Android.Hidden.1912

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.437.origin

Removes its shortcut from the home screen.

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/informator.xml
/data/data/####/shared_prefs/TwitterAdvertisingInfoPreferences.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_6a57180d-0c3e-4bb2-bd65-c376f6e1deb4_1485417964887.tap
/data/data/####/files/.Fabric/io.fabric.sdk.android:fabric/mpcom.crashlytics.settings.json
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889ADEB0052-0001-0839-1A9245804EE7BeginSession.cls_temp
/data/data/####/files/hMDCionqeE
/data/data/####/shared_prefs/io.fabric.sdk.android:fabric:mpio.fabric.sdk.android.Onboarding.xml
/data/data/####/cls.dex
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AE09032F-0001-08A0-1A9245804EE7SessionApp.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AE09032F-0001-08A0-1A9245804EE7SessionDevice.cls_temp
/data/data/####/shared_prefs/infMrkPst.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889ADEB0052-0001-0839-1A9245804EE7SessionOS.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_0b12f73b-f910-4223-a3de-3db2ec8902e3_1485417994692.tap
/data/data/####/shared_prefs/mpcom.crashlytics.prefs.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889ADEB0052-0001-0839-1A9245804EE7SessionDevice.cls_temp
/data/data/####/shared_prefs/com.crashlytics.sdk.android:answers:settings.xml
/data/data/####/shared_prefs/####.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889ADEB0052-0001-0839-1A9245804EE7SessionUser.cls_temp
/data/data/####/shared_prefs/installTime.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AE09032F-0001-08A0-1A9245804EE7BeginSession.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
/data/data/####/shared_prefs/####dmnkpr.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_133b9d88-5179-4848-aa3d-9557b55d2b3b_1485417963143.tap
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
/data/data/####/files/cls.dex
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889ADEB0052-0001-0839-1A9245804EE7SessionApp.cls_temp
/data/data/####/shared_prefs/####dmnkpr.xml.bak
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AE09032F-0001-08A0-1A9245804EE7SessionOS.cls_temp