Android.Packed.18928

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.89.origin
Android.Triada.120.origin

Removes its shortcut from the home screen.

Network activity:

Connecting to:

a####.####.com:7901
c####.####.com:8230
la####.com
c####.####.com:8888
c####.####.com
c####.####.com:8080
w####.####.com
b####.####.com:9230
l####.####.com
a####.####.com
b####.####.com

HTTP GET requests:

c####.####.com:8888/log/send?t=####&f1=####&f2=####
w####.####.com/js/common/jquery.js
la####.com/;jsessionid=5863A8DEEDDFC249C0A09B15EEBCFCD9
c####.####.com:8080/ads/promotion/b1702f9d-dfe5-4c30-85ee-20f6cf92ae13.png
l####.####.com/jquery/1.9.1/jquery.min.js
la####.com/render?2####
w####.####.com/js/common/swiper.min.js
c####.####.com/log/send?t=####&f1=####&f2=####
la####.com/render?5####
w####.####.com/css/deskBuoy/wapgame.css
w####.####.com/97973/20160107/XPvA-fxnkkuv4149157.png
w####.####.com/adx.php?c=####
w####.####.com/games/waphome/menu_icon2.png
w####.####.com/games/waphome/menu_icon6.png
w####.####.com/css/deskBuoy/normalize.css
w####.####.com/desk/deskBuoy.action
w####.####.com/games/20160127/TD09-fxnuvxe8453578.png
w####.####.com/games/20160118/r5uz-fxnrahr8471316.png
la####.com/;jsessionid=F71C6B75D041E00A5BA8F54A98C271C9
w####.####.com/97973/20160118/XKFL-fxnqrkc6599731.png
c####.####.com/ads/js/webAdClick32.js
w####.####.com/games/waphome/menu_icon4.png
w####.####.com/css/deskBuoy/swiper.min.css
w####.####.com/images/deskBuoy/zH6L-fxnuvxh5232248.jpg
w####.####.com/css/deskBuoy/deskBuoy.css
w####.####.com/images/deskBuoy/nOfy-fxnvhvu7096910.jpg
w####.####.com/js/deskBuoy/deskbuoy.js

HTTP POST requests:

a####.####.com:7901/
b####.####.com:9230/
c####.####.com:8230/
a####.####.com/
b####.####.com/
w####.####.com/bd/ads.action?channelId=####

Modified file system:

Creates the following files:

/data/data/####/files/shell_flag.cache
/data/data/####/shared_prefs/DataEvent.xml
/data/data/####/shared_prefs/shared_pref.xml
/data/data/####/cache/job2186.temp
/sdcard/.76761b91/65f4d34/34f8ba5397f10e78cf1ce826659fa4b9_1020.34
/data/data/####/files/0909181a07070b121c1c03617510947.jar
/data/data/####/cache/job1020_1401538654.jar
/data/data/####/files/work_check_flag.cache
/data/data/####/files/0909181a07070b121c1c031449860735.jar
/data/data/####/cache/job2097.temp
/data/data/####/shared_prefs/global_timeout.xml.bak
/data/data/####/cache/job1020_92384832.jar
/data/data/####/shared_prefs/savedata.xml
/data/data/####/shared_prefs/global_timeout.xml
/data/data/####/cache/job2514.temp
/data/data/####/files/0909181a07070b121c1c031183424028.jar
/data/data/####/shared_prefs/global_timeouttimeoutlist.xml.bak
/data/data/####/cache/job1020_1448084588.jar
/data/data/####/shared_prefs/shared_pref_strategy.xml.bak
/data/data/####/cache/job2395.temp
/data/data/####/cache/job2165.temp
/sdcard/.76761b91/eed88357/####/cache/image/http111cdn.abcdserver.com180801ads1promotion1b1702f9d-dfe5-4c30-85ee-20f6cf92ae13.png
/data/data/####/shared_prefs/JoyConfig.xml
/data/data/####/shared_prefs/global_timeouttimeoutlist.xml
/data/data/####/files/silencedownLoad_1011.cache
/data/data/####/cache/job2423.temp
/data/data/####/cache/job1020_1900545986.jar
/data/data/####/shared_prefs/shared_pref_strategy.xml
/data/data/####/cache/job2082.temp
/data/data/####/cache/633939428####.apk
/data/data/####/files/0909181a07070b121c1c031943658029.jar