Android.Packed.19932

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.500.origin
Android.DownLoader.1846

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/informator.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_0a541d80-0aea-488e-abcc-e88f9f329c2c_1485423419474.tap
/data/data/####/files/crypted.zip
/data/data/####/shared_prefs/TwitterAdvertisingInfoPreferences.xml
/data/data/####/shared_prefs/mobproxy.xml.bak
/data/data/####/files/kHkGUDGCmj
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_192a5ecf-7733-4e00-921a-d55070462726_1485423387345.tap
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889C31A0180-0001-080A-75A27CEFEF7BBeginSession.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_6ec0f3eb-3434-496d-af94-d22a0f54b8fc_1485423386594.tap
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889C31A0180-0001-080A-75A27CEFEF7BSessionApp.cls_temp
/data/data/####/shared_prefs/infMrkPst.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889C31A0180-0001-080A-75A27CEFEF7BSessionDevice.cls_temp
/data/data/####/shared_prefs/mpcom.crashlytics.prefs.xml
/data/data/####/shared_prefs/inf.storage.xml.bak
/data/data/####/shared_prefs/com.crashlytics.sdk.android:answers:settings.xml
/data/data/####/shared_prefs/####.xml
/data/data/####/shared_prefs/installTime.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
/data/data/####/shared_prefs/####dmnkpr.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
/data/data/####/shared_prefs/inf.storage.xml
/data/data/####/files/CPkrFUMfYEeeDyyO.dex
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_c772edbe-5f2f-4b76-b3e6-32ac53b44ac8_1485423386461.tap
/data/data/####/files/cls.dex
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889C31A0180-0001-080A-75A27CEFEF7BSessionOS.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_b63766f5-c09a-48f6-942d-35238536cbc5_1485423390403.tap
/data/data/####/shared_prefs/####dmnkpr.xml.bak
/data/data/####/shared_prefs/mobproxy.xml
/data/data/####/shared_prefs/####.xml.bak