Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.1007.origin
- Android.DownLoader.968.origin
- Android.Triada.4567
- Android.Triada.510.origin
- Android.Triada.546.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) s####.bn####.com:16002
- TCP(HTTP/1.1) o####.cz####.com:10051
- TCP(HTTP/1.1) y####.k8####.com:80
- TCP(HTTP/1.1) ua####.f6####.com:80
- TCP(HTTP/1.1) t####.c8####.com:13002
- TCP(HTTP/1.1) bi####.bi####.com:10238
- TCP(HTTP/1.1) s####.bn####.com:14002
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) cdn.tab####.com:443
- TCP(TLS/1.0) 1####.250.179.170:443
- TCP(TLS/1.0) h####.bi####.com:443
- TCP(TLS/1.0) 2####.58.214.14:443
- TCP(TLS/1.0) 1####.250.179.142:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) res.noc####.cc:443
- TCP(TLS/1.0) jsc.m####.com:443
- TCP(TLS/1.0) sb.scoreca####.com:443
- TCP(TLS/1.2) 1####.250.179.142:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) 1####.250.179.170:443
- UDP 1####.217.132.136:443
DNS requests:
- 36####.ob####.com
- and####.google####.com
- android####.go####.com
- bi####.bi####.com
- cdn.tab####.com
- h####.b####.com
- h####.bi####.com
- jsc.m####.com
- m####.go####.com
- o####.cz####.com
- res.noc####.cc
- s####.bn####.com
- sb.scoreca####.com
- t####.c8####.com
- ua####.f6####.com
- y####.k8####.com
- z4####.ep####.com
HTTP GET requests:
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/323885/323885.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/325074/325074.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/325383/325383.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/327335/327335.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/327431/327431.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/331926/331926.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/334241/334241.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/334979/334979.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/335102/335102.jpg
- res.noc####.cc:443/sex_beauty/mmonly/bjnmn/335672/335672.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/334410/334410.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/334836/334836.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/335437/335437.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/335912/335912.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/335975/335975.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/336086/336086.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/336731/336731.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/336739/336739.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/336741/336741.jpg
- res.noc####.cc:443/sex_beauty/mmonly/hgmn/336742/336742.jpg
- ua####.f6####.com/modellog/OR4WREW9D87ER46T9GFD7.cl
- ua####.f6####.com/textlog/45F03BF30CFDFF6CC100728555A3878D.log
- ua####.f6####.com/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
- ua####.f6####.com/textlog/FFA6813C118243858FFF1E5CDFF99A3B.log
- y####.k8####.com/hwyw/akertuns.zip
- y####.k8####.com/hwyw/erfdoc9e54utr9gf7e455968y.zip
- y####.k8####.com/hwyw/staunkert.zip
- y####.k8####.com/zhuti/9Y23adsgengxin.zip
- y####.k8####.com/zhuti/D3GfIY5d530608.zip
HTTP POST requests:
- bi####.bi####.com:10238/czwwwkpmfl/
- bi####.bi####.com:10238/phvttztyax/
- h####.b####.com:443/app.gif
- o####.cz####.com:10051/getjar/
- o####.cz####.com:10051/getsol/
- o####.cz####.com:10051/repsol/
- s####.bn####.com:14002/a2jyco/
- s####.bn####.com:14002/ajnhz5/
- s####.bn####.com:14002/uv2tay/
- s####.bn####.com:16002/fkhiwf/
- t####.c8####.com:13002/4ad8fq/
- t####.c8####.com:13002/a7atzr/
- t####.c8####.com:13002/lgu4ds/
Miscellaneous:
Requests the system alert window permission.
