Technical information
Malicious functions:
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) js.a####.ir:80
- TCP(HTTP/1.1) srv.magneta####.com:80
- TCP(HTTP/1.1) cloudfr####.amazo####.com:80
- TCP(HTTP/1.1) m####.sarp####.com:80
- TCP(HTTP/1.1) ada983f####.pro####.ewr5####.####.net:80
- TCP(HTTP/1.1) trust####.en####.ir:80
- TCP(HTTP/1.1) a9ce0b4####.pro####.c####.####.net:80
- TCP(HTTP/1.1) a8b3fa5####.pro####.j####.####.net:80
- TCP(HTTP/1.1) sdk.appb####.com:80
- TCP(HTTP/1.1) a38eacf####.pro####.n####.####.net:80
- TCP(HTTP/1.1) sto####.beyt####.com:80
- TCP(HTTP/1.1) www.beyt####.com:80
- TCP(TLS/1.0) api.tap####.ir:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) cer####.alexame####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) srv.magneta####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) onesi####.com:443
- TCP(TLS/1.0) js.a####.ir:443
- TCP(TLS/1.0) p####.tap####.ir:443
- TCP(TLS/1.0) d31qbv1####.cloudf####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) 1####.217.17.78:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) www.go####.nl:443
DNS requests:
- a####.ir
- a38eacf####.pro####.n####.####.net
- a8b3fa5####.pro####.j####.####.net
- a9ce0b4####.pro####.c####.####.net
- ada983f####.pro####.ewr5####.####.net
- api.tap####.ir
- cer####.alexame####.com
- cloudfr####.amazo####.com
- d####.fl####.com
- d31qbv1####.cloudf####.net
- js.a####.ir
- m####.sarp####.com
- onesi####.com
- p####.tap####.ir
- s####.g.doublec####.net
- sdk.appb####.com
- srv.magneta####.com
- sto####.beyt####.com
- trust####.en####.ir
- www.beyt####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.googlet####.com
HTTP GET requests:
- a38eacf####.pro####.n####.####.net/test.png
- a8b3fa5####.pro####.j####.####.net/test.png
- a9ce0b4####.pro####.c####.####.net/test.png
- ada983f####.pro####.ewr5####.####.net/test.png
- cloudfr####.amazo####.com/x.png
- js.a####.ir/adad-client/js/?device=####&androidid=####&token=####&networ...
- js.a####.ir/static/images/skip-load.gif
- js.a####.ir/static/images/video_mute_button.png
- js.a####.ir/static/images/video_skip_button.png
- m####.sarp####.com/images/9706/large_97-06-c07-589.jpg
- m####.sarp####.com/images/9706/large_97-06-c23-747.png
- m####.sarp####.com/images/9706/large_hq-mansouriansister-elhamcharkhande...
- m####.sarp####.com/images/9706/large_mq-alimotahari-critic-pride970608.jpg
- m####.sarp####.com/images/9706/large_mq-married-kimiaalizade-hamedmadanc...
- m####.sarp####.com/images/9706/large_mq-practice-sport-behnooshtabatabai...
- srv.magneta####.com/shared/shadow.9.png
- sto####.beyt####.com/images/banners/108mobdrtajbakhshb002.gif
- sto####.beyt####.com/images/banners/108mobjavaherbazar010.gif
- sto####.beyt####.com/images/banners/108mobkhabshop001.gif
- sto####.beyt####.com/images/banners/108moblachinm0073.gif
- sto####.beyt####.com/images/banners/108mobmatin014.gif
- sto####.beyt####.com/images/banners/108mobmybabyproduct005.gif
- sto####.beyt####.com/images/banners/108mobpsalamat14.gif
- sto####.beyt####.com/images/banners/1mobghasedak.gif
- sto####.beyt####.com/images/banners/hafez.jpg
- sto####.beyt####.com/images/banners/mobchicken-device1.gif
- sto####.beyt####.com/images/banners/mobican0012.gif
- sto####.beyt####.com/images/banners/moblahzeakhar001.gif
- sto####.beyt####.com/images/banners/mobsamseir003.gif
- sto####.beyt####.com/images/banners/mobvajehpardaz3.gif
- sto####.beyt####.com/images/banners/prices2.png
- sto####.beyt####.com/images/services/health.png
- sto####.beyt####.com/images/services/mt3100.jpg
- sto####.beyt####.com/images/services/sleep.jpg
- trust####.en####.ir/logo.aspx?id=####&p=####
- www.beyt####.com/
- www.beyt####.com/?m=####
- www.beyt####.com/about-us.html
- www.beyt####.com/about-us.html?m=####
- www.beyt####.com/ads/images/slide1.jpg
- www.beyt####.com/ads/images/slide2.jpg
- www.beyt####.com/cache/template/gzip.php?jquery-####
- www.beyt####.com/cache/template/gzip.php?templat####
- www.beyt####.com/cache/template/gzip.php?widgetk####
- www.beyt####.com/enamad.html
- www.beyt####.com/enamad.html?m=####
- www.beyt####.com/images/beytheme/infoEmail.png
- www.beyt####.com/images/events/default/1.png
- www.beyt####.com/images/events/default/2.png
- www.beyt####.com/images/events/default/glass.png
- www.beyt####.com/images/events/default/h.png
- www.beyt####.com/images/events/default/larr.png
- www.beyt####.com/images/events/default/menum.png
- www.beyt####.com/images/events/default/mhome.png
- www.beyt####.com/images/events/default/rarr.png
- www.beyt####.com/images/events/default/v1.png
- www.beyt####.com/images/events/default/v2.png
- www.beyt####.com/images/stories/news/97/06/9706-55t883.jpg
- www.beyt####.com/media/widgetkit/widgets/mediaplayer/mediaelement/mediae...
- www.beyt####.com/media/widgetkit/widgets/slideset/js/slideset.js?_=####
- www.beyt####.com/media/widgetkit/widgets/slideshow/js/slideshow.js?_=####
- www.beyt####.com/modules/mod_jw_srfr/tmpl/default/css/template.css
- www.beyt####.com/modules/mod_raxo_allmode/tmpl/allmode-portal/allmode-po...
- www.beyt####.com/modules/mod_raxo_allmode/tools/tb.php?src=####&w=####&h...
- www.beyt####.com/news/international/tnews11007113.html
- www.beyt####.com/news/international/tnews11007113.html?m=####
- www.beyt####.com/online.php
- www.beyt####.com/online.php?m=####
- www.beyt####.com/templates/bey/favicon.ico
- www.beyt####.com/templates/bey/favicon.ico?m=####
HTTP POST requests:
- sdk.appb####.com/api/pb?action=####
- srv.magneta####.com/api/magnet/v3/app/InitialConfiguration
Modified file system:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_7SSRQ64V...BP_258
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.yflurrydatasenderblock.5cb13d02-ed42-4ae2-bfef...892b56
- /data/data/####/.yflurrydatasenderblock.a12a4501-9c2d-4b5a-a876...033f2f
- /data/data/####/.yflurryreport.-35d4ce84519c98af
- /data/data/####/APP_ID_GROUP.xml
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/GTPlayerPurchases.xml
- /data/data/####/LOCATION_SHARED_PREFS.xml
- /data/data/####/MultiDex.lock
- /data/data/####/OneSignal.db-journal
- /data/data/####/OneSignal.xml
- /data/data/####/TapseelPreferences.xml
- /data/data/####/UserInfo.xml
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/ab_pref_int.xml
- /data/data/####/ab_sdk_pref.xml
- /data/data/####/adadSharedPreferences.xml
- /data/data/####/bkoodb.ttf
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/com.appbrain.ping
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/index
- /data/data/####/installationNum
- /data/data/####/multidex.version.xml
- /data/data/####/mysqlite.db
- /data/data/####/mysqlite.db-journal
- /data/data/####/pref.db
- /data/data/####/pref.db-journal
- /data/data/####/tap.db
- /data/data/####/tap.db-journal
- /data/data/####/unsent_requests
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/bannerConfirmLandscape
- /data/media/####/bannerConfirmPortrait
- /data/media/####/close
- /data/media/####/magnetLogo
- /data/media/####/mute
- /data/media/####/replay
- /data/media/####/shadow.9.png
- /data/media/####/sound
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5PAdding
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5PAdding
- AES-CBC-PKCS5Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
