Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.3.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sdkco####.ad.xi####.com:80
- TCP(HTTP/1.1) trac####.m####.com:80
- TCP(HTTP/1.1) zi.si.07####.cn:80
- TCP(TLS/1.0) d####.fl####.com:443
DNS requests:
- d####.fl####.com
- f4.ma####.xi####.com
- sdkco####.ad.xi####.com
- serv####.a.com
- trac####.m####.com
- zi.si.07####.cn
HTTP GET requests:
- sdkco####.ad.xi####.com/api/checkupdate/lastusefulversion?currentApiVers...
- sdkco####.ad.xi####.com/api/detail/3c1d68051a19ea72d9bfb0aa9c312efd?ts=#...
- sdkco####.ad.xi####.com/api/detail/54db829f09424caad69f7fb9350fa48d?ts=#...
- sdkco####.ad.xi####.com/api/detail/a194a0a7214f6cbda0672045c51505d1?ts=#...
HTTP POST requests:
- trac####.m####.com/track/v1
- zi.si.07####.cn/elbuortni/ed5a/p06
- zi.si.07####.cn/elbuortni/ed5a/q06
File system changes:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_Q348NP8C...WY_195
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.yflurrydatasenderblock.09f2607f-b596-486c-9a46...aee317
- /data/data/####/.yflurrydatasenderblock.1e9f29ef-9194-49ba-a5cf...455db1
- /data/data/####/.yflurrydatasenderblock.24e6a2fc-d9a2-44c5-ad4c...6504ac
- /data/data/####/.yflurrydatasenderblock.2adef553-29a7-4f1e-996e...499bc1
- /data/data/####/.yflurrydatasenderblock.2d849b9a-ba33-4ad3-a7cf...5f6d87
- /data/data/####/.yflurrydatasenderblock.3d3b53b7-53be-4abc-8ea0...9841a4
- /data/data/####/.yflurrydatasenderblock.4ae3655a-4994-414a-9b28...bce9af
- /data/data/####/.yflurrydatasenderblock.4eb192ab-0b90-4e14-9f37...a3afaf
- /data/data/####/.yflurrydatasenderblock.4fa6cf33-6602-4133-99cb...6a202c
- /data/data/####/.yflurrydatasenderblock.569d000f-1d43-47ca-ab4a...a69b29
- /data/data/####/.yflurrydatasenderblock.65c502b2-c82f-4aa3-9048...5382ee
- /data/data/####/.yflurrydatasenderblock.68d3f4b6-d94f-4bef-8afd...89f495
- /data/data/####/.yflurrydatasenderblock.6bdc92a2-ccfc-49dd-ae41...88fb19
- /data/data/####/.yflurrydatasenderblock.7bd37424-2d05-4f87-909e...654e10
- /data/data/####/.yflurrydatasenderblock.93244075-3b09-419d-8842...aa9867
- /data/data/####/.yflurrydatasenderblock.9aa577dd-939f-4eb5-ad63...cb86df
- /data/data/####/.yflurrydatasenderblock.9c9ad448-b181-4e29-a3e7...d6d2bf
- /data/data/####/.yflurrydatasenderblock.a6614f29-cfb8-42c3-b7e2...6784b3
- /data/data/####/.yflurrydatasenderblock.a75416a5-6bfa-424d-9617...7756fa
- /data/data/####/.yflurrydatasenderblock.b1ec7492-b30d-412e-aa57...82a9ca
- /data/data/####/.yflurrydatasenderblock.b8e14ad4-51c8-41c4-8da1...097b83
- /data/data/####/.yflurrydatasenderblock.bdf6911a-f7de-4ec4-9298...f3af9a
- /data/data/####/.yflurrydatasenderblock.c3d48915-4138-4254-9367...caa5a3
- /data/data/####/.yflurrydatasenderblock.c632cae2-c3f6-4bfd-8aeb...32aa3f
- /data/data/####/.yflurrydatasenderblock.d5473440-d3bf-49af-994e...f9ef82
- /data/data/####/.yflurrydatasenderblock.ddbefe88-8989-47bb-8c83...f2c7a5
- /data/data/####/.yflurrydatasenderblock.e207b633-5399-4202-9597...5d1707
- /data/data/####/.yflurrydatasenderblock.e6e18958-33ca-4311-9160...aef3d7
- /data/data/####/.yflurrydatasenderblock.fa3d0697-b5a9-4a44-87b7...85a95f
- /data/data/####/.yflurrydatasenderblock.fdfa4aa5-6b07-4d70-863e...675e23
- /data/data/####/.yflurryreport.-671a0a662c3c944e
- /data/data/####/AnalyticsCache.txt
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/ReporterService.xml
- /data/data/####/_msintrouble_r.xml
- /data/data/####/analytics.db-journal
- /data/data/####/analytics_asset.apk
- /data/data/####/com.shenzhiy.xierenjuede.yjingsh.jar
- /data/data/####/heartbeat.xml
- /data/data/####/libanalytics.so
- /data/data/####/policy.cache
- /data/data/####/requests.db-journal
- /data/data/####/sharedPre_flurry.xml
- /data/data/####/updater.xml
- /data/data/####/webview.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- cocos2dcpp
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
