Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.2.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.1mo####.com:80
- TCP(HTTP/1.1) a####.api.1mo####.com:80
- TCP(TLS/1.0) 2####.58.212.142:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
DNS requests:
- a####.1mo####.com
- a####.api.1mo####.com
- d####.fl####.com
- kp.0####.com
- m.0####.com
- s.lb####.com
- ssl.google-####.com
- u.lb####.com
HTTP GET requests:
- a####.1mo####.com/log/applogin?appid=####&uid=####&mv=####&imei=####&av=...
- a####.api.1mo####.com/ads/getInfo.php?appid=####&appver=####&client=####
- a####.api.1mo####.com/config/init.php
- a####.api.1mo####.com/push/message.php
- a####.api.1mo####.com/shareApps/get_invite_code
Modified file system:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_WRC3NP6F...F6_195
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.yflurrydatasenderblock.41d2b3c6-8749-46bc-adc5...be695d
- /data/data/####/.yflurryreport.4721dc6e7b3d0d9
- /data/data/####/78.xml
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/SHARE_APPS.xml
- /data/data/####/a.zip
- /data/data/####/ce.zip
- /data/data/####/com.waiting.share_preferences.xml
- /data/data/####/en_tempni
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/iad_KPkit.xml
- /data/data/####/iad_unkit.xml
- /data/data/####/ipssp.xml
- /data/data/####/kp_ce.db-journal
- /data/data/####/n.zip
- /data/data/####/sort.xml
- /data/data/####/tc_ce.db
- /data/data/####/tc_ce.db-journal
- /data/data/####/tempni
- /data/data/####/tn.zip
- /data/data/####/z.zip
- /data/media/####/.nomedia
- /data/media/####/XH.txt
Miscellaneous:
Loads the following dynamic libraries:
- nwpmkkd
Uses the following algorithms to encrypt data:
- DES
- RSA-ECB-PKCS1Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
