Technical information
Malicious functions:
Sends SMS messages:
- 737471: 1924432719
- 737474: 1924432719
- 83215: 124956833
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) e-cha####.ir:80
- TCP(HTTP/1.1) lib####.te####.net:80
- TCP(HTTP/1.1) img.te####.net:80
- TCP(HTTP/1.1) cloudfr####.amazo####.com:80
- TCP(HTTP/1.1) m####.webg####.ir:80
- TCP(HTTP/1.1) i####.te####.net:80
- TCP(HTTP/1.1) www.te####.net:80
- TCP(HTTP/1.1) src.te####.net:80
- TCP(HTTP/1.1) art####.te####.net:80
- TCP(HTTP/1.1) a02341b####.pro####.m####.####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) d5nxst8####.cloudf####.net:443
- TCP(TLS/1.0) img.te####.net:443
- TCP(TLS/1.0) src.te####.net:443
- TCP(TLS/1.0) crea####.magneta####.com:443
- TCP(TLS/1.0) api.te####.net:443
- TCP(TLS/1.0) mada####.com:443
- TCP(TLS/1.0) cdn.yekt####.com:443
- TCP(TLS/1.0) srv.magneta####.com:443
- TCP(TLS/1.0) i####.te####.net:443
- TCP(TLS/1.0) f####.yekt####.com:443
- TCP(TLS/1.0) lib####.te####.net:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) www.te####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) art####.te####.net:443
- TCP(TLS/1.0) d31qbv1####.cloudf####.net:443
- TCP(TLS/1.0) c####.magneta####.com:443
DNS requests:
- a####.te####.net
- a02341b####.pro####.m####.####.net
- api.te####.net
- art####.te####.net
- c####.magneta####.com
- cdn.yekt####.com
- cloudfr####.amazo####.com
- crea####.magneta####.com
- d31qbv1####.cloudf####.net
- d5nxst8####.cloudf####.net
- e-cha####.ir
- f####.yekt####.com
- i####.te####.net
- img.te####.net
- lib####.te####.net
- m####.webg####.ir
- mada####.com
- s####.g.doublec####.net
- src.te####.net
- srv.magneta####.com
- tr2.magneta####.com
- www.google-####.com
- www.te####.net
HTTP GET requests:
- art####.te####.net/271615/ثبت-نام-مجردها-در-سامانه-همسان-گزینی
- art####.te####.net/379010/غذاهای-سالمی-که-واقعا-سالم-نیستند
- cloudfr####.amazo####.com/x.png
- e-cha####.ir/show.php
- i####.te####.net/TS/Persian/Registration_V2/pix.png
- i####.te####.net/Ts/Persian/Registeration/left.gif
- i####.te####.net/Ts/Persian/Registeration/sabt.png
- i####.te####.net/Ts/rss.gif
- i####.te####.net/mainParts/persian/services/Advertisement/2017/6/14/New_...
- i####.te####.net/ts/1024/green/Header.png?seed=####
- i####.te####.net/ts/1024/green/Header_Footer.jpg?seed=####
- lib####.te####.net/image/WHrMenu.png
- src.te####.net/gen/js/ws/Services/GetSocketCount.js
- src.te####.net/gen/js/ws/Services/TebyanNotification.js
- src.te####.net/gen/js/ws/Services/TebyanSocketUser.js
- src.te####.net/gen/js/ws/TebyanWebSocket.js
- src.te####.net/proj/teb/js/Notification/UserNotification.js
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.google-####.com/plugins/ua/linkid.js
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/f_000044
- <Package Folder>/cache/####/f_000045
- <Package Folder>/cache/####/f_000046
- <Package Folder>/cache/####/f_000047
- <Package Folder>/cache/####/f_000048
- <Package Folder>/cache/####/f_000049
- <Package Folder>/cache/####/f_00004a
- <Package Folder>/cache/####/f_00004b
- <Package Folder>/cache/####/f_00004c
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
Miscellaneous:
Displays its own windows over windows of other applications.
