Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.455.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.455.origin
Network activity:
Connecting to:
- a####.####.net
- s####.####.net
- t####.####.net
HTTP GET requests:
- a####.####.net/aos/v3/pns?s=####
- s####.####.net/stat/aos/v3/init?s=####
- t####.####.net/v1/active?dv=####&ts=####&osv=####&pt=####&appid=####&ver...
Modified file system:
Creates the following files:
- <Package Folder>/databases/01e98e61e61828a3b97f292b36e7480d
- <Package Folder>/databases/01e98e61e61828a3b97f292b36e7480d-journal
- <Package Folder>/databases/0<IMEI>1.db-journal
- <Package Folder>/databases/5ebc662c163a3de7c104e5757dee5772
- <Package Folder>/databases/5ebc662c163a3de7c104e5757dee5772-journal
- <Package Folder>/databases/82cd0d0216edb9a403a3ee1b4a03a6ce
- <Package Folder>/databases/82cd0d0216edb9a403a3ee1b4a03a6ce-journal
- <Package Folder>/databases/8d96220b0a292b46276a8d32848f09b4-journal
- <Package Folder>/databases/E_ID<IMEI>.db-journal
- <Package Folder>/databases/P15pKIjsm64m
- <Package Folder>/databases/P15pKIjsm64m-journal
- <Package Folder>/databases/T1oX0rhhuXWt
- <Package Folder>/databases/T1oX0rhhuXWt-journal
- <Package Folder>/databases/XKwVoK0huy3R
- <Package Folder>/databases/XKwVoK0huy3R-journal
- <Package Folder>/databases/b424d7d8ff40c18897f9cec490886ebf
- <Package Folder>/databases/b424d7d8ff40c18897f9cec490886ebf-journal
- <Package Folder>/databases/jqIqJYOT3JpT
- <Package Folder>/databases/jqIqJYOT3JpT-journal
- <Package Folder>/databases/wIU6pTyUBYWX
- <Package Folder>/databases/wIU6pTyUBYWX-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/wsUL1uCdKvjD
- <Package Folder>/databases/wsUL1uCdKvjD-journal
- <Package Folder>/files/014962152636071.jar
- <Package Folder>/files/014962152645541.jar
- <Package Folder>/files/149621526517601496215265176.jar
- <Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak
- <SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
- <SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
Miscellaneous:
Executes next shell scripts:
- <dexopt>
