Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.3.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) hm.bd.5####.net:80
- TCP(HTTP/1.1) devsqu####.ca####.com:80
DNS requests:
- devsqu####.ca####.com
- hm.bd.5####.net
- sp.ad.adla####.jp
HTTP GET requests:
- devsqu####.ca####.com/logicsquare/adcfg.php?os=####&cc=####
- devsqu####.ca####.com/servercfg.php?appname=####&market=####&version=###...
HTTP POST requests:
- hm.bd.5####.net/9imeijcigol/2f16/p9c
- hm.bd.5####.net/9imeijcigol/2f16/q9c
File system changes:
Creates the following files:
- /data/data/####/_mglogicjiemi_r.xml
- /data/data/####/ads_config_0_US.cfg
- /data/data/####/com.yewninofev.jar
- /data/data/####/puzzles_111.arch
- /data/data/####/server.cfg
- /data/data/####/sound.cfg
- /data/data/####/webview.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- cocosdenshion
- game
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
