Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.65.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP sp1.sz####.com:9701
- TCP sp2.sz####.com:9703
- TCP sp2.sz####.com:9702
DNS requests:
- r.sz####.com
- sp1.sz####.com
- sp2.sz####.com
- sp3.sz####.com
Modified file system:
Creates the following files:
- <Package Folder>/databases/fs_download.db-journal
- <Package Folder>/files/j.jar
- <Package Folder>/shared_prefs/common_pre.xml
- <Package Folder>/shared_prefs/fsappnfo_pre.xml
- <Package Folder>/shared_prefs/fsconf_pre.xml
- <Package Folder>/shared_prefs/fstrategy_pre.xml
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
