Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) www.snooker####.com:80
- TCP(HTTP/1.1) www.eternit####.com:8200
- TCP(HTTP/1.1) www.inspira####.com:8320
- TCP(TLS/1.0) rr3---s####.g####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) g####.hmv####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) rr5---s####.g####.com:443
- TCP(TLS/1.0) securep####.g.doublec####.net:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) rr4---s####.g####.com:443
- TCP(TLS/1.0) d198c70####.safef####.googles####.com:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.2) 1####.251.36.46:443
- TCP(TLS/1.2) 1####.251.39.99:443
- TCP(TLS/1.2) www.google####.com:443
- UDP rr3---s####.g####.com:443
- UDP www.google####.com:443
- UDP rr5---s####.g####.com:443
- UDP rr4---s####.g####.com:443
DNS requests:
- adser####.go####.com
- adser####.go####.nl
- and####.google####.com
- android####.go####.com
- d####.fl####.com
- d198c70####.safef####.googles####.com
- g####.hmv####.com
- p####.google####.com
- rr3---s####.g####.com
- rr4---s####.g####.com
- rr5---s####.g####.com
- safebro####.google####.com
- securep####.g.doublec####.net
- www.eternit####.com
- www.google####.com
- www.google-####.com
- www.googlet####.com
- www.gst####.com
- www.inspira####.com
- www.snooker####.com
HTTP GET requests:
- www.eternit####.com:8200/file/upload/game_1.png
- www.snooker####.com/Goto.ashx?ChannelID=####
HTTP POST requests:
- d####.fl####.com:443/aap.do
- www.inspira####.com:8320/h5_config
- www.inspira####.com:8320/h5_report
File system changes:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_TKK6K2G5...H5_281
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.yflurrydatasenderblock.1fa07cc3-27a7-481b-bc06...d9d8b8
- /data/data/####/.yflurrydatasenderblock.9847568f-01ee-4674-b502...61cbcb
- /data/data/####/.yflurrydatasenderblock.bf265bd6-d11f-424b-bca9...d099f3
- /data/data/####/.yflurryreport.7455a0ebf0a7e714
- /data/data/####/1
- /data/data/####/24f8c553947a370f_0
- /data/data/####/2940195bd9870d6e_0 (deleted)
- /data/data/####/2b4109d6c2bc4e4d_0
- /data/data/####/4a43c775ecf81df6_0
- /data/data/####/6ee9103f7700dc18_0
- /data/data/####/6ee9103f7700dc18_1
- /data/data/####/80dd3b07ab857eec_0
- /data/data/####/80dd3b07ab857eec_1
- /data/data/####/836140409c552d50_0
- /data/data/####/836140409c552d50_1
- /data/data/####/Cookies-journal
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a6ad11d6692dcf70_0
- /data/data/####/a8494e08bd1176ef_0
- /data/data/####/aa23e4ebab12a15a_0
- /data/data/####/aad76077fd324184_0 (deleted)
- /data/data/####/ba136218ec4c208a_0
- /data/data/####/bed2adf617b9a268_0
- /data/data/####/c830a35cc9fcdec1_0
- /data/data/####/com.bilacity.footacle_preferences.xml
- /data/data/####/data_5.dex
- /data/data/####/data_5.dex.flock (deleted)
- /data/data/####/eab574b6bc351333_0
- /data/data/####/eab574b6bc351333_1
- /data/data/####/ef37d4b3278d9f59_0
- /data/data/####/ef37d4b3278d9f59_1
- /data/data/####/fd7e904084fdad31_0 (deleted)
- /data/data/####/h5_pan_settings_8.xml
- /data/data/####/h5_settings.xml
- /data/data/####/index
- /data/data/####/installationNum
- /data/data/####/metrics_guid
- /data/data/####/the-real-index
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
Gets information about network.
Displays its own windows over windows of other apps.
