Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Joker.1127
- Android.Joker.281.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) blog####.l.googleu####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) cat.metl####.xyz:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.2) 1####.251.1.113:443
- TCP(TLS/1.2) www.google####.com:443
- TCP cat.metl####.xyz:443
DNS requests:
- cat.metl####.xyz
- flashli####.blog####.com
- g####.face####.com
- m####.go####.com
- www.google####.com
HTTP GET requests:
- blog####.l.googleu####.com:443/ads.txt
File system changes:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_2BDS9DN8...95_318
- /data/data/####/.YFlurrySenderIndex.info.StreamingMain
- /data/data/####/.font3599-3599-0
- /data/data/####/.font4421-4421-0
- /data/data/####/.font4709-4709-0
- /data/data/####/.yflurrydatasenderblock.01ed5c51-ba1d-4e46-a7ca...730d36
- /data/data/####/.yflurrydatasenderblock.1d1c1f98-a74d-4513-a981...fe8957
- /data/data/####/.yflurrydatasenderblock.2a30c778-d60b-4b9e-a165...e6cfd4
- /data/data/####/.yflurrydatasenderblock.2b0afac2-f9b6-4ddc-9dab...279167
- /data/data/####/.yflurrydatasenderblock.4f0255f2-b01f-46ba-bddd...43ec9d
- /data/data/####/.yflurrydatasenderblock.61fb27fe-1c87-4273-bd27...f9bb65
- /data/data/####/.yflurrydatasenderblock.6ce64add-2a1d-4d34-970f...a8b464
- /data/data/####/.yflurrydatasenderblock.6f702d72-981c-4614-b4bb...5dc418
- /data/data/####/.yflurrydatasenderblock.742e910b-a020-42f0-b187...ae54cd
- /data/data/####/.yflurrydatasenderblock.774aadbf-4daa-464f-b516...c8d585
- /data/data/####/.yflurrydatasenderblock.8c6d18af-769c-4ed2-919e...631265
- /data/data/####/.yflurrydatasenderblock.8f5ee0a0-12a2-4751-ba72...33426a
- /data/data/####/.yflurrydatasenderblock.bcbff30f-1d02-4cf6-9ec3...a5fcf1
- /data/data/####/.yflurrydatasenderblock.e6f791f8-cf96-4ddb-8048...11ccd0
- /data/data/####/1024550743-759570940
- /data/data/####/1633031840514.dex
- /data/data/####/1633031840514.dex.flock (deleted)
- /data/data/####/1633031840514.jar
- /data/data/####/1633031840514.tmp
- /data/data/####/AdsConfig.xml
- /data/data/####/Cookies-journal
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml.bak
- /data/data/####/RateThisApp.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/admob.xml
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/com.binbin.flashlight_preferences.xml
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/completed-1663223168911
- /data/data/####/completed-1663223172424
- /data/data/####/completed-1663223173254
- /data/data/####/completed-1663223180739
- /data/data/####/completed-1663223181531
- /data/data/####/completed-1663223190689
- /data/data/####/completed-1663223193264
- /data/data/####/completed-1663223199538
- /data/data/####/completed-1663223200271 (deleted)
- /data/data/####/completed-1663223207222
- /data/data/####/completed-1663223207647 (deleted)
- /data/data/####/completed-1663223220314
- /data/data/####/completed-1663223224034
- /data/data/####/completed-1663223242894
- /data/data/####/currentFile
- /data/data/####/epic.so
- /data/data/####/index
- /data/data/####/installationNum
- /data/data/####/journal.tmp
- /data/data/####/kernel.dex
- /data/data/####/loader.dex
- /data/data/####/metrics_guid
- /data/data/####/packaged.zip
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
- /data/data/####/user_info.sp.xml
- /data/data/####/user_info.sp.xml.bak
Miscellaneous:
Loads the following dynamic libraries:
- epic
- libmain
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5PADDING
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Intercepts notifications.
