Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.232.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.cu####.com:80
- TCP(HTTP/1.1) www.zfr####.com:80
- TCP(HTTP/1.1) 13.2####.34.86:7088
- TCP(TLS/1.0) d####.fl####.com:443
DNS requests:
- d####.fl####.com
- www.cu####.com
- www.zfr####.com
HTTP GET requests:
- www.cu####.com/20170613_images.zip
- www.cu####.com/20180921134505.app-release_V1.0_20180921.zip
HTTP POST requests:
- www.zfr####.com/up.do
Modified file system:
Creates the following files:
- /data/data/####/.DS_Store
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_422N6M5V...R5_280
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/._.DS_Store
- /data/data/####/.yflurrydatasenderblock.01692bfb-3efc-4986-83e0...7945f3
- /data/data/####/.yflurrydatasenderblock.01740463-d62e-4da7-be82...82a2e1
- /data/data/####/.yflurrydatasenderblock.0329dc15-6fe8-4c77-8f6b...6f368c
- /data/data/####/.yflurrydatasenderblock.05dbaa22-2d74-4dea-a83e...0e650f
- /data/data/####/.yflurrydatasenderblock.06ee3bfe-6feb-4533-9ccc...a0eac7
- /data/data/####/.yflurrydatasenderblock.0aac7969-1ec3-42a0-9355...97b5fc
- /data/data/####/.yflurrydatasenderblock.0e515301-aed8-45af-8769...2f6112
- /data/data/####/.yflurrydatasenderblock.0ecb4c2a-70cd-44ff-b6b1...7c360d
- /data/data/####/.yflurrydatasenderblock.0f10c20e-9aaf-486a-a3d5...17b018
- /data/data/####/.yflurrydatasenderblock.10c5a812-7ef5-4c5e-8360...344d8c
- /data/data/####/.yflurrydatasenderblock.13e9eddc-a9e7-47e8-a6b3...477c48
- /data/data/####/.yflurrydatasenderblock.14257bbe-3dad-4d12-ac4c...87ff9f
- /data/data/####/.yflurrydatasenderblock.1b6df739-6613-4ba6-be9d...0ad819
- /data/data/####/.yflurrydatasenderblock.1cbf0450-99f5-4d2b-8eab...386450
- /data/data/####/.yflurrydatasenderblock.205fb88e-77ff-4fc1-ad87...a4c7ba
- /data/data/####/.yflurrydatasenderblock.22793841-ecb7-4a54-b72f...2f502a
- /data/data/####/.yflurrydatasenderblock.233ab5af-c7b8-4842-8dc5...540ec4
- /data/data/####/.yflurrydatasenderblock.2421814c-03ed-4aa9-8c9c...683131
- /data/data/####/.yflurrydatasenderblock.260fb6d5-c37f-4a3a-ad3b...fca666
- /data/data/####/.yflurrydatasenderblock.27fb42fc-739c-40a7-aca9...2a5e38
- /data/data/####/.yflurrydatasenderblock.2a368b71-727c-482b-ae7d...74d0ce
- /data/data/####/.yflurrydatasenderblock.2ba3ff87-8370-4f46-9ccd...b23c78
- /data/data/####/.yflurrydatasenderblock.2ccbb2df-078b-42bd-b075...2521c1
- /data/data/####/.yflurrydatasenderblock.305b075d-1b14-45a3-86ec...c47ad8
- /data/data/####/.yflurrydatasenderblock.312a2bd2-2624-42ca-b02c...07e849
- /data/data/####/.yflurrydatasenderblock.339b2c21-0bb6-4db5-888e...932268
- /data/data/####/.yflurrydatasenderblock.37882863-9a77-4a1d-af4c...89d543
- /data/data/####/.yflurrydatasenderblock.39f3199d-7d9b-441b-a820...a7dcb0
- /data/data/####/.yflurrydatasenderblock.3d840c4e-ddcc-4713-b2fa...abfdde
- /data/data/####/.yflurrydatasenderblock.403c9d65-2796-47ed-aab0...760088
- /data/data/####/.yflurrydatasenderblock.450130fb-e768-48f8-96fb...13faca
- /data/data/####/.yflurrydatasenderblock.46187288-bfa3-4361-bbc4...87baa8
- /data/data/####/.yflurrydatasenderblock.4ab9b24b-c947-4fa0-8503...e00de5
- /data/data/####/.yflurrydatasenderblock.4d667342-83cc-43a3-9522...954159
- /data/data/####/.yflurrydatasenderblock.4dcf3597-4e3c-408d-a05c...f47781
- /data/data/####/.yflurrydatasenderblock.4ef4f08f-2bb4-4fb1-8937...f6a3de
- /data/data/####/.yflurrydatasenderblock.510697ad-b2ea-43f5-8a1e...a6fca0
- /data/data/####/.yflurrydatasenderblock.557367f4-e632-43d2-8680...2e4fdd
- /data/data/####/.yflurrydatasenderblock.560b231c-37d7-4339-a0cc...3c9b4f
- /data/data/####/.yflurrydatasenderblock.581cc1cc-0d4c-46ad-8227...29dd0d
- /data/data/####/.yflurrydatasenderblock.588e33d2-a2e6-47e4-b790...6c61c0
- /data/data/####/.yflurrydatasenderblock.5b4cc646-f346-44af-820d...910fcc
- /data/data/####/.yflurrydatasenderblock.5e739b85-d425-44aa-a8a6...19e705
- /data/data/####/.yflurrydatasenderblock.5e8d08ae-cc38-4997-90c4...d2c679
- /data/data/####/.yflurrydatasenderblock.5fe32d65-5ee3-40f4-9bab...5940e5
- /data/data/####/.yflurrydatasenderblock.615171ba-a46b-40db-9dfa...18e79d
- /data/data/####/.yflurrydatasenderblock.63b2923d-8f05-47ad-b60d...642428
- /data/data/####/.yflurrydatasenderblock.671612ae-509c-42bc-8dff...022955
- /data/data/####/.yflurrydatasenderblock.6823b383-5bfb-4152-828c...eea333
- /data/data/####/.yflurrydatasenderblock.6ef508e8-b422-4e69-8ea8...7ca2c9
- /data/data/####/.yflurrydatasenderblock.6fe585c4-fa42-4e9a-91fe...e46e8a
- /data/data/####/.yflurrydatasenderblock.716bca7b-1670-4e09-9713...cd6db1
- /data/data/####/.yflurrydatasenderblock.7188b40a-3566-4e12-ba52...8ad051
- /data/data/####/.yflurrydatasenderblock.7800ba72-18de-4b80-a085...4e5615
- /data/data/####/.yflurrydatasenderblock.7884a0f0-596a-42f7-b9f8...51e1cc
- /data/data/####/.yflurrydatasenderblock.7996a521-dd17-4e98-9188...e5c5d2
- /data/data/####/.yflurrydatasenderblock.7bdd6308-e1fa-4221-ba22...5bc5cd
- /data/data/####/.yflurrydatasenderblock.7e2c8c25-2dcc-4045-b493...7f9912
- /data/data/####/.yflurrydatasenderblock.7e496962-1665-428c-974c...61cb59
- /data/data/####/.yflurrydatasenderblock.7e99515b-e70f-480e-968f...7c814f
- /data/data/####/.yflurrydatasenderblock.7fdb4b0c-0bea-4475-8edb...c55c3e
- /data/data/####/.yflurrydatasenderblock.8292919d-1c6d-4be2-b9e0...7d9662
- /data/data/####/.yflurrydatasenderblock.84238ea4-b135-417b-b7d6...29a455
- /data/data/####/.yflurrydatasenderblock.862753ca-af57-4ebb-bb72...afbeb7
- /data/data/####/.yflurrydatasenderblock.87bbce80-8993-4d82-95cf...25f6cc
- /data/data/####/.yflurrydatasenderblock.8916dcce-ef99-4f71-92f4...419f00
- /data/data/####/.yflurrydatasenderblock.89604810-6258-43e3-bd05...e2572b
- /data/data/####/.yflurrydatasenderblock.8973ad66-0a16-4c6a-8731...b64f40
- /data/data/####/.yflurrydatasenderblock.89a12c09-0fe5-4395-b400...6975e0
- /data/data/####/.yflurrydatasenderblock.92f58633-4290-497b-870a...8fa94e
- /data/data/####/.yflurrydatasenderblock.98edb965-2801-428e-a67b...8ed36a
- /data/data/####/.yflurrydatasenderblock.9986e0e0-98ab-42b2-bb5e...d70c45
- /data/data/####/.yflurrydatasenderblock.9b1db992-aed9-42fa-bcef...c7b2d3
- /data/data/####/.yflurrydatasenderblock.9d974f19-0d14-4da7-af2c...2449c2
- /data/data/####/.yflurrydatasenderblock.9dfb2723-3132-4ddc-8200...09d3fe
- /data/data/####/.yflurrydatasenderblock.9f425ae5-aaed-4678-b4d9...9f2a3d
- /data/data/####/.yflurrydatasenderblock.a136beec-cfc7-4055-8e7d...5901da
- /data/data/####/.yflurrydatasenderblock.a13ebc40-3dfe-4745-bf81...d3bb9c
- /data/data/####/.yflurrydatasenderblock.a160f26e-f83d-4872-99d5...ae42a3
- /data/data/####/.yflurrydatasenderblock.a4360c96-b34c-4cc9-abd6...c56737
- /data/data/####/.yflurrydatasenderblock.a500a5eb-1c62-4abb-b237...82bece
- /data/data/####/.yflurrydatasenderblock.aa5afb5a-0e7f-46e4-a58e...5b3625
- /data/data/####/.yflurrydatasenderblock.aae7f7be-e807-4cea-8cd9...1697d9
- /data/data/####/.yflurrydatasenderblock.ac1d735b-3e57-4806-9b2f...f58c38
- /data/data/####/.yflurrydatasenderblock.ac8a6a1c-bc1d-4d73-a1ea...adb277
- /data/data/####/.yflurrydatasenderblock.ad44c9a6-8adb-4dde-9448...dbb11c
- /data/data/####/.yflurrydatasenderblock.ae6694e0-2536-430f-961f...b409d8
- /data/data/####/.yflurrydatasenderblock.aff6402f-b106-4984-af5b...b8d87c
- /data/data/####/.yflurrydatasenderblock.b47e196e-facf-4bcc-ad9b...7ef3cb
- /data/data/####/.yflurrydatasenderblock.b6e701ce-2aff-4aee-b9dd...120b4c
- /data/data/####/.yflurrydatasenderblock.bbc1ebdc-8c65-493f-b5a6...ad6971
- /data/data/####/.yflurrydatasenderblock.bc9e2efc-e390-451f-86c9...8c34dc
- /data/data/####/.yflurrydatasenderblock.bd86d1a7-9317-4246-b942...fb62f7
- /data/data/####/.yflurrydatasenderblock.bef9f4f7-d582-4e42-b0ef...609412
- /data/data/####/.yflurrydatasenderblock.c15e94d4-efbf-4b76-9aff...edcc80
- /data/data/####/.yflurrydatasenderblock.c174245f-2a04-4e1b-8d04...6d9d1b
- /data/data/####/.yflurrydatasenderblock.c42524cf-fff6-4c42-a71c...682266
- /data/data/####/.yflurrydatasenderblock.cafe574d-e2a6-48f2-b3f1...ddebcb
- /data/data/####/.yflurrydatasenderblock.cf7c2fa5-4e7c-4025-9de1...6d9249
- /data/data/####/.yflurrydatasenderblock.d00571bc-10d7-4986-b470...5d27c2
- /data/data/####/.yflurrydatasenderblock.d0c44200-ed49-4831-a9af...ccacf5
- /data/data/####/.yflurrydatasenderblock.d3a320b2-5060-4c68-a0e9...7c51c4
- /data/data/####/.yflurrydatasenderblock.d5da1886-8de1-411f-8c85...307196
- /data/data/####/.yflurrydatasenderblock.d934fce2-9186-477d-9689...be557a
- /data/data/####/.yflurrydatasenderblock.dd0611a6-0745-449f-847d...d966e4
- /data/data/####/.yflurrydatasenderblock.de7d552d-440b-4ca5-a710...f35f6e
- /data/data/####/.yflurrydatasenderblock.e0fd34e1-c8fa-4463-9324...3d9bb4
- /data/data/####/.yflurrydatasenderblock.e2bcf145-c97f-4c76-a6cf...d1bcb2
- /data/data/####/.yflurrydatasenderblock.e9afa919-0159-4655-b82d...603cf5
- /data/data/####/.yflurrydatasenderblock.eb0269c1-5c89-48ac-af4f...d0a7d8
- /data/data/####/.yflurrydatasenderblock.ee17f473-1db0-4abf-9820...1b0caf
- /data/data/####/.yflurrydatasenderblock.ee8b9b0d-a933-4b71-a7f1...dcf900
- /data/data/####/.yflurrydatasenderblock.eefd3e77-e9f6-4ff0-bdab...58621c
- /data/data/####/.yflurrydatasenderblock.f2122cd6-5064-4923-b2c1...9370e2
- /data/data/####/.yflurrydatasenderblock.f2661649-13e3-45b5-ac7e...b1682c
- /data/data/####/.yflurrydatasenderblock.f30367a8-75dd-4a4d-8141...5754b7
- /data/data/####/.yflurrydatasenderblock.f3da4b86-5aa6-4e4f-9eba...13af2b
- /data/data/####/.yflurrydatasenderblock.f61d45a2-5edf-421e-87b5...52a3a0
- /data/data/####/.yflurrydatasenderblock.f731baa9-b4de-428d-871f...04c9a3
- /data/data/####/.yflurrydatasenderblock.fed81586-ba65-4d68-a416...95851d
- /data/data/####/T001other_config.xml
- /data/data/####/T001up_config.xml
- /data/data/####/ad_tag.png
- /data/data/####/ad_tag1.png
- /data/data/####/backw
- /data/data/####/bg_touch.png
- /data/data/####/d.dex
- /data/data/####/d.zip
- /data/data/####/dtemp.apk
- /data/data/####/ic_del.png
- /data/data/####/ic_gp_tv.png
- /data/data/####/icon_add.png
- /data/data/####/icon_btn_more.png
- /data/data/####/icon_down_circle.png
- /data/data/####/images.zip
- /data/data/####/installationNum
- /data/data/####/m_cfg.xml
- /data/data/####/my.db
- /data/data/####/my.db-journal
- /data/data/####/ob.dex
- /data/data/####/ob.zip
- /data/data/####/sp_click_cf.xml
- /data/data/####/t_ini.xml
- /data/data/####/webview.db
- /data/data/####/webview.db-journal
- /data/media/####/pid
Miscellaneous:
Executes next shell scripts:
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.zon.qoo.MS
- chmod 777 <Package Folder>/backw
- dd if=<Package Folder>/lib/libbackw.so of=<Package Folder>/backw
- sh
Loads the following dynamic libraries:
- backw
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.