Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.3.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) zi.si.07####.cn:80
DNS requests:
- sdkco####.ad.xi####.com
- zi.si.07####.cn
HTTP POST requests:
- zi.si.07####.cn/sz/313f/q83
Modified file system:
Creates the following files:
- /data/data/####/_cszs_.xml
- /data/data/####/_mszs_r.xml
- /data/data/####/_vszs_.xml
- /data/data/####/first_time.xml
- /data/data/####/updater.xml
- /data/data/####/xfgg.drzgj.jar
- /data/data/####/zs.jar
- /data/media/####/.nomedia
- /data/media/####/crash-2018_05_16_06_59_19.txt
- /data/media/####/crash-2018_05_16_06_59_20.txt
- /data/media/####/crash-2018_05_16_06_59_32.txt
- /data/media/####/crash-2018_05_16_06_59_33.txt
- /data/media/####/crash-2018_05_16_06_59_34.txt
- /data/media/####/crash-2018_05_16_06_59_36.txt
- /data/media/####/crash-2018_05_16_06_59_37.txt
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
