Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.1007.origin
- Android.Triada.4567
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) 1####.177.14.100:443
- TCP(TLS/1.0) st####.what####.net:443
- TCP(TLS/1.0) wy####.s####.com:15002
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) 8.2####.24.66:13001
- TCP(TLS/1.0) v####.cz####.com:443
- TCP(TLS/1.0) 1####.177.14.95:443
- TCP(TLS/1.0) wy####.s####.com:16001
- TCP(TLS/1.0) sa-ea####.cf.modsd####.app:443
- TCP(TLS/1.0) 92####.uh####.com:443
- TCP(TLS/1.0) p8####.fq####.com:443
- TCP(TLS/1.0) firebas####.crashly####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) cdn.hey####.cloud:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.0) 64.2####.161.95:443
- TCP(TLS/1.2) 1####.177.14.100:443
- TCP(TLS/1.2) inte####.faceu####.com:6443
- TCP(TLS/1.2) 1####.251.1.113:443
- TCP(TLS/1.2) 8.2####.24.66:13001
- TCP(TLS/1.2) 64.2####.163.95:443
- TCP(TLS/1.2) 64.2####.164.94:443
- TCP(TLS/1.2) 64.2####.164.113:443
- TCP(TLS/1.2) 64.2####.161.95:443
- TCP ads####.traffic####.com:443
- UDP p####.google####.com:443
- UDP rr2---s####.g####.com:443
- UDP rr1---s####.g####.com:443
- TCP api.mo####.app:443
- UDP 64.2####.161.95:443
- TCP etp.hey####.com:443
DNS requests:
- 148.77.188.####.arpa
- 2.and####.p####.####.org
- 204.114.114.####.arpa
- 92####.uh####.com
- ads####.traffic####.com
- api.mo####.app
- cdn.hey####.cloud
- cdn.za####.cloud
- d####.fl####.com
- e####.bn####.com
- etp.hey####.com
- firebas####.crashly####.com
- firebas####.google####.com
- firebas####.google####.com
- inte####.faceu####.com
- n####.w1####.com
- p####.google####.com
- p8####.fq####.com
- rr1---s####.g####.com
- rr2---s####.g####.com
- sa-ea####.cf.modsd####.app
- st####.what####.net
- v####.cz####.com
- wy####.s####.com
HTTP GET requests:
- cdn.hey####.cloud:443/res/am_stickers_emoji.zip
- cdn.hey####.cloud:443/res/cc_call_video.mp4
- firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:548258886...
- sa-ea####.cf.modsd####.app:443/applet/1651145438.app-center-v0.1.34.v1.zip
- sa-ea####.cf.modsd####.app:443/res/lib/faceunity-sdk-core-8.0.0-full.7z
HTTP POST requests:
- 92####.uh####.com:443/rdsrmpgsqf/
- firebas####.google####.com:443/v1/projects/548258886856/namespaces/fireb...
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
