Android.Packed.20983

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.546.origin

Network activity:

Connecting to:

s####.####.com
a####.####.com

HTTP POST requests:

a####.####.com/ad-service/ad/mark
s####.####.com/api/pb?action=####

Modified file system:

Creates the following files:

/data/data/####/.jiagu/libjiagu.so
/data/data/####/shared_prefs/admob.xml.bak
/data/data/####/databases/donationDb-journal
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/admob.xml
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/shared_prefs/ab_sdk_pref.xml.bak
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/files/com.appbrain.ping
/data/data/####/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
/data/data/####/shared_prefs/jg_app_update_settings_random.xml
/data/data/####/shared_prefs/ab_sdk_pref.xml
/data/data/####/databases/donationDb
/data/data/####/app_wi/####.odex
/data/data/####/app_jgls/.log.lock
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/shared_prefs/ab_pref_int.xml
/data/data/####/cache/1470286953684.jar
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/databases/db_public-journal
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/databases/webview.db-journal
/data/data/####/app_wi/####.zip
/data/data/####/app_jgls/.log.ls
/data/data/####/cache/ApplicationCache.db-journal
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/cache/1470286953684.tmp