Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.468.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.468.origin
Network activity:
Connecting to:
- a####.####.com
HTTP GET requests:
- a####.####.com/service/ouFeed.php?d_name=####&c_id=####&a_id=####&networ...
- a####.####.com/upload/update/open_1.0.7.9.png
Modified file system:
Creates the following files:
- <Package Folder>/app_load_tmp/ns.jar
- <Package Folder>/app_ns_down/ns.data
- <Package Folder>/databases/<Package>db
- <Package Folder>/databases/<Package>db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/74E74E1D15964134027836EFA96563EB.xml
- <Package Folder>/shared_prefs/9CE7A799499D60E64EFDBB06E7BB39FE.xml
Miscellaneous:
Executes next shell scripts:
- <dexopt>
