Android.DownLoader.2267

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Click.136.origin
Android.Backdoor.433.origin

Downloads the following detected threats from the Web:

Android.Backdoor.433.origin

Network activity:

Connecting to:

c####.####.com
p####.####.com:8066
l####.####.cn
p####.####.com
pi####.####.com

HTTP GET requests:

c####.####.com/s?z####
l####.####.cn/m/7vW52mta4PPv2SPsX1A8G-U73d0WMsNRVxPZJQ
l####.####.cn/t?r=####&p=####
p####.####.com/c/1495005881840

HTTP POST requests:

l####.####.cn/g?r=####
p####.####.com:8066/s/
pi####.####.com/mstat/report
p####.####.com/s/
p####.####.com/p/1495005882408

Modified file system:

Creates the following files:

<Package Folder>/.snail/databases/apk_install_tip.db
<Package Folder>/.snail/shared_prefs/main.prefs
<Package Folder>/shared_prefs/loader_snail.xml
<Package Folder>/.snail/databases/apk_install_tip.db-journal
<Package Folder>/.snail/databases/apk_install_sc_db
<Package Folder>/.snail/databases/app_stats.db-journal
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/files/.snail_temp/af41cd79-c9df-4f2a-bfc2-c210a13f86ee.a.de
<Package Folder>/.snail/shared_prefs/common_rundata.prefs.bak
<Package Folder>/.snail/databases/win_ad.db
<Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
<Package Folder>/.snail/databases/app_stats.db
<Package Folder>/.snail/shared_prefs/common_cfg.prefs
<Package Folder>/.snail/shared_prefs/locconfig
<Package Folder>/app_hyifue/D6AA8EFBE7379C394CE9CA8FAD263829.jar
<Package Folder>/files/.snail_data/.b3.f5.zip
<Package Folder>/.snail/files/ad_data/download_temp/af41cd79-c9df-4f2a-bfc2-c210a13f86ee.a
<Package Folder>/.snail/databases/apk_install_sc_db-journal
<Package Folder>/files/.snail_data/.af41cd79-c9df-4f2a-bfc2-c210a13f86ee.a.zip
<Package Folder>/.snail/databases/statistics.db-journal
<Package Folder>/.snail/databases/win_ad.db-journal
<Package Folder>/.snail/databases/app_track.db
<Package Folder>/.snail/databases/log_temp.db
<Package Folder>/files/.snail_temp/af41cd79-c9df-4f2a-bfc2-c210a13f86ee.a
<Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
<Package Folder>/.snail/databases/download.db-journal
<Package Folder>/.snail/databases/app_track.db-journal
<Package Folder>/.snail/shared_prefs/lconfig
<Package Folder>/.snail/shared_prefs/common_rundata.prefs
<Package Folder>/.snail/databases/download.db
<Package Folder>/files/qdcycz
<Package Folder>/.snail/files/ad_temp/server_req_hb_response.gz
<Package Folder>/.snail/snail_lib/libsnail_b3_f5_zip.so
<Package Folder>/.snail/files/prop_file/phone_dataer.prop
<Package Folder>/.snail/databases/log_index.db-journal
<Package Folder>/.snail/databases/log_temp.db-journal
<Package Folder>/.snail/files/ad_temp/run_status_hb_response.gz
<Package Folder>/.snail/databases/statistics.db
<Package Folder>/.snail/databases/log_index.db
<Package Folder>/.snail/files/ext4-snail-5
<Package Folder>/.snail/files/ad_temp/run_status_hb_request.gz
<Package Folder>/.snail/shared_prefs/exception
<Package Folder>/databases/tencent_analysis.db-journal
<Package Folder>/.snail/shared_prefs/log_cfg.prefs
<Package Folder>/.snail/shared_prefs/run_status.prefs
<Package Folder>/files/mobclick_agent_cached_<Package>