Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) d####.h####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) crash-r####.yy.com:80
- TCP(HTTP/1.1) norma-e####.m####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) sho####.yy.com:80
- UDP(TELNET) 2####.170.50.135:23
- UDP(TELNET) a####.yy.com:23
- UDP(TELNET) 2####.228.248.99:23
- UDP(TELNET) 61.1####.73.132:23
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) r####.yy.com:443
- TCP(TLS/1.0) co####.h####.com:443
- TCP(TLS/1.0) a####.yy.com:443
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP(TLS/1.0) a####.a####.m.####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) 1####.250.186.202:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.2) 1####.250.203.131:443
- TCP(TLS/1.2) 1####.250.186.202:443
- TCP(TLS/1.2) and####.cli####.go####.com:443
- UDP wta####.yy.com:6002
- UDP wta####.yy.com:4002
- UDP a####.yy.com:80
- UDP 1####.20.84.154:6002
- TCP 1####.20.85.97:8094
- UDP 1####.242.117.100:4002
- UDP 60.2####.219.164:5002
- UDP 1####.247.249.100:80
- UDP 61.1####.52.149:4002
- TCP 36.2####.19.7:8086
- TCP zb-cent####.m.ta####.com:443
- UDP a####.yy.com:6002
- UDP a####.yy.com:4002
- TCP 61.1####.199.203:8081
- TCP 1####.20.84.7:8094
- UDP 61.1####.52.149:5002
- TCP 36.1####.204.8:87
- UDP a####.yy.com:5002
- TCP 1####.232.157.29:82
- UDP 1####.161.124.240:90
- TCP 4####.56.77.22:8095
- UDP 61.1####.29.215:5002
- TCP cm-1####.g####.com:5224
- UDP 1####.231.141.196:4002
- UDP 1####.247.249.98:4002
- UDP 36.2####.20.87:80
- TCP 1####.161.124.240:90
- UDP wta####.yy.com:80
- TCP sdk.o####.t####.####.com:5224
- UDP 2####.228.248.99:6002
- TCP 1####.90.174.106:8084
- UDP 1####.90.175.157:6002
- UDP 1####.242.117.100:5002
- UDP 2####.194.67.7:80
DNS requests:
- a####.m.ta####.com
- a####.yy.com
- a####.yy.com
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- api.s####.mob.com
- c-h####.g####.com
- cdn-sdk####.g####.com
- cm-1####.g####.com
- co####.h####.com
- crash-r####.yy.com
- d####.h####.com
- do.yy.du####.####.8
- do.yy.du####.com
- instant####.google####.com
- m####.h####.com
- msg.umengc####.com
- norma-e####.m####.com
- r####.yy.com
- s####.wta####.yy.com
- sdk.c####.g####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sho####.yy.com
- umen####.m.ta####.com
- umengj####.m.ta####.com
- wta####.yy.com
- y####.h####.com
HTTP GET requests:
- a####.yy.com:443/p/school/officialList.do?version=####&uid=####&os=####&...
- cdn-sdk####.g####.com.####.com/tdata_RBO669
- cdn-sdk####.g####.com.####.com/tdata_cpZ817
- cdn-sdk####.g####.com.####.com/tdata_uxr091
- co####.h####.com:443/api/getAppConfig?mid=####&sys=####
- co####.h####.com:443/api/getSdkListConfig?sys=####
- d####.c####.l####.####.com/config/hzv9.conf
- norma-e####.m####.com/android/exchange/getpublickey.do
- sdk.o####.p####.####.com/api/addr.htm
- sho####.yy.com/mgvoice/app/getChannelConfig.action?uid=####&os=####&osVe...
- sho####.yy.com/mgvoice/app/getKeyBoardMessage.action?uid=####&os=####&os...
- sho####.yy.com/mgvoice/app/queryAccompaniment.action?uid=####&os=####&os...
- sho####.yy.com/mgvoice/app/queryChannelSignList.action?os=####&netType=#...
- sho####.yy.com/mgvoice/app/queryFromList.action?toType=####&toUid=####&o...
- sho####.yy.com/mgvoice/app/queryPlayHouseInfo.action?uid=####&os=####&os...
HTTP POST requests:
- a####.a####.m.####.com:443/amdc/mobileDispatch?platform=####&v=####&devi...
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- c-h####.g####.com/api.php?format=####&t=####
- crash-r####.yy.com/crash/reporting
- crash-r####.yy.com/dau/reporting
- d####.h####.com/c.gif?act=####&smkdata=####&EC=####&appkey=####&item=###...
- msg.umengc####.com:443/launch
- msg.umengc####.com:443/register
- norma-e####.m####.com/push/android/external/add.do
- r####.yy.com:443/report.do?act=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
