Android.Packed.27864

Added to the Dr.Web virus database: 2017-08-25

Virus description added: 2017-08-25

Malicious functions:

Executes code of the following detected threats:

Network activity:

Connecting to:

HTTP POST requests:

Modified file system:

Creates the following files:

<Package Folder>/cache/####/70588c1dde66cc4150474d8fb11fe7e37397261c9828a35b0214755545e5df5c.0.tmp
<Package Folder>/cache/####/91d3f8d38c3c7a15963cec7ce8d5f6823bfd28d17f125e4151eb74d22ce65805.0.tmp
<Package Folder>/cache/####/91f5789ae0f9a85258fb3cca3eb151741473c19886490b1a535db905fef97876.0.tmp
<Package Folder>/cache/####/9b424e8094be6d6ea2649b2ec3c3a5b976c03469bafc92a109d78c5bf11dadd4.0.tmp
<Package Folder>/cache/####/a980a2391282e3be01d5f0549200aa5a7bdf9e4b5583ad3346f449ba9325a834.0.tmp
<Package Folder>/cache/####/ad5663052de26c1dbaf3d53972d4210c6aa8ba5cf7ccf395ddd88e958c9274d5.0.tmp
<Package Folder>/cache/####/aebfffb69991a5883f63ddbf14f6e9b0ecd8f3ef5dc161b92a381eae9d20af2e.0.tmp
<Package Folder>/cache/####/dcf65afc3b7d4e2e05130ce269495d6d40cc52ae6947f7a1bd917fc5be0d0f78.0.tmp
<Package Folder>/cache/####/edc3e4134b3240aa1ad4e2af799e0c120de2e618e3f3feee4329d820bbb6d565.0.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/filesbb.jar
<Package Folder>/shared_prefs/Prefres.xml
<Package Folder>/shared_prefs/SSPPrefe.xml
<Package Folder>/shared_prefs/SSPPrefe.xml.bak
<Package Folder>/shared_prefs/VsoYouSdk.xml
<SD-Card>/<Package>/####/gunkiller=1765.apk.tmp

Miscellaneous:

Loads the following dynamic libraries:

Uses the following algorithms to decrypt data:

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.