Android.Packed.18990

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.122.origin

Network activity:

Connecting to:

h####.net:6372
so####.com
i####.####.com
d####.####.com
h####.net
so####.com:8176
a####.####.com

HTTP GET requests:

d####.####.com/md5_fe08685616e25b2b56488b75a4edd7a0.apk
d####.####.com/md5_4c57ab79ed83d730bdd7de5fbacb5b43.jpg
h####.net/start?key=####
so####.com:8176/getad?key=####
i####.####.com/service/getIpInfo.php?ip=####
d####.####.com/md5_6eb89ac328cf4b3aba664ba587255fd9.jpg
d####.####.com/md5_511618c0d7f4016ae1d78275d4c00956.jpg
d####.####.com/md5_08292b4b235a76748f1584426fadebed.jpg
so####.com/getad?key=####
h####.net:6372/getspotad?key=####
h####.net/infocollect?key=####
h####.net/click?key=####
d####.####.com/admin/upload/assets/j_close.png
h####.net/getspotad?key=####
h####.net/view?key=####

HTTP POST requests:

a####.####.com/app_logs

Modified file system:

Creates the following files:

/data/data/####/databases/Downloado
/data/data/####/shared_prefs/config.xml
/sdcard/.android/files/com.qaz.wsx.dex
/data/data/####/shared_prefs/configo.xml
/sdcard/Android/data/####/cache/md5_08292b4b235a76748f1584426fadebed.jpg.cache
/data/data/####/shared_prefs/configo.xml.bak
/data/data/####/databases/Log-journal
/data/data/####/databases/Downloado-journal
/sdcard/Android/data/.nomedia
/sdcard/Android/data/####/files/logo.png
/data/data/####/files/mobclick_agent_cached_####
/data/data/####/databases/iAppData-journal
/sdcard/.android/files/com.tgb.yhn.dex
/sdcard/.android/.android.dat-journal
/data/data/####/databases/Download-journal
/sdcard/Android/data/####/files/cls.png
/sdcard/.android/.android.dat
/data/data/####/shared_prefs/D_D.xml
/data/data/####/shared_prefs/iConfig.xml
/data/data/####/shared_prefs/KJokeConfig.xml
/data/data/####/shared_prefs/iConfig.xml.bak
/data/data/####/shared_prefs/KJokeConfig.xml.bak
/sdcard/.android/####/spot_in.png
/data/data/####/databases/iDownload-journal
/data/data/####/app_MceY/classes.jar
/sdcard/download.db
/sdcard/Android/data/####/files/id
/data/data/####/databases/dbWPDJ-journal
/data/data/####/databases/webview.db-journal
/sdcard/.android/files/com.edc.rfv.dex
/sdcard/.android/####/.iid
/data/data/####/files/FavoriteType.xml
/data/data/####/shared_prefs/mobclick_agent_state_####.xml
/sdcard/Android/data/####/files/filter
/data/data/####/databases/Logo
/data/data/####/cache/web_image_cache/http+dow+fklocker+com+md5_4c57ab79ed83d730bdd7de5fbacb5b43+jpg
/data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
/data/data/####/databases/Logo-journal
/sdcard/download.db-journal
/data/data/####/cache/web_image_cache/http+dow+fklocker+com+md5_6eb89ac328cf4b3aba664ba587255fd9+jpg
/data/data/####/shared_prefs/mobclick_agent_header_####.xml
/data/data/####/cache/web_image_cache/http+dow+fklocker+com+md5_511618c0d7f4016ae1d78275d4c00956+jpg
/data/data/####/databases/iLog-journal
/data/data/####/shared_prefs/config.xml.bak