Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Internet:
- Android.Xiny.20
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.k####.nl:80
- TCP(HTTP/1.1) img.cool####.cn:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) www.brainst####.com:80
- TCP(HTTP/1.1) r.eli####.cn:80
- TCP(HTTP/1.1) yes.yuchan####.com.cn:80
- TCP(SSL/3.0) www.k####.nl:443
- TCP(TLS/1.0) www.k####.nl:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) www.googlea####.com:443
DNS requests:
- d####.fl####.com
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- img.cool####.cn
- pag####.googles####.com
- pv.s####.com
- r.eli####.cn
- ssl.google-####.com
- tpc.googles####.com
- www.brainst####.com
- www.googlea####.com
- www.k####.nl
- yes.yuchan####.com.cn
HTTP GET requests:
- gdv.a.s####.com/cityjson?ie=####
- img.cool####.cn/2011/gou.jar
- www.k####.nl/specials/ebikelimburg?gclid=####
- yes.yuchan####.com.cn/k2?protocol=####&version=####&cid=####
HTTP POST requests:
- r.eli####.cn/k1?requestId=####&g=####&ua=####
- www.brainst####.com/APPDeveloper/AgeFace/adzlist.php
File system changes:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_G79PNJVK...RJ_236
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.yflurrydatasenderblock.37a52dab-1d9c-4ec8-9274...59b0d6
- /data/data/####/.yflurrydatasenderblock.7a7e6dc6-8227-469f-891f...a19dcd
- /data/data/####/.yflurryreport.-37cfa7dc1aa591a8
- /data/data/####/1478228129219.dex
- /data/data/####/1478228129219.jar
- /data/data/####/1478228129219.tmp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/NPED.xml
- /data/data/####/W_Key.xml
- /data/data/####/a.xml
- /data/data/####/admob.xml
- /data/data/####/com.age.jxface.make.me.old.dex
- /data/data/####/com.age.jxface.make.me.old.dex (deleted)
- /data/data/####/com.age.jxface.make.me.old_preferences.xml
- /data/data/####/com.age.jxface.make.me.old_preferences.xml.bak
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/st.xml
- /data/data/####/temp.dex
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/4.8_gou.jar.tmp
- /data/media/####/restime.dat
Miscellaneous:
Loads the following dynamic libraries:
- ela
- guaa
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.
