Android.Packed.24256

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.414.origin

Downloads the following detected threats from the Web:

Android.DownLoader.414.origin

Network activity:

Connecting to:

2####.####.197
2####.####.214
a####.####.cn
a####.####.com
a####.####.me
and####.####.com
f####.####.com
z####.####.com

HTTP GET requests:

2####.####.197/action/account/getinfo?app_id=####&udid=####&imsi=####&ne...
2####.####.214/action/pop_ad/ad?app_id=####&udid=####&imsi=####&net=####...
and####.####.com/mobile/track_sdk_event?sdk_version=####&android_version...
f####.####.com/f/jrtt8.jpg

HTTP POST requests:

a####.####.cn/action/user_info
a####.####.com/ad-service/ad/mark
a####.####.me/2.0/app/cache
z####.####.com/emag/99af/q1e

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/databases/0<IMEI>0.db-journal
<Package Folder>/databases/com.pocketchange.android.ProductTransactionManager.db
<Package Folder>/databases/com.pocketchange.android.ProductTransactionManager.db-journal
<Package Folder>/databases/com.pocketchange.android.http.AsyncHttpRequestService$RequestManager.db
<Package Folder>/databases/com.pocketchange.android.http.AsyncHttpRequestService$RequestManager.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/01496221974212.jar
<Package Folder>/files/01496221981785.jar
<Package Folder>/files/14962219740450.jar
<Package Folder>/files/14962219816840.jar
<Package Folder>/files/CacheTime.dat
<Package Folder>/files/Usr.hz
<Package Folder>/files/com.ggt.pql.jar
<Package Folder>/files/libjiagu.so
<Package Folder>/shared_prefs/AppSettings.xml
<Package Folder>/shared_prefs/MyPrefsFile.xml
<Package Folder>/shared_prefs/MyPrefsFile.xml.bak
<Package Folder>/shared_prefs/ShowAdFlag.xml
<Package Folder>/shared_prefs/_cscomsoftfunqiangblockingergame_r.xml
<Package Folder>/shared_prefs/_cscomsoftfunqiangblockingergame_r.xml.bak
<Package Folder>/shared_prefs/com.pocketchange.android.Preferences.xml
<Package Folder>/shared_prefs/com.pocketchange.android.http.AsyncHttpRequestExecutor.xml
<Package Folder>/shared_prefs/fac_f_<IMEI>.xml
<Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml
<Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml.bak
<Package Folder>/shared_prefs/fconf_f_<IMEI>.xml
<Package Folder>/shared_prefs/fconf_f_<IMEI>.xml.bak
<Package Folder>/shared_prefs/finfo_f_<IMEI>.xml
<Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml
<Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml.bak
<Package Folder>/shared_prefs/i.xml
<Package Folder>/shared_prefs/jg_app_update_settings_random.xml
<Package Folder>/shared_prefs/kiip.xml
<Package Folder>/shared_prefs/xappInfo_pre.xml
<Package Folder>/shared_prefs/xappInfo_pre.xml.bak
<SD-Card>/Android/####/AppPackage.dat
<SD-Card>/Android/####/CacheTime.dat
<SD-Card>/Android/####/UnPackage.dat
<SD-Card>/Android/####/android
<SD-Card>/Download/####/jrtt8.jpg.dat