Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.603.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
- TCP(HTTP/1.1) d.billyaf####.com:80
- TCP(HTTP/1.1) game####.cdn6-da####.top:80
- TCP(HTTP/1.1) r####.adsb####.com:80
- TCP(HTTP/1.1) char####.com:80
- TCP(HTTP/1.1) thiscli####.com:80
- TCP(HTTP/1.1) a####.w####.in:80
- TCP(HTTP/1.1) c.cldl####.com:80
- TCP(HTTP/1.1) main-p####.biz:80
- TCP(HTTP/1.1) namet####.com:80
- TCP(HTTP/1.1) w####.io:80
- TCP(HTTP/1.1) c.clm####.com:80
- TCP(HTTP/1.1) e####.w####.in:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) hy####.com:80
- TCP(HTTP/1.1) web.counter####.com:80
- TCP(HTTP/1.1) tango####.com:80
- TCP(HTTP/1.1) koolmed####.com:80
- TCP(HTTP/1.1) cpgnrot####.com:80
- TCP(HTTP/1.1) www.nltopof####.com:80
- TCP(TLS/1.0) billmsc####.com:443
DNS requests:
- a####.google####.com
- a####.w####.in
- billmsc####.com
- c.cldl####.com
- c.clm####.com
- char####.com
- cpgnrot####.com
- d.billyaf####.com
- d3656q1####.cloudf####.net
- e####.w####.in
- game####.cdn6-da####.top
- hy####.com
- koolmed####.com
- main-p####.biz
- namet####.com
- tango####.com
- thiscli####.com
- w####.io
- web.counter####.com
- www.nltopof####.com
- www.trac####.site
HTTP GET requests:
- a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
- e####.w####.in/interface/mothdnew.php?subid=####&pjid=####&uid=####&Imsi...
- e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
- e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
- game####.cdn6-da####.top/default.aspx?u=####&o=####&t=####&cid=####&f=####
- game####.cdn6-da####.top/media/mainstream/backbutton_mainstream.js
- game####.cdn6-da####.top/media/mainstream/jquery.js
- game####.cdn6-da####.top/media/mainstream/js.cookie6_pure.js
- game####.cdn6-da####.top/media/mainstream/js1.js
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/1666.png
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/<System Property...
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/alert.ogg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/comment-c.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/comment-k.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/comment1.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/comment7.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/fb-check.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/female.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/galiphone.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/icon-left.png
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/icon-right.png
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/ip6sunbox.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/loading.gif
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/logo.png
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/oldlady.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/oldman.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/ps4.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/ps4man.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/s6unbox.jpg
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/smiley.png
- game####.cdn6-da####.top/media/mainstream/nl/wap/google/sub2.png
- game####.cdn6-da####.top/util/utils-ms.js
- hy####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKhos-Ud...
- main-p####.biz/?u=####&o=####&t=####&cid=####
- r####.adsb####.com/c/140a6455137922f3?c1=####&c2=####&c3=####&_uu=####
HTTP POST requests:
- e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/index
- <Package Folder>/cache/intel-2085983745.txt
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/ApplicationCache.db-journal
- <Package Folder>/files/mingsk
- <Package Folder>/files/sail747.so
- <Package Folder>/files/wokuai.apk
- <Package Folder>/shared_prefs/Argolisten.xml
- <Package Folder>/shared_prefs/jihuos.xml
- <Package Folder>/shared_prefs/userconfig.xml
Miscellaneous:
Loads the following dynamic libraries:
- intel-2085983745
- main
- ppv
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
