Android.Packed.22142

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.414.origin

Network activity:

Connecting to:

c####.####.com
1####.####.131:8080
f####.####.com
a####.####.com

HTTP GET requests:

1####.####.131:8080/spotService/a.jsp?k=####
c####.####.com/jquery-1.9.1.min.js
f####.####.com/js/main.js
f####.####.com/fetch_feature.php?pname=####&lang=####&aid=####&mac=####&...
f####.####.com/f.php?pname=####&lang=####&aid=####&mac=####&sim=####&api...
c####.####.com/mobile/1.3.0/images/ajax-loader.gif
c####.####.com/mobile/1.3.0/jquery.mobile-1.3.0.min.css
c####.####.com/mobile/1.3.0/jquery.mobile-1.3.0.min.js
f####.####.com/css/main.css

HTTP POST requests:

a####.####.com/app_logs

Modified file system:

Creates the following files:

<Package Folder>/shared_prefs/spName.xml
<Package Folder>/shared_prefs/c1<IMEI>.xml
<Package Folder>/databases/google_analytics_v2.db-journal
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/databases/a1.db-journal
<Package Folder>/files/.imprint
<Package Folder>/shared_prefs/a1<IMEI>.xml
<Package Folder>/shared_prefs/b1<IMEI>.xml
<Package Folder>/databases/apps-journal
<Package Folder>/shared_prefs/matrix_cache.prefs.xml
<Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
<Package Folder>/files/gaClientId
<Package Folder>/shared_prefs/a.xml
<Package Folder>/files/.umeng/exchangeIdentity.json
<Package Folder>/shared_prefs/ads_config.prefs.xml
<Package Folder>/shared_prefs/com.avos.avoscloud.approuter.SCH4nOBLCgCj6ydJTw1eXSYs-MdYXbMMI.xml
<Package Folder>/shared_prefs/ads_config.prefs.xml.bak
<Package Folder>/cache/webviewCacheChromium/index
<Package Folder>/shared_prefs/com.avos.avoscloud.approuter.SCH4nOBLCgCj6ydJTw1eXSYs-MdYXbMMI.xml.bak
<Package Folder>/databases/apps
<Package Folder>/shared_prefs/c1<IMEI>.xml.bak
<Package Folder>/cache/webviewCacheChromium/f_000001
<Package Folder>/shared_prefs/matrix_cache.prefs.xml.bak
<Package Folder>/cache/webviewCacheChromium/f_000003
<Package Folder>/cache/webviewCacheChromium/f_000002
<Package Folder>/shared_prefs/com.avos.avoscloud.RequestStatisticsUtil.data.xml.bak
<Package Folder>/shared_prefs/FBAdPrefs.xml
<Package Folder>/shared_prefs/a1.xml
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/com.avos.avoscloud.RequestStatisticsUtil.data.xml
<Package Folder>/shared_prefs/b1<IMEI>.xml.bak
<Package Folder>/databases/webview.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/mobclick_agent_cached_<Package>33
<Package Folder>/files/01495006106931.jar
<Package Folder>/shared_prefs/a1<IMEI>.xml.bak
<Package Folder>/shared_prefs/SDKIDFA.xml
<Package Folder>/cache/webviewCacheChromium/data_3
<Package Folder>/cache/webviewCacheChromium/data_2
<Package Folder>/cache/webviewCacheChromium/data_1
<Package Folder>/cache/webviewCacheChromium/data_0