Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.1007.origin
- Android.RemoteCode.231.origin
- Android.Triada.4567
- Android.Triada.510.origin
- Android.Triada.573.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) fung####.ly####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) dwq.fs####.com:80
- TCP(HTTP/1.1) api.applove####.com:80
- TCP(HTTP/1.1) q####.m####.com:16002
- TCP(HTTP/1.1) hw9####.new####.com:80
- TCP(HTTP/1.1) o####.cz####.com:10051
- TCP(HTTP/1.1) ua####.f6####.com:80
- TCP(HTTP/1.1) nu####.js####.com:12029
- TCP(HTTP/1.1) q####.m####.com:13002
- TCP(HTTP/1.1) gc4####.9####.com:80
- TCP(HTTP/1.1) d####.dd7####.com:80
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) d####.seven####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) g####.shine####.top:443
- TCP(TLS/1.0) new-####.u####.com:443
- TCP(TLS/1.0) r3---sn####.g####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) fo####.site:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) gd.a.s####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) 344904b####.safef####.googles####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) topm####.vip:443
- TCP(TLS/1.0) securep####.g.doublec####.net:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 64.2####.163.94:443
- TCP(TLS/1.2) 1####.251.1.101:443
- UDP www.google####.com:443
DNS requests:
- 344904b####.safef####.googles####.com
- 36####.ob####.com
- a####.r####.com
- a####.u####.com
- adser####.go####.com
- adser####.go####.nl
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- api.applove####.com
- d####.dd7####.com
- d####.seven####.com
- dwq.fs####.com
- fo####.site
- fung####.ly####.com
- g####.shine####.top
- gc4####.9####.com
- hw9####.new####.com
- jz####.mc####.com
- nu####.js####.com
- o####.cz####.com
- pag####.googles####.com
- pv.s####.com
- q####.m####.com
- r3---sn####.g####.com
- securep####.g.doublec####.net
- topm####.vip
- u####.u####.com
- ua####.f6####.com
- www.google####.com
- www.googlet####.com
- z5.c####.com
- z9.c####.com
HTTP GET requests:
- api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
- api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
- d####.dd7####.com/upload/hw/batdex20191010.jar
- d####.dd7####.com/upload/hw/c1005dex20190527.jar
- d####.dd7####.com/upload/hw/h5rq20191022.jar
- d####.dd7####.com/upload/hw/kklz02dex20200414.jar
- d####.dd7####.com/upload/hw/lsdk20200506.jar
- d####.dd7####.com/upload/hw/mf20200508.jar
- d####.dd7####.com/upload/hw/qcdex20200316.jar
- d####.dd7####.com/upload/plog/cy1105.jar
- d####.dd7####.com/upload/plog/hwsdk1111.jar
- d####.dd7####.com/upload/plog/hx0409.jar
- d####.dd7####.com/upload/plog/jar20190515.jar
- d####.dd7####.com/upload/plog/jrw20210630.jar
- d####.dd7####.com/upload/plog/kk20201106.jar
- d####.dd7####.com/upload/plog/panshi1208.jar
- d####.dd7####.com/upload/plog/sdk0625.jar
- d####.dd7####.com/upload/plog/sh290_20210810.jar
- d####.dd7####.com/upload/plog/skk20210416.jar
- d####.dd7####.com/upload/plog/xianmm0512.jar
- d####.dd7####.com/upload/plog/zcoup1118.jar
- dwq.fs####.com/FB/nsa_10012_mk03.zip
- dwq.fs####.com/dtbx/liangzong/hwlz06.zip
- dwq.fs####.com/dtbx/liangzong/lz04.zip
- dwq.fs####.com/dtbx/yeahmobi/unsigned.zip
- dwq.fs####.com/dtbx/yunshi/awli-release.zip
- dwq.fs####.com/plugins/applh0723.zip
- dwq.fs####.com/plugins/dp2.zip
- dwq.fs####.com/plugins/yz058Uc30i0913.zip
- fo####.site:443/323ewew/s20211126234954.1
- fung####.ly####.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-lo...
- fung####.ly####.com/lym07ly09/fonts/fontawesome-webfont.woff2?v=####
- fung####.ly####.com/lym07ly09/game/synthetic-number-13/
- fung####.ly####.com/lym07ly09/images/favicon.ico
- fung####.ly####.com/lym07ly09/images/logo/blade-cut-fruit-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/bread-ingredients-disappeared-...
- fung####.ly####.com/lym07ly09/images/logo/cat-dressup-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/double-stickman-jumping-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/dress-up-the-pokemon-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/eliminate-colorful-bricks-logo...
- fung####.ly####.com/lym07ly09/images/logo/quick-elimination-of-fruit-log...
- fung####.ly####.com/lym07ly09/images/logo/quick-knife-cut-ice-cream-logo...
- fung####.ly####.com/lym07ly09/images/logo/shining-zuma-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/slingshot-monster-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/snake-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/stickman-ultimate-duel-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/super-burger-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/synthetic-number-13-logo.jpg
- fung####.ly####.com/lym07ly09/images/logo/thief-parkour-logo.jpg
- fung####.ly####.com/lym07ly09/images/sokiDa.jpg
- fung####.ly####.com/lym07ly09/images/top.png
- fung####.ly####.com/lym07ly09/public/bootstrap.min.css
- fung####.ly####.com/lym07ly09/public/font-awesome.min.css
- fung####.ly####.com/lym07ly09/static/jquery-1.11.2.min.js
- fung####.ly####.com/lym07ly09/static/shejiwo.js
- fung####.ly####.com/lym07ly09/static/theme.css
- gc4####.9####.com/zsyunsxda
- gc4####.9####.com/zsyunsxda/
- gd.a.s####.com:443/cityjson
- ua####.f6####.com/modellog/OEUW24U3RE9EUTR99EURF98.cl
- ua####.f6####.com/textlog/45F03BF30CFDFF6CC100728555A3878D.log
- ua####.f6####.com/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
- ua####.f6####.com/textlog/FFA6813C118243858FFF1E5CDFF99A3B.log
- z.c####.com/stat.htm?id=####&cnzz_eid=####
HTTP POST requests:
- al####.u####.com:443/unify_logs
- al####.u####.com:443/zcfg
- d####.seven####.com:443/FBService.svc/dfs5443yty54
- hw9####.new####.com/api/activite
- hw9####.new####.com/api/offer
- hw9####.new####.com/api/tbdynamic
- hw9####.new####.com/apidata/showeb
- new-####.u####.com:443/api/postZdata
- nu####.js####.com:12029/hfdlls/
- nu####.js####.com:12029/i3v8nb/
- nu####.js####.com:12029/lfkdnr/
- o####.cz####.com:10051/getjar/
- o####.cz####.com:10051/getsol/
- o####.cz####.com:10051/repsol/
- q####.m####.com:13002/84gcjmo/
- q####.m####.com:13002/ck0k66o/
- q####.m####.com:13002/v1jyved/
- q####.m####.com:16002/h7bj93/
