Android.Packed.25173

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.243.origin
Android.DownLoader.328.origin
Android.Hmad.1
Android.Hmad.1.origin

Downloads the following detected threats from the Web:

Android.DownLoader.243.origin
Android.DownLoader.328.origin
Android.Hmad.1
Android.Hmad.1.origin

Network activity:

Connecting to:

a####.####.com
adser####.####.com
e####.####.com
e####.####.com:9090
m####.####.net
o####.####.com
pus####.####.com
statson####.####.com

HTTP GET requests:

adser####.####.com/static/ad/showRule.json?phoneBrand=####&phone=####&js...
e####.####.com/sdkcp/user_visit_appcp.jsp?Subid=####&cpid=####&Pjid=####...
e####.####.com:9090/sdkcp/user_visit_appcp.jsp?Subid=####&cpid=####&Pjid...

HTTP POST requests:

a####.####.com/rest/2.0/channel/3535187815621799387
m####.####.net/api/get_apps
o####.####.com/v2/check_config_update
pus####.####.com/get/get_ad_3
pus####.####.com/user/ad_screen
pus####.####.com/user/register_gzip
statson####.####.com/pushlog

Modified file system:

Creates the following files:

<Package Folder>/app_jc/dfp.jar
<Package Folder>/app_jc/dfx.jar
<Package Folder>/app_jc/tfp.jar (deleted)
<Package Folder>/app_jc/tfx.jar (deleted)
<Package Folder>/app_mjf/ddz.jar
<Package Folder>/app_mjf/tdz.jar (deleted)
<Package Folder>/cache/ads1521209785.jar
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/womi_SDKDB.db
<Package Folder>/databases/womi_SDKDB.db-journal
<Package Folder>/files/.jiagu.ls
<Package Folder>/files/libjiagu.so
<Package Folder>/files/umeng_it.cache
<Package Folder>/rd/cd.zip
<Package Folder>/shared_prefs/1%dss#gfs#ge1%dr1%dps#g_s#gds#ge1%drs#gas#ghs#gSs#g_s#ge1%dr1%dos#gCs#ge1%dls#gis#gb1%do1%dm.xml
<Package Folder>/shared_prefs/1%dss#gfs#ge1%dr1%dps#g_s#gds#ge1%drs#gas#ghs#gSs#g_s#ge1%dr1%dos#gCs#ge1%dls#gis#gb1%do1%dm.xml.bak
<Package Folder>/shared_prefs/<Package>.push_sync.xml
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/shared_prefs/ads_share_cache.pref.xml
<Package Folder>/shared_prefs/bindcache.xml
<Package Folder>/shared_prefs/cached.pref.xml
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/dzmsdkpre.xml
<Package Folder>/shared_prefs/fpssp.xml
<Package Folder>/shared_prefs/fxssp.xml
<Package Folder>/shared_prefs/k.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/myActivityName.xml
<Package Folder>/shared_prefs/pst.xml
<Package Folder>/shared_prefs/s#ges#gd1%ds#gos#gcs#ghss#gas#gh.xml
<Package Folder>/shared_prefs/service_sp_name_common.xml
<Package Folder>/shared_prefs/service_sp_name_common.xml.bak
<Package Folder>/shared_prefs/service_spname_apps.xml
<Package Folder>/shared_prefs/service_spname_cookie.xml
<Package Folder>/shared_prefs/service_spname_show_rule.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<SD-Card>/.android/####/rtwfosdyfw.db
<SD-Card>/.android/####/rtwfosdyfw.db-journal
<SD-Card>/Light.apk
<SD-Card>/baidu/.cuid
<SD-Card>/tencent/####/serviceshare