Technical information
Malicious functions:
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) js.a####.ir:80
- TCP(HTTP/1.1) www.aloat####.ir:80
- TCP(HTTP/1.1) gia####.com:80
- TCP(HTTP/1.1) aloat####.ir:80
- TCP(TLS/1.0) 1####.217.20.78:443
- TCP(TLS/1.0) js.a####.ir:443
- TCP(TLS/1.0) cdn.ra####.com:443
DNS requests:
- a####.ir
- aloat####.ir
- cdn.ra####.com
- gia####.com
- js.a####.ir
- www.aloat####.ir
HTTP GET requests:
- aloat####.ir/panel/update.php?license=####
- aloat####.ir/wp-content/uploads/2018/04/Essential-Oil-Aromatherapy-Blend...
- aloat####.ir/wp-content/uploads/2018/04/health-wellness_body-mind-spirit...
- aloat####.ir/wp-content/uploads/2018/04/pichak-3.jpg
- aloat####.ir/wp-content/uploads/2018/04/چای-لاغری3.jpg
- aloat####.ir/wp-content/uploads/2018/05/139411200929148077076664.jpg
- aloat####.ir/wp-content/uploads/2018/05/5.jpg
- aloat####.ir/wp-content/uploads/2018/05/505a5676b5a3aa6a3f6b2efa15ce8a2c...
- aloat####.ir/wp-content/uploads/2018/05/5468661-582x395.jpg
- aloat####.ir/wp-content/uploads/2018/05/54847.jpg
- aloat####.ir/wp-content/uploads/2018/05/57ae569e-f4ad-4002-b042-47d0ba82...
- aloat####.ir/wp-content/uploads/2018/05/AN5-Apple_Cider_Vinegar-1296x728...
- aloat####.ir/wp-content/uploads/2018/05/Herbal-remedies-for-anxiety2-Ban...
- aloat####.ir/wp-content/uploads/2018/05/Olive-Oil-for-Hair.jpg
- aloat####.ir/wp-content/uploads/2018/05/Origan-Hot-and-Spicy.jpg
- aloat####.ir/wp-content/uploads/2018/05/acne-hormooni-gy-671x420.jpg
- aloat####.ir/wp-content/uploads/2018/05/boxhornklee.jpg
- aloat####.ir/wp-content/uploads/2018/05/salamdr_58512726ae474.jpg
- aloat####.ir/wp-content/uploads/2018/05/wild-yam-herb-img.jpg
- aloat####.ir/wp-content/uploads/2018/05/شایعه-سرطان-ریحان-بنفش-600x330.jpg
- aloat####.ir/wp-content/uploads/2018/05/فوائد_الشاي_الأخضر_للحامل.jpg
- aloat####.ir/wp-json/givekesh/posts?category_name=####&search=####&per_p...
- gia####.com/wp-content/uploads/shanbalileh-for-diabetes-gy.jpg
- js.a####.ir/adad-client/js/?device=####&androidid=####&token=####&networ...
- js.a####.ir/adview/?digest=####&device=####&androidid=####&token=####&ne...
- js.a####.ir/media/ads1712/173737a2-ef8c-47e3-8f36-335a0ded9edb/ar4-3327....
- js.a####.ir/media/ads1802/4d6c02c9-5803-4a42-b687-2e3e27466f8c/33603.jpg
- js.a####.ir/static/images/skip-load.gif
- js.a####.ir/static/images/video_mute_button.png
- js.a####.ir/static/images/video_skip_button.png
- www.aloat####.ir/wp-json/givekesh/posts?category_name=####&search=####&p...
Modified file system:
Creates the following files:
- /data/data/####/-940655700-1857866083
- /data/data/####/03f834a8af84b76da276be4c2f4107ce31d49ec3e6ad385....0.tmp
- /data/data/####/04e7c242218ad74f163d72e6e11c7fd9cc29bcbb417dd31....0.tmp
- /data/data/####/176d1d22ab4fd6d29998944fe6e31d3844dafb4fcd97ba2....0.tmp
- /data/data/####/24bb018709e8b8cb9d431945e36e10d36cccc38f6b018d9....0.tmp
- /data/data/####/2c2e6526a97848aa9b335aa912ab054ffae88a9911539c1....0.tmp
- /data/data/####/45ccc6af2ee675e492412c5a50b04b1d5c972c44a8b4193....0.tmp
- /data/data/####/5f7267f05f46ed2951a96955c9a3f897712112a8a96af35....0.tmp
- /data/data/####/68295fe5bd847f1a2380aa4aef2f872b0cb67e37a133b67....0.tmp
- /data/data/####/8a076b5ecd5b02f09d91b3481130d759d7fcebf54528f0f....0.tmp
- /data/data/####/8a1fe88567a2f015dfbeaeefffe0bfee2b80b0d260756c8....0.tmp
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/adadSharedPreferences.xml
- /data/data/####/b96c5da14acd2d4de664e0a89f1971be61d14210d108cbd....0.tmp
- /data/data/####/b9ff4f303d460bfbe465a144c1939f7907bb0230bc49f5e....0.tmp
- /data/data/####/c764e3a8f699847c7e55f0bef74eabe4e9ea85819860f56....0.tmp
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/com.amin.traditional_preferences.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/d2ccf363335d0c104b004902013794a0f4cee4ef4706985....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dcf3f3dda4666efdcfb49b4ad8181782a0c0b240f8caf2a....0.tmp
- /data/data/####/e097d7682bd448a645a7170d9333af9889d679bc9efd42e....0.tmp
- /data/data/####/e5a5d238ce4fb763d8b783128580b1250649659d213842a....0.tmp
- /data/data/####/e771ecc0239f6ed13bd27f70281c28adca9c948b418a101....0.tmp
- /data/data/####/eb250041d99c945b772a769e257852070b34ac8fb99e903....0.tmp
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/fc9ba62bf776a190812908dd573f9a2d2b85fe04423752a....0.tmp
- /data/data/####/index
- /data/data/####/journal.tmp
- /data/data/####/unsent_requests
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Gains access to network information.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
