Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.14.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) f2.doodlem####.com:80
- TCP(HTTP/1.1) d3jhh8v####.cloudf####.net:80
- TCP(HTTP/1.1) googl####.g.doublec####.net:80
- TCP(HTTP/1.1) feat####.perfect####.com:8080
- TCP(HTTP/1.1) xi.ai.xa####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) d239g0z####.cloudf####.net:80
- TCP(HTTP/1.1) newfeat####.perfect####.com:80
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
DNS requests:
- d####.fl####.com
- d239g0z####.cloudf####.net
- d3jhh8v####.cloudf####.net
- f2.doodlem####.com
- feat####.perfect####.com
- googl####.g.doublec####.net
- newfeat####.perfect####.com
- ssl.google-####.com
- www.google-####.com
- xi.ai.xa####.com
HTTP GET requests:
- d239g0z####.cloudf####.net/featurescreen/MotoHighwayRider.jpg
- d239g0z####.cloudf####.net/icons/icon_MotoHighwayRider.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_3dbowling.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_amazingrun.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_archerymaster3d.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_autotheftgangsters.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_bikeracing3d.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_citysmasher.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_explorationcraft.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_fanaticalbasketball.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_fanaticalfootball.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_gunshipstrike.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_prisonescape.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_punchboxing3d.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_realbaseball.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_realbikeracing.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_rocketcarball.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_skyfighters.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_snipershot.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_surgerymaster.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_tattoomaster.png
- d3jhh8v####.cloudf####.net/moregames_files/icon_westgunfighter.png
- feat####.perfect####.com:8080/moregames/bg.png
- feat####.perfect####.com:8080/moregames/free_button.png
- feat####.perfect####.com:8080/moregames/index.html
- googl####.g.doublec####.net/mads/static/sdk/native/sdk-core-v40.js
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...
- xi.ai.xa####.com/t3
HTTP POST requests:
- f2.doodlem####.com/feature_server/fullScreen/get.php
- f2.doodlem####.com/feature_server/geo-ip/test.php
- newfeat####.perfect####.com/featureview/getfeatureview/
Modified file system:
Creates the following files:
- /data/data/####/.FlurrySenderIndex.info.AnalyticsData_9QGBQTV23...7B_172
- /data/data/####/.FlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.dmgames_prefs.xml
- /data/data/####/.flurryagent.d24a7eb
- /data/data/####/.flurrydatasenderblock.14352082-256d-4eac-9261-...55c586
- /data/data/####/.flurrydatasenderblock.ba7f55cb-1e60-4001-8bfe-...89646f
- /data/data/####/.hockey.xml
- /data/data/####/1152168c.jar
- /data/data/####/1526531157831.log
- /data/data/####/1526531165871.log
- /data/data/####/1526531173957.log
- /data/data/####/1526531183504.log
- /data/data/####/1526531206962.log
- /data/data/####/21b5e.xml
- /data/data/####/ads-2015641879.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/http_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/aHR0cDovL2QyMzlnMHo2N2pjdGVkLmNsb3VkZnJvbnQubm...5qcGc=
- /data/media/####/aHR0cDovL2QyMzlnMHo2N2pjdGVkLmNsb3VkZnJvbnQubm...5wbmc=
Miscellaneous:
Loads the following dynamic libraries:
- gdx
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
