Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.3.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) promo####.dam####.com:80
- TCP(HTTP/1.1) googl####.g.doublec####.net:80
- TCP(HTTP/1.1) ji.oi.jos####.cn:80
- TCP(TLS/1.0) googl####.g.doublec####.net:443
DNS requests:
- googl####.g.doublec####.net
- ji.oi.jos####.cn
- promo####.dam####.com
HTTP GET requests:
- googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40-load...
- googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40.html
HTTP POST requests:
- ji.oi.jos####.cn/1e1a/08d43/q08
- promo####.dam####.com/app/list/
File system changes:
Creates the following files:
- /data/data/####/00f6c2849a2d9d7d_0
- /data/data/####/031493ae72850052_0
- /data/data/####/04b7ff11249aa23a_0
- /data/data/####/05f4bb4f33a83998_0
- /data/data/####/0acbb9a7cd33bcbb_0
- /data/data/####/100229da2b71f8d1_0
- /data/data/####/18f812e77f4b4d87_0
- /data/data/####/1e7da4f50f094f36_0
- /data/data/####/1eef61c76c114fb6_0
- /data/data/####/22c2d45b668625ed_0
- /data/data/####/252d9d2b5915e57b_0
- /data/data/####/28bb9b6ba334740b_0
- /data/data/####/31929ad47575bd21_0
- /data/data/####/31a38ea634c149fb_0
- /data/data/####/31fb40873488e317_0
- /data/data/####/37a8f4899c903021_0
- /data/data/####/389b2eb993ec14b5_0
- /data/data/####/3e70906075180b69_0
- /data/data/####/3f89b10ad197db42_0
- /data/data/####/403422862df8d90f_0
- /data/data/####/40a97a5f71a5cb84_0
- /data/data/####/425c5282351987d3_0
- /data/data/####/42ffb71c458aada7_0
- /data/data/####/459e19a56bc256ad_0
- /data/data/####/48889facd046cd63_0
- /data/data/####/49932eb601668452_0
- /data/data/####/4e76d45978f5819a_0
- /data/data/####/53bea4be6d00330b_0
- /data/data/####/55077bcd0b5c4be9_0
- /data/data/####/55637322b0202bd7_0
- /data/data/####/571b628f7573222d_0
- /data/data/####/5808021a5cffc191_0
- /data/data/####/5b3d80ca97ee8de4_0
- /data/data/####/5c162c3a66bdd40d_0
- /data/data/####/5eed5b3fe686ecde_0
- /data/data/####/723b08db8af80b53_0
- /data/data/####/7b83d196e40b8d93_0
- /data/data/####/7ff850a6914ec4e2_0
- /data/data/####/8287d1433f167bae_0
- /data/data/####/841b979e55f17eae_0
- /data/data/####/8fa680326eb4fd5a_0
- /data/data/####/900bad5675180b3d_0
- /data/data/####/92b66008f6467095_0
- /data/data/####/92d71b08ec571106_0
- /data/data/####/94c5c82bc6379754_0
- /data/data/####/9b97d79bfdeef672_0
- /data/data/####/9c74e5e77c5df30e_0
- /data/data/####/9c946a748f24a310_0
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/Cookies
- /data/data/####/Cookies-journal
- /data/data/####/Web Data
- /data/data/####/Web Data-journal
- /data/data/####/a5a87dd41be0b57a_0
- /data/data/####/admob.xml
- /data/data/####/ads1055718877.jar
- /data/data/####/ads1418390475.jar
- /data/data/####/ads271961495.jar
- /data/data/####/ads920668916.jar
- /data/data/####/ads957501459.jar
- /data/data/####/b43bb199464955e2_0
- /data/data/####/b88f3794826987d4_0
- /data/data/####/ba87136be60125c1_0
- /data/data/####/bda197a7b7fd3e0f_0
- /data/data/####/c04e98125accf469_0
- /data/data/####/c5ddc91e.xml
- /data/data/####/com.nfwruj.dex (deleted)
- /data/data/####/com.nfwruj.jar
- /data/data/####/d0d1386ee05f4b50_0
- /data/data/####/d2f67fdc198d223b_0
- /data/data/####/d52b27570b08ffdf_0
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/db70a00c384e3198_0
- /data/data/####/de0817d314b56582_0
- /data/data/####/ee1319e424f24fc5_0
- /data/data/####/f2a66c9bf2ec1686_0
- /data/data/####/f2e0786c8923eaab_0
- /data/data/####/f8739551ffbac00f_0
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/fc239f3c000f7886_0
- /data/data/####/fc48e1853a04c5d8_0
- /data/data/####/fcba21d3ba2cb629_0
- /data/data/####/gaClientId
- /data/data/####/gameSave1
- /data/data/####/gameSet
- /data/data/####/http_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/param.xml
- /data/data/####/roge.file.current.xml
- /data/data/####/roge.file.recod.xml
- /data/data/####/roge.file.xml
- /data/data/####/sleep.xml
- /data/data/####/the-real-index
- /data/data/####/thumb.apk
- /data/data/####/thumb.dex (deleted)
- /data/data/####/webview.db
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- game
- zlibs
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
