Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.2442
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) 47.97.1####.182:10005
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) l####.cc:80
- TCP(HTTP/1.1) 47.97.1####.182:10010
- TCP(HTTP/1.1) sdk.ks-####.com:8989
- TCP(TLS/1.0) digital####.google####.com:443
- TCP(TLS/1.0) wa####.127.net:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) def####.cn.zb.####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) web####.net####.im:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.2) and####.cli####.go####.com:443
- TCP(TLS/1.2) 2####.58.208.99:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP cm-1####.g####.com:5225
- TCP sdk.o####.t####.####.com:5224
DNS requests:
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- c-h####.g####.com
- cdn-sdk####.g####.com
- cm-1####.g####.com
- digital####.google####.com
- instant####.google####.com
- l####.cc
- log.u####.com
- md####.google####.com
- plb####.u####.com
- sdk-ope####.g####.com
- sdk.c####.g####.com
- sdk.ks-####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- u####.u####.com
- wa####.127.net
- web####.net####.im
- www.gst####.com
HTTP GET requests:
- cdn-sdk####.g####.com.####.com/tdata_EDB102
- cdn-sdk####.g####.com.####.com/tdata_RBO669
- cdn-sdk####.g####.com.####.com/tdata_cpZ817
- cdn-sdk####.g####.com.####.com/tdata_uxr091
- d####.c####.l####.####.com/config/hzv9.conf
- def####.cn.zb.####.com:443/bar/get/54fd367cfd98c532c00007f1/?pcv=####&de...
- l####.cc/i/sdk/is_gal?os=####&android_id_md5=####&imei_md5=####×tam...
- sdk.o####.p####.####.com/api/addr.htm
- wa####.127.net:443/lbs?version=####
- web####.net####.im:443/statistic/getConfig
HTTP POST requests:
- al####.u####.com:443/unify_logs
- c-h####.g####.com/api.php?format=####&t=####
- l####.cc/i/sdk/install
- sdk.ks-####.com:8989/api/CanHWDecode/2017-01-01
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
