Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.14.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.er####.com:80
- TCP(HTTP/1.1) idu####.qini####.com:80
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) regi####.xm####.xi####.com:443
DNS requests:
- api.er####.com
- ci.hi.c####.####.cn
- img####.er####.com
- regi####.xm####.xi####.com
- ssl.google-####.com
HTTP GET requests:
- api.er####.com/api/v1/album_categories/4/albums?channel=####&offset=####...
- api.er####.com/api/v1/album_categories?channel=####&offset=####&limit=##...
- api.er####.com/api/v1/albums/home_recommended?channel=####&offset=####&l...
- api.er####.com/api/v1/banners?channel=####
- api.er####.com/api/v1/home_items?channel=####&offset=####&limit=####
- idu####.qini####.com/album/10_1492578783440.png
- idu####.qini####.com/album/120_20170414114441_l4zl.jpg
- idu####.qini####.com/album/175_1506333512989.png
- idu####.qini####.com/album/1_20170414114409_efjg.jpg
- idu####.qini####.com/album/225_1506045647794.png
- idu####.qini####.com/album/24_1492578803640.png
- idu####.qini####.com/album/28_1492578758731.png
- idu####.qini####.com/album/33_1493977102106.png
- idu####.qini####.com/album/375_1506045623572.png
- idu####.qini####.com/album/398_1524895210589.png
- idu####.qini####.com/album/97_20170414114434_zgfc.jpg
- idu####.qini####.com/audio_playlist/103_20170413112648_g9du.jpg
- idu####.qini####.com/audio_playlist/109_20170413112649_nfts.png
- idu####.qini####.com/audio_playlist/184_20170413112650_mad7.png
- idu####.qini####.com/audio_playlist/192_20170413112652_qti3.png
- idu####.qini####.com/audio_playlist/194_20170413112652_rkzn.png
- idu####.qini####.com/audio_playlist/195_20170413112652_k9jj.jpg
- idu####.qini####.com/audio_playlist/198_20170413112653_othd.png
- idu####.qini####.com/audio_playlist/64747507822_1493799045924.jpg
- idu####.qini####.com/audio_playlist/77294775510_1493795959461.jpg
- idu####.qini####.com/video/11756_1508221002565.png
- idu####.qini####.com/video/11777_1508303319421.png
- idu####.qini####.com/video/40_1495179422720.jpg
- idu####.qini####.com/video/4632_1508220972500.png
- idu####.qini####.com/video/4726_20170413121158_j3ri.jpg
- idu####.qini####.com/video/6361_1495179605129.jpg
- idu####.qini####.com/videos/11234_20170425171923.jpg
HTTP POST requests:
- api.er####.com/getAdSetting
- api.er####.com/getAdStatus
- api.er####.com/getAudioCategoryPlaylist
- api.er####.com/getAudioPlaylistByAcid
- api.er####.com/getAudioRecommendPlaylist
- api.er####.com/getBootpage
- api.er####.com/getLatestAudioPlayList
- api.er####.com/getRefererKey
- api.er####.com/getSlide
Modified file system:
Creates the following files:
- /data/data/####/-1880369690-1650261843
- /data/data/####/-1880369690-725059313
- /data/data/####/-1880369690-790373348
- /data/data/####/-1880369690-91575277
- /data/data/####/-1880369690-981776927
- /data/data/####/-18803696901077986193
- /data/data/####/-1880369690185261625
- /data/data/####/-188036969062946168
- /data/data/####/-1880369690925111415
- /data/data/####/-2059490746-1722052698
- /data/data/####/-2807708831404373239
- /data/data/####/-5895319691472761591
- /data/data/####/-722612501-1122297024
- /data/data/####/-722612501-1505195379
- /data/data/####/-722612501-777348304
- /data/data/####/-7226125011541777607
- /data/data/####/-7226125011893582431
- /data/data/####/-722612501238361898
- /data/data/####/-722612501490675278
- /data/data/####/-926150954-1622579856
- /data/data/####/-926150954-2031656488
- /data/data/####/078aebf181a490916419151e2f7cb42a.0.tmp
- /data/data/####/078aebf181a490916419151e2f7cb42a.1.tmp
- /data/data/####/0a8afb4790f4ab4f91f3acf556078952060f67c6bb67294....0.tmp
- /data/data/####/0cad66aff55b88a37992febb5c468dbdb7f1f8046303c38....0.tmp
- /data/data/####/0d3c9cddd7d8c7b968453902858ba95236145fce15e6628....0.tmp
- /data/data/####/10077288381186975279
- /data/data/####/1145962641-1545633383
- /data/data/####/11459632891858737123
- /data/data/####/11651036011098409693
- /data/data/####/1165103601617891430
- /data/data/####/15261446431422966935
- /data/data/####/1759096154-1354009716
- /data/data/####/1837808191767033346
- /data/data/####/1838081872-1141869940
- /data/data/####/1838081872-1665390863
- /data/data/####/18380818721323980651
- /data/data/####/1838081872523162375
- /data/data/####/26f9174a2827b324221109f4ff2f8fb3739573fa0d0f356....0.tmp
- /data/data/####/2f9dd94ce33b6c69d608c8c66bc80757dda38cff75c8282....0.tmp
- /data/data/####/3701db72e764f9159ca4a1c65dac3094fbab6e716e7ded7....0.tmp
- /data/data/####/3960803z.jar
- /data/data/####/3975097z.jar
- /data/data/####/3aafdfec0dfc11a6bf646906ba3035b9ae182effb8aee5c....0.tmp
- /data/data/####/3e8f31437f7d90c475abca4ff1539c6f04d5c76475f2922....0.tmp
- /data/data/####/40979834afec5d686136add7919ab9f2218a488ee436351....0.tmp
- /data/data/####/43bb0ad9860ff7eda2a5810f72c2aec5027feb83f27ee8d....0.tmp
- /data/data/####/454aad62a23c043c207329cac57bc96359c83d38d8a4fcf....0.tmp
- /data/data/####/5672f3da80c15ada007902568ae21b7aac4ccdaf05e6f65....0.tmp
- /data/data/####/58fd63b703bde9ab244b54f15e124a27cb5c54d88fe026e....0.tmp
- /data/data/####/5e35afe584bfd6148ecdccbd196de6706a19ad078ccfc77....0.tmp
- /data/data/####/6443999162dae3a1c39f947e42a7eeb44a0849295d511ec....0.tmp
- /data/data/####/771981f7067dfecd23f59718519644cd5d64d98d5d4e731....0.tmp
- /data/data/####/7b83643421ff099692180e1101f8e9837a653ddfb068db4....0.tmp
- /data/data/####/865add579431f3ab66add3d21bebfc4f75f04c5da624fd6....0.tmp
- /data/data/####/8b47c10636b0fb0db60a9442aabf829d.0.tmp
- /data/data/####/8b47c10636b0fb0db60a9442aabf829d.1.tmp
- /data/data/####/8de352c0f77610c5c046146c28e19982b1ecf4d2151d31f....0.tmp
- /data/data/####/9974a294916bb819a2b85907206dce92cf370bb4d6afdf0....0.tmp
- /data/data/####/9b8c2edfc8f9365aaa40f13460af68c0.0.tmp
- /data/data/####/9b8c2edfc8f9365aaa40f13460af68c0.1.tmp
- /data/data/####/DeviceUtils.xml
- /data/data/####/a066ec967d0b734f74571bb89e3e0351439ff0d6822263c....0.tmp
- /data/data/####/a7a891ae14ef3c03370579fe803a2c2ba12e1d0a90536f5....0.tmp
- /data/data/####/b3f81f09325bed3d407e09678635b103.0.tmp
- /data/data/####/b3f81f09325bed3d407e09678635b103.1.tmp
- /data/data/####/b6691.xml
- /data/data/####/b6691.xml.bak
- /data/data/####/b8578b5ed18dc58946bb0e229c25e888fe8be39f130d7ba....0.tmp
- /data/data/####/babysong-database.db-journal
- /data/data/####/c6349e16e469318bc20f84c96dabfdbb2c259388513e98b....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/d7a38a3daea1943b50133fc75502b3bd3e3893e003abd32....0.tmp
- /data/data/####/e5a379413a246d7cec1b01a47a6d062b852519bbd0a15b2....0.tmp
- /data/data/####/e63fa795145dd14dc96d68b1a13831cc3ce8c442037ce31....0.tmp
- /data/data/####/e9c7b789db61e0a78d1b25a8b11fadaab539625bbd475fe....0.tmp
- /data/data/####/ec201b9b7c0ba8af9c7da6f270d239d7.0.tmp
- /data/data/####/ec201b9b7c0ba8af9c7da6f270d239d7.1.tmp
- /data/data/####/ef3190f5e3257b8e684f7677b841a0c34efcc76368a0ba0....0.tmp
- /data/data/####/gaClientId
- /data/data/####/geofencing.db
- /data/data/####/geofencing.db-journal
- /data/data/####/google_analytics_v2.db-journal
- /data/data/####/idremao.app.xml
- /data/data/####/idremao.user.xml
- /data/data/####/journal.tmp
- /data/data/####/mipush.xml
- /data/data/####/mipush_extra.xml
- /data/data/####/mobclick_agent_cached_com.ling.ergedaquan20380
- /data/data/####/multidex.version.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about APN settings.
Gains access to information about accounts (Google, Facebook, etc.) registered on the device.
Displays its own windows over windows of other applications.
