Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.1007.origin
- Android.RemoteCode.231.origin
- Android.Triada.4567
- Android.Triada.510.origin
- Android.Triada.573.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) hw9####.new####.com:80
- TCP(HTTP/1.1) gc4####.9####.com:80
- TCP(HTTP/1.1) nu####.js####.com:12029
- TCP(HTTP/1.1) o####.cz####.com:10051
- TCP(HTTP/1.1) hw1####.new####.com:80
- TCP(HTTP/1.1) d####.dd7####.com:80
- TCP(HTTP/1.1) fung####.ly####.com:80
- TCP(HTTP/1.1) q####.m####.com:13002
- TCP(HTTP/1.1) api.applove####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) s####.b####.com:80
- TCP(HTTP/1.1) q####.m####.com:16002
- TCP(HTTP/1.1) 36####.ob####.com:80
- TCP(HTTP/1.1) dwq.fs####.com:80
- TCP(TLS/1.0) d####.seven####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) fo####.site:443
- TCP(TLS/1.0) gd.a.s####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) def####.cn.zb.####.com:443
- TCP(TLS/1.0) r3---sn####.g####.com:443
- TCP(TLS/1.0) 2d9b661####.safef####.googles####.com:443
- TCP(TLS/1.0) 1####.217.168.234:443
- TCP(TLS/1.0) r5---sn####.g####.com:443
- TCP(TLS/1.0) securep####.g.doublec####.net:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) 3fung####.com:443
- TCP(TLS/1.0) at.al####.com:443
- TCP(TLS/1.0) 2####.58.214.14:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.2) 1####.217.168.234:443
- TCP(TLS/1.2) 1####.250.179.142:443
- TCP(TLS/1.2) 1####.250.179.195:443
- UDP r3---sn####.g####.com:443
- UDP p####.google####.com:443
DNS requests:
- 2d9b661####.safef####.googles####.com
- 36####.ob####.com
- 3fung####.com
- a####.r####.com
- a####.u####.com
- adser####.go####.com
- adser####.go####.nl
- and####.google####.com
- api.applove####.com
- at.al####.com
- d####.dd7####.com
- d####.seven####.com
- dwq.fs####.com
- fo####.site
- fung####.ly####.com
- gc4####.9####.com
- hw1####.new####.com
- hw9####.new####.com
- jz####.mc####.com
- m####.go####.com
- nu####.js####.com
- o####.cz####.com
- p####.google####.com
- pag####.googles####.com
- pv.s####.com
- q####.m####.com
- r3---sn####.g####.com
- r5---sn####.g####.com
- s####.b####.com
- securep####.g.doublec####.net
- u####.u####.com
- ua####.f6####.com
- www.googlet####.com
- z5.c####.com
- z9.c####.com
HTTP GET requests:
- 36####.ob####.com/modellog/OEUW24U3RE9EUTR99EURF98.cl
- 36####.ob####.com/textlog/45F03BF30CFDFF6CC100728555A3878D.log
- 36####.ob####.com/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
- 36####.ob####.com/textlog/FFA6813C118243858FFF1E5CDFF99A3B.log
- api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
- api.applove####.com/api/v3/search/get?osv=####&token=####&pm=####&os=###...
- api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
- d####.dd7####.com/upload/hw/batdex20191010.jar
- d####.dd7####.com/upload/hw/c1005dex20190527.jar
- d####.dd7####.com/upload/hw/h5rq20191022.jar
- d####.dd7####.com/upload/hw/kklz02dex20200414.jar
- d####.dd7####.com/upload/hw/lsdk20200506.jar
- d####.dd7####.com/upload/hw/mf20200508.jar
- d####.dd7####.com/upload/hw/qcdex20200316.jar
- d####.dd7####.com/upload/plog/cy1105.jar
- d####.dd7####.com/upload/plog/hwsdk1111.jar
- d####.dd7####.com/upload/plog/hx0409.jar
- d####.dd7####.com/upload/plog/jar20190515.jar
- d####.dd7####.com/upload/plog/jrw20210630.jar
- d####.dd7####.com/upload/plog/kk20201106.jar
- d####.dd7####.com/upload/plog/ps20210219.jar
- d####.dd7####.com/upload/plog/sdk0625.jar
- d####.dd7####.com/upload/plog/sh290_20210810.jar
- d####.dd7####.com/upload/plog/skk20210416.jar
- d####.dd7####.com/upload/plog/xianmm0512.jar
- d####.dd7####.com/upload/plog/zcoup1118.jar
- dwq.fs####.com/FB/nsa_100008_20211110.zip
- dwq.fs####.com/dtbx/liangzong/hwlz06.zip
- dwq.fs####.com/dtbx/liangzong/lz04.zip
- dwq.fs####.com/dtbx/yeahmobi/unsigned.zip
- dwq.fs####.com/dtbx/yunshi/awli-release.zip
- dwq.fs####.com/plugins/applh0723.zip
- dwq.fs####.com/plugins/dp2.zip
- dwq.fs####.com/plugins/yz058Uc30i0913.zip
- fo####.site:443/ewewew/s20211101220628.1
- fung####.ly####.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-lo...
- fung####.ly####.com/lym07ly07/fonts/fontawesome-webfont.woff2?v=####
- fung####.ly####.com/lym07ly07/game/vertical-drop/
- fung####.ly####.com/lym07ly07/images/favicon.ico
- fung####.ly####.com/lym07ly07/images/logo/cartoon-world-puzzle-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/challenge-alcatraz-island-logo...
- fung####.ly####.com/lym07ly07/images/logo/deep-sea-gem-mining-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/find-out-ten-different-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/grab-the-sugar-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/juvenile-ninja-trial-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/little-amster-eating-menlon-se...
- fung####.ly####.com/lym07ly07/images/logo/mathematical-puzzle-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/maze-lovers-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/memory-ice-cream-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/orange-smiley-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/pocket-monster-puzzle-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/rolling-shield-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/shuttle-between-sectet-doors-l...
- fung####.ly####.com/lym07ly07/images/logo/vertical-drop-logo.jpg
- fung####.ly####.com/lym07ly07/images/sokiDa.jpg
- fung####.ly####.com/lym07ly07/images/top.png
- fung####.ly####.com/lym07ly07/public/bootstrap.min.css
- fung####.ly####.com/lym07ly07/public/font-awesome.min.css
- fung####.ly####.com/lym07ly07/static/jquery-1.11.2.min.js
- fung####.ly####.com/lym07ly07/static/shejiwo.js
- fung####.ly####.com/lym07ly07/static/theme.css
- gc4####.9####.com/zsyunsxda
- gc4####.9####.com/zsyunsxda/
- gd.a.s####.com:443/cityjson
- s####.b####.com/redirect?s=####&at=####&rt=####&s1=####
- z.c####.com/stat.htm?id=####&cnzz_eid=####
HTTP POST requests:
- al####.u####.com:443/unify_logs
- al####.u####.com:443/zcfg
- d####.seven####.com:443/FBService.svc/d3f23rf334f3
- def####.cn.zb.####.com:443/api/postZdata
- hw1####.new####.com/api/tbdynamic
- hw9####.new####.com/api/activite
- hw9####.new####.com/api/back
- hw9####.new####.com/api/offer
- hw9####.new####.com/api/tbdynamic
- hw9####.new####.com/apidata/showeb
- nu####.js####.com:12029/hfdlls/
- nu####.js####.com:12029/i3v8nb/
- nu####.js####.com:12029/lfkdnr/
- o####.cz####.com:10051/getjar/
- o####.cz####.com:10051/getsol/
- o####.cz####.com:10051/repsol/
- q####.m####.com:13002/84gcjmo/
- q####.m####.com:13002/ck0k66o/
- q####.m####.com:13002/v1jyved/
- q####.m####.com:16002/h7bj93/
