Technical information
Malicious functions:
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) coba####.com:80
- TCP(HTTP/1.1) dap####.com:80
- TCP(HTTP/1.1) pushnot####.com:80
- TCP(HTTP/1.1) ge####.com:80
- TCP(HTTP/1.1) www.face####.com:80
- TCP(HTTP/1.1) d3ud741####.cloudf####.net:80
- TCP(HTTP/1.1) th####.net:80
- TCP(HTTP/1.1) d1nmxii####.cloudf####.net:80
- TCP(HTTP/1.1) po####.ir:80
- TCP(HTTP/1.1) sax.peakon####.com:80
- TCP(HTTP/1.1) analy####.sh####.st:80
- TCP(HTTP/1.1) go.oncl####.com:80
- TCP(HTTP/1.1) lpo.mediaon####.com:80
- TCP(HTTP/1.1) cdn.th####.net:80
- TCP(HTTP/1.1) st####.sh.st:80
- TCP(HTTP/1.1) s1-a####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) d1n3tk6####.cloudf####.net:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) ads.sh####.st:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) c####.net:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) rot####.com:443
- TCP(TLS/1.0) bo####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) gait####.com:443
- TCP(TLS/1.0) c####.adf.ly:443
- TCP(TLS/1.0) a####.ly:443
- TCP(TLS/1.0) bam.nr-####.net:443
- TCP(TLS/1.0) cl-06d7####.g####.co:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) serv####.m####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) m.face####.com:443
- TCP(TLS/1.0) s####.users####.com:443
- TCP(TLS/1.0) n.ads1-a####.com:443
- TCP(TLS/1.0) api.tap####.ir:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) js-a####.newr####.com:443
- TCP(TLS/1.0) 1####.217.20.78:443
- TCP(TLS/1.0) onesi####.com:443
- TCP(TLS/1.0) s####.ads1-a####.com:443
- TCP(TLS/1.0) fort####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) go.mob####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) www.cuizip####.com:443
- TCP(TLS/1.0) bod####.com:443
- TCP(TLS/1.0) con####.face####.net:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) stat####.face####.com:443
- TCP(TLS/1.0) t####.co:443
DNS requests:
- a####.google####.com
- a####.ly
- ads.sh####.st
- adser####.go####.com
- adser####.go####.nl
- analy####.sh####.st
- api.tap####.ir
- bam.nr-####.net
- bo####.com
- bod####.com
- c####.adf.ly
- c####.net
- cdn.th####.net
- coba####.com
- con####.face####.net
- d1n3tk6####.cloudf####.net
- d1nmxii####.cloudf####.net
- d3ud741####.cloudf####.net
- dap####.com
- f####.google####.com
- f####.gst####.com
- fort####.com
- gait####.com
- ge####.com
- go.mob####.com
- go.oncl####.com
- googl####.g.doublec####.net
- js-a####.newr####.com
- jsc.m####.com
- lpo.mediaon####.com
- m.face####.com
- n.ads1-a####.com
- onesi####.com
- pag####.googles####.com
- po####.ir
- pushnot####.com
- rot####.com
- s####.ads1-a####.com
- s####.users####.com
- s1-a####.com
- sax.peakon####.com
- serv####.m####.com
- st####.sh.st
- st####.xx.f####.net
- stat####.face####.com
- t####.co
- th####.net
- tpc.googles####.com
- www.cuizip####.com
- www.face####.com
- www.go####.com
- www.google-####.com
- www.googlet####.com
- www.googlet####.com
HTTP GET requests:
- a####.google####.com/ajax/libs/jquery/1.7.1/jquery.min.js
- ads.sh####.st/ads.php?key=####&width=####&height=####&ch=####&cp.dest_do...
- c####.net/top-10-insurance-companies-in-usa-2018.jsp?ref=####
- cdn.th####.net/static/css/adfly_7.css
- cdn.th####.net/static/js/amvn.js
- cdn.th####.net/static/js/b64.js
- cdn.th####.net/static/js/main.js
- cdn.th####.net/static/js/view105b.js
- coba####.com/apu.php?zoneid=####
- d1n3tk6####.cloudf####.net/Vd2xLV3UUAyUxSgMFL2pDR1h4YUFRBjg4GwdRKA8CMC4x...
- d1nmxii####.cloudf####.net/?ixmnd=####
- d3ud741####.cloudf####.net/?vudud=####
- dap####.com/dxn
- ge####.com/bundles/smeweb/js/xvideos.js
- ge####.com/grey_wizard_rewrite/shst_en/error/smeweb_error.css
- ge####.com/grey_wizard_rewrite_js/?b=xFEwO####
- ge####.com/shortest-url/end-adsession?adSessionId=####&adbd=####&callbac...
- ge####.com/wCCoIp
- go.oncl####.com/apu.php?zoneid=####
- lpo.mediaon####.com/?ti=####&si=####
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20190102/r20180604/show_ads_impl.js
- po####.ir/redi/afly.php
- po####.ir/redi/short.php
- pushnot####.com/notif/get_push.php?id=####
- pushnot####.com/notif/samane.php
- s1-a####.com/show.php?url=####
- sax.peakon####.com/pops/wgprtb.php?&subid=####&pid=####&m=####&ref=####&...
- st####.sh.st/js/packed/interstitial-page.js?2018-12####
- th####.net/-64808UZPF/dxn?rndad=####
- th####.net/1market.php?i=####&n=####&p=IIs6I####
- th####.net/fp.rev10.php?nocache=####
- th####.net/funcript1546953171168.php?pub=####&v=####
- th####.net/js/display.js
- www.face####.com/plugins/like.php?href=####&width=####&fb_source=####&la...
- www.google-####.com/analytics.js
- www.google-####.com/ga.js
HTTP POST requests:
- analy####.sh####.st/displayed
- analy####.sh####.st/viewed
- th####.net/callback/8133245327768c2a8812aac0af801213
- th####.net/index/ping
HTTP OPTIONS requests:
- analy####.sh####.st/displayed
- analy####.sh####.st/viewed
File system changes:
Creates the following files:
- /data/data/####/OneSignal.db-journal
- /data/data/####/OneSignal.xml
- /data/data/####/TapseelPreferences.xml
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/bkoodb.ttf
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/index
- /data/data/####/ir.tapsell.sdk.ads
- /data/data/####/ir.tapsell.sdk.ads-journal
- /data/data/####/pref.xml
- /data/data/####/tap.db-journal
- /data/data/####/unsent_requests
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
