Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.1007.origin
- Android.RemoteCode.231.origin
- Android.Triada.4567
- Android.Triada.510.origin
- Android.Triada.573.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) nu####.js####.com:12029
- TCP(HTTP/1.1) a####.r####.com:16002
- TCP(HTTP/1.1) hw9####.new####.com:80
- TCP(HTTP/1.1) o####.cz####.com:10051
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) api.applove####.com:80
- TCP(HTTP/1.1) d####.dd7####.com:80
- TCP(HTTP/1.1) fung####.ly####.com:80
- TCP(HTTP/1.1) ua####.f6####.com:80
- TCP(HTTP/1.1) a####.r####.com:13002
- TCP(HTTP/1.1) s####.b####.com:80
- TCP(HTTP/1.1) gc4####.9####.com:80
- TCP(HTTP/1.1) dwq.fs####.com:80
- TCP(TLS/1.0) enters####.com:443
- TCP(TLS/1.0) gd.a.s####.com:443
- TCP(TLS/1.0) at.al####.com:443
- TCP(TLS/1.0) d####.seven####.com:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) def####.cn.zb.####.com:443
- TCP(TLS/1.0) hcap####.com:443
- TCP(TLS/1.0) m####.iu####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) securep####.g.doublec####.net:443
- TCP(TLS/1.0) fo####.site:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) 1####.250.179.142:443
- UDP 74.1####.100.169:443
DNS requests:
- 36####.ob####.com
- a####.r####.com
- a####.u####.com
- android####.go####.com
- api.applove####.com
- at.al####.com
- d####.dd7####.com
- d####.seven####.com
- dwq.fs####.com
- enters####.com
- fo####.site
- fung####.ly####.com
- gc4####.9####.com
- hcap####.com
- hw9####.new####.com
- jz####.mc####.com
- m####.iu####.com
- newas####.hcap####.com
- nu####.js####.com
- o####.cz####.com
- pv.s####.com
- q####.m####.com
- s####.b####.com
- securep####.g.doublec####.net
- u####.u####.com
- ua####.f6####.com
- www.google####.com
- www.googlet####.com
- z5.c####.com
- z9.c####.com
HTTP GET requests:
- api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
- api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
- d####.dd7####.com/upload/hw/batdex20191010.jar
- d####.dd7####.com/upload/hw/c1005dex20190527.jar
- d####.dd7####.com/upload/hw/h5rq20191022.jar
- d####.dd7####.com/upload/hw/kklz02dex20200414.jar
- d####.dd7####.com/upload/hw/lsdk20200506.jar
- d####.dd7####.com/upload/hw/mf20200508.jar
- d####.dd7####.com/upload/hw/qcdex20200316.jar
- d####.dd7####.com/upload/plog/cy1105.jar
- d####.dd7####.com/upload/plog/hwsdk1111.jar
- d####.dd7####.com/upload/plog/hx0409.jar
- d####.dd7####.com/upload/plog/jar20190515.jar
- d####.dd7####.com/upload/plog/jrw20210630.jar
- d####.dd7####.com/upload/plog/kk20201106.jar
- d####.dd7####.com/upload/plog/ps20210219.jar
- d####.dd7####.com/upload/plog/sdk0625.jar
- d####.dd7####.com/upload/plog/sh290_20210810.jar
- d####.dd7####.com/upload/plog/skk20210416.jar
- d####.dd7####.com/upload/plog/xianmm0512.jar
- d####.dd7####.com/upload/plog/zcoup1118.jar
- dwq.fs####.com/FB/nsa_100008_20211110.zip
- dwq.fs####.com/dtbx/liangzong/hwlz06.zip
- dwq.fs####.com/dtbx/liangzong/lz04.zip
- dwq.fs####.com/dtbx/yeahmobi/unsigned.zip
- dwq.fs####.com/dtbx/yunshi/awli-release.zip
- dwq.fs####.com/plugins/applh0723.zip
- dwq.fs####.com/plugins/dp2.zip
- dwq.fs####.com/plugins/yz058Uc30i0913.zip
- fo####.site:443/ewewew/s20211101220628.1
- fung####.ly####.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v...
- fung####.ly####.com/cdn-cgi/images/browser-bar.png?137675####
- fung####.ly####.com/cdn-cgi/images/cf-no-screenshot-warn.png
- fung####.ly####.com/cdn-cgi/images/trace/captcha/nojs/h/transparent.gif?...
- fung####.ly####.com/cdn-cgi/images/trace/managed/js/transparent.gif?ray=...
- fung####.ly####.com/cdn-cgi/styles/cf.errors.css
- fung####.ly####.com/favicon.ico
- fung####.ly####.com/lym07ly09
- gc4####.9####.com/zsyunsxda
- gc4####.9####.com/zsyunsxda/
- gd.a.s####.com:443/cityjson
- m####.iu####.com:443/proc.php?48f0072####
- s####.b####.com/redirect?s=####&at=####&rt=####&s1=####
- ua####.f6####.com/modellog/OEUW24U3RE9EUTR99EURF98.cl
- ua####.f6####.com/textlog/45F03BF30CFDFF6CC100728555A3878D.log
- ua####.f6####.com/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
- ua####.f6####.com/textlog/FFA6813C118243858FFF1E5CDFF99A3B.log
- z.c####.com/stat.htm?id=####&cnzz_eid=####
HTTP POST requests:
- a####.r####.com:13002/84gcjmo/
- a####.r####.com:13002/ck0k66o/
- a####.r####.com:13002/v1jyved/
- a####.r####.com:16002/h7bj93/
- al####.u####.com:443/unify_logs
- al####.u####.com:443/zcfg
- d####.seven####.com:443/FBService.svc/rt432t45t45
- def####.cn.zb.####.com:443/api/postZdata
- fung####.ly####.com/cdn-cgi/challenge-platform/h/b/flow/ov1/0.7287134867...
- hw9####.new####.com/api/activite
- hw9####.new####.com/api/back
- hw9####.new####.com/api/offer
- hw9####.new####.com/api/tbdynamic
- hw9####.new####.com/apidata/showeb
- nu####.js####.com:12029/hfdlls/
- nu####.js####.com:12029/i3v8nb/
- nu####.js####.com:12029/lfkdnr/
- o####.cz####.com:10051/getjar/
- o####.cz####.com:10051/getsol/
- o####.cz####.com:10051/repsol/
