Android.Packed.20881

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.78.origin

Network activity:

Connecting to:

a####.####.com

HTTP GET requests:

a####.####.com/ad/20170119/201701191807243.png
a####.####.com/ad/20170329/201703291130966.apk

HTTP POST requests:

a####.####.com/is/list.jsp
a####.####.com/is/click.jsp
a####.####.com/is/info.jsp
a####.####.com/app/down.jsp
a####.####.com/is/show.jsp
a####.####.com/app_logs
a####.####.com/is/init.jsp

Modified file system:

Creates the following files:

/data/data/####/app_imgfile/d_sc_circle
/data/data/####/app_imgfile/d_listview_bg
/data/data/####/files/snail_data/ar-IWnNfy6ETh_pY/cAxY5kEtnA9aAxkcPKKnGJ7S1uc=
/data/data/####/app_imgfile/d_btnbg_blue
/data/data/####/app_imgfile/d_bottom_btn_install
/data/data/####/app_imgfile/d_arrow_up
/data/data/####/app_imgfile/d_pop_back
/data/data/####/app_imgfile/d_m_star
/data/data/####/app_imgfile/d_tj_line
/data/data/####/app_imgfile/d_cp_more_btn
/data/data/####/app_imgfile/d_btnbg_yellow
/data/data/####/app_imgfile/d_top_bg
/data/data/####/files/alladstart
/data/data/####/app_imgfile/d_cp_other_btn
/data/data/####/app_imgfile/d_btnbg_orange
/data/data/####/app_imgfile/d_page_selecte_green
/data/data/####/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB-journal
/sdcard/ddad/spot/http@@apk@d@ad@yuanfenup@com@ad@20170119@201701191807243@png
/data/data/####/app_imgfile/d_dtop_closebtn
/data/data/####/shared_prefs/list_share.xml
/data/data/####/shared_prefs/mobclick_agent_state_####.xml
/data/data/####/app_imgfile/d_shortcutad_bg
/data/data/####/app_imgfile/d_bottom_bg
/data/data/####/app_imgfile/d_listcloseBtn
/data/data/####/app_imgfile/d_default_bg
/data/data/####/app_imgfile/d_appsc_an
/data/data/####/app_imgfile/d_btnbg_green
/data/data/####/app_imgfile/d_safe_icon
/data/data/####/app_imgfile/d_cloesbtn_top
/data/data/####/app_imgfile/d_safe_line
/data/data/####/shared_prefs/appshare.xml.bak
/data/data/####/files/temp
/data/data/####/app_imgfile/d_adwords_bg
/data/data/####/app_imgfile/d_list_title_bg
/data/data/####/app_imgfile/d_page_selecte_orange
/data/data/####/files/runing.properties
/data/data/####/app_imgfile/d_arrow_down
/data/data/####/databases/gjappdl.db
/data/data/####/shared_prefs/appshare.xml
/data/data/####/app_imgfile/d_img_bg
/data/data/####/app_imgfile/d_pop_bottom_btn
/data/data/####/app_imgfile/d_bottom_btn_cancel
/sdcard/ddad/runing.properties
/data/data/####/shared_prefs/spadturn.xml
/sdcard/Download/spot/201703291130966.apk.tmp
/data/data/####/app_imgfile/d_btn_install
/data/data/####/files/snail_data/ar-IWnNfy6ETh_pY/tYDDNm8S8PJmBHVCxbe9QVp4nLOjmMYU
/data/data/####/shared_prefs/mobclick_agent_header_####.xml
/data/data/####/app_oouj/kkl.jar
/data/data/####/app_imgfile/d_page_selecte_blue
/data/data/####/app_imgfile/d_page_selecte_yellow
/data/data/####/app_imgfile/d_page_normol
/data/data/####/app_imgfile/d_install_btn
/data/data/####/databases/gjappdl.db-journal