Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) mia####.cn:80
- TCP(HTTP/1.1) dbc6933####.qcloud####.com:80
- TCP(HTTP/1.1) m.mia####.cn:80
- TCP(HTTP/1.1) 1####.67.196.181:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) for####.do####.com:443
- TCP(TLS/1.0) phonede####.google####.com:443
- TCP(TLS/1.0) 64.2####.165.100:443
- TCP(TLS/1.0) u####.u####.com:443
- TCP(TLS/1.0) 64.2####.165.139:443
- TCP(TLS/1.0) new-####.u####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) errne####.u####.com.####.com:443
- TCP(TLS/1.0) 85.1####.117.141:443
- TCP(TLS/1.0) and####.b####.qq.com:443
- TCP(TLS/1.2) 1####.177.14.113:443
- TCP(TLS/1.2) phonede####.google####.com:443
- TCP(TLS/1.2) 64.2####.162.94:443
- TCP try.g####.io:443
- TCP arm.z####.cn:10007
- UDP phonede####.google####.com:443
- UDP rr1---s####.g####.com:443
- TCP arm.z####.cn:10002
- TCP i####.doub####.com.####.com:443
DNS requests:
- 2.and####.p####.####.org
- a####.u####.com
- and####.b####.qq.com
- and####.google####.com
- api.kun####.com
- arm.z####.cn
- devicei####.google####.com
- errne####.u####.com
- i####.doub####.com
- m####.do####.com
- m####.go####.com
- m.mia####.cn
- mia####.cn
- p####.google####.com
- pag####.googles####.com
- phonede####.google####.com
- rr1---s####.g####.com
- try.g####.io
- u####.u####.com
HTTP GET requests:
- dbc6933####.qcloud####.com/api.php/provide/filter
- for####.do####.com:443/j/new_search_subjects?sort=####&range=####&tags=#...
- m.mia####.cn/资源包1.jar
- mia####.cn/meow
HTTP POST requests:
- and####.b####.qq.com:443/rqd/async?aid=####
- errne####.u####.com.####.com:443/apm_cc
- new-####.u####.com:443/api/postZdata
- u####.u####.com:443/unify_logs
- u####.u####.com:443/zcfg
Miscellaneous:
Uses special library to hide executable bytecode.
