Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.906.origin
- Android.Triada.4567
- Android.Triada.510.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) 7####.r####.com:13002
- TCP(HTTP/1.1) 7####.r####.com:16002
- TCP(HTTP/1.1) dwq.fs####.com:80
- TCP(HTTP/1.1) 7####.r####.com:14002
- TCP(HTTP/1.1) o####.cz####.com:10051
- TCP(HTTP/1.1) 36####.pb####.com:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) st####.what####.net:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) log.kz####.com:443
- TCP(TLS/1.2) 1####.251.1.139:443
- TCP(TLS/1.2) gmscomp####.google####.com:443
- TCP(TLS/1.2) 64.2####.165.94:443
- TCP(TLS/1.2) 1####.194.222.113:443
- UDP rr8---s####.g####.com:443
- UDP rr1---s####.g####.com:443
- UDP gmscomp####.google####.com:443
DNS requests:
- 2.and####.p####.####.org
- 36####.pb####.com
- 7####.r####.com
- a####.r####.com
- dwq.fs####.com
- gmscomp####.google####.com
- log.kz####.com
- o####.cz####.com
- q####.m####.com
- rr1---s####.g####.com
- rr8---s####.g####.com
- st####.what####.net
- yu.uw####.com
HTTP GET requests:
- 36####.pb####.com/modellog/DFE98RW94TR98DSWEO5R.cl
- 36####.pb####.com/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
- dwq.fs####.com/plugins/dp11.zip
- dwq.fs####.com/plugins/yz058Uc30i0524.zip
- dwq.fs####.com/souhu-sdk/was-1109.zip
- log.kz####.com:443/waApi/getSCfg?zt_channel=####&uuid=####
- st####.what####.net:443/downloadable?category=####
HTTP POST requests:
- 7####.r####.com:13002/84gcjmo/
- 7####.r####.com:13002/ck0k66o/
- 7####.r####.com:13002/v1jyved/
- 7####.r####.com:14002/bym8v6/
- 7####.r####.com:14002/i8xps1/
- 7####.r####.com:14002/wmg3wz/
- 7####.r####.com:16002/0mlo16/
- 7####.r####.com:16002/h7bj93/
- log.kz####.com:443/logCollect/getCfg/
- log.kz####.com:443/waApi/getCfg
- o####.cz####.com:10051/getjar/
- o####.cz####.com:10051/getsol/
- o####.cz####.com:10051/repjar/
Miscellaneous:
Requests the system alert window permission.
