Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.2442
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) adash####.man.aliy####.com:80
- TCP(HTTP/1.1) appf####.ti####.cn:80
- TCP(HTTP/1.1) api.ti####.cn:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) u####.u####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) plb####.u####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) api.growi####.com:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP(TLS/1.0) eco####.me####.com:443
- TCP(TLS/1.0) l####.cc:443
- TCP(TLS/1.0) 64.2####.162.95:443
- TCP(TLS/1.0) t.growi####.com:443
- TCP(TLS/1.0) t####.growi####.com:443
- TCP(TLS/1.0) ac.c####.ti####.cn:443
- TCP(TLS/1.2) 1####.251.1.102:443
- TCP(TLS/1.2) p####.google####.com:443
- UDP p####.google####.com:443
- TCP zb-cent####.m.ta####.com:443
DNS requests:
- 2.and####.p####.####.org
- a####.b####.qq.com
- a####.man.aliy####.com
- ac.c####.ti####.cn
- aexcep####.b####.qq.com
- amdc####.m.ta####.com
- and####.b####.qq.com
- api.growi####.com
- api.ti####.cn
- appf####.ti####.cn
- eco####.me####.com
- h####.b####.com
- l####.cc
- m####.go####.com
- p####.google####.com
- plb####.u####.com
- t####.growi####.com
- t.growi####.com
- ti####.st####.ti####.cn
- u####.u####.com
- umen####.m.ta####.com
HTTP GET requests:
- api.ti####.cn/TinmanCommonServices/V1/Ad/query?version=####
- api.ti####.cn/TinmanCommonServices/V1/getParams?paramsKey=####
- api.ti####.cn/TinmanCommonServices/V1/getResource?resourceTypeId=####
- appf####.ti####.cn/static/jojosherlock/files2_2/ar_v22/cfg/cards.json.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/ar_v22/cfg/shares.json.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700036.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700037.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700038.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700039.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700040.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700041.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700042.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700043.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700044.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700045.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700046.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700047.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700048.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700049.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700050.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700051.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700052.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700053.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700054.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700055.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700056.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700057.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700058.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700059.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700060.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700061.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700062.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700063.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700064.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700065.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700066.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700067.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700068.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/libbase/700069.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2001.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2002.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2003.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2004.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2005.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2006.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2007.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2008.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2009.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/packs/2010.zip
- appf####.ti####.cn/static/jojosherlock/files2_2/version/version.json
- l####.cc:443/i/sdk/is_gal?os=####&android_id_md5=####&imei_md5=####&time...
- t####.growi####.com:443/products/80e50a5781d75199/android/<Package>/sett...
- t.growi####.com:443/app/80e50a5781d75199/android/devices?u=####&dm=####&...
- ti####.c####.l####.####.com/generalserver_zip_273ad407b9d3eb0d7de2177a4f...
- ti####.c####.l####.####.com/generalserver_zip_5ef7c7ea113d94b9e74043ea47...
- ti####.c####.l####.####.com/generalserver_zip_76ff620ccc50d5cae9b5e14ea9...
- ti####.c####.l####.####.com/generalserver_zip_a314144ff289882522482a6607...
- ti####.c####.l####.####.com/generalserver_zip_f2debd5ee3c3ce896929f84098...
HTTP POST requests:
- adash####.man.aliy####.com/man/api?ak=####&s=####
- and####.b####.qq.com/rqd/async?aid=####
- api.growi####.com:443/v3/80e50a5781d75199/android/cstm?stm=####
- api.growi####.com:443/v3/80e50a5781d75199/android/pv?stm=####
- api.ti####.cn/TinmanCommonServices/V1/getNewVersion
- eco####.me####.com:443/sdk/init?src=####&ent_id=####
- eco####.me####.com:443/sdk/init_sdk_user?src=####
- eco####.me####.com:443/sdk/statistics?src=####&ent_id=####
- h####.b####.com:443/app.gif
- l####.cc:443/i/sdk/install
- l####.cc:443/i/sdk/open
- plb####.u####.com:443/umpx_internal
- plb####.u####.com:443/umpx_push_launch
- plb####.u####.com:443/umpx_push_register
- u####.u####.com:443/unify_logs
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
