Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.611.origin
- Android.Triada.3382
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) 1####.74.95.89:80
- TCP(HTTP/1.1) a####.u####.com.####.com:80
- TCP(HTTP/1.1) 1####.24.101.108:80
- TCP(HTTP/1.1) w####.pcon####.com.cn:80
- TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) devicei####.google####.com:443
- TCP(TLS/1.2) app-mea####.com:443
- TCP(TLS/1.2) devicei####.google####.com:443
- UDP devicei####.google####.com:443
DNS requests:
- 2.and####.p####.####.org
- a####.u####.com
- and####.google####.com
- app-mea####.com
- devicei####.google####.com
- int.d####.s####.####.cn
- ip.ta####.com
- oc.u####.com
- p####.google####.com
- v3.bule####.cn
- v3.bule####.cn.####.8
- w####.pcon####.com.cn
HTTP GET requests:
- na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####
HTTP POST requests:
- a####.u####.com.####.com/app_logs
- w####.pcon####.com.cn/ip.jsp
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
