E92A22DC4AC550
<SD-Card>/.SystemService/####/uid
<SD-Card>/lysy/####/<Package>.ini
<SD-Card>/lysy/####/config.ini
<SD-Card>/lysy/####/journal.tmp
<SD-Card>/sys31/20160324053034gk_40_48.png.tmp