Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.906.origin
- Android.Triada.4567
- Android.Triada.510.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) d####.m####.com:13003
- TCP(TLS/1.0) v####.cz####.com:443
- TCP(TLS/1.0) kvinit-####.api.koc####.com:443
- TCP(TLS/1.0) d####.m####.com:13001
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) n####.w1####.com:443
- TCP(TLS/1.0) cdn.hey####.cloud:443
- TCP(TLS/1.0) firebas####.crashly####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) st####.what####.net:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) d####.m####.com:16001
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) con####.koc####.com:443
- TCP(TLS/1.0) wa.zc####.com:443
- TCP(TLS/1.0) cdn.za####.cloud:443
- TCP(TLS/1.0) dwq.fs####.com:443
- TCP(TLS/1.2) inte####.faceu####.com:6443
- TCP(TLS/1.2) safebro####.google####.com:443
- TCP(TLS/1.2) d####.fl####.com:443
- TCP(TLS/1.2) 64.2####.164.94:443
- TCP(TLS/1.2) pla####.google####.com:443
- TCP ads####.traffic####.com:443
- UDP firebas####.google####.com:443
- UDP safebro####.google####.com:443
- UDP www.gst####.com:443
DNS requests:
- 149.77.188.####.arpa
- 2.and####.p####.####.org
- 204.114.114.####.arpa
- ads####.traffic####.com
- and####.a####.go####.com
- and####.google####.com
- app-mea####.com
- cdn.hey####.cloud
- cdn.za####.cloud
- con####.koc####.com
- d####.fl####.com
- d####.m####.com
- dwq.fs####.com
- firebas####.crashly####.com
- firebas####.google####.com
- firebas####.google####.com
- firebas####.google####.com
- g####.r####.com
- gmscomp####.google####.com
- inte####.faceu####.com
- kvinit-####.api.koc####.com
- n####.w1####.com
- p####.google####.com
- pla####.google####.com
- safebro####.google####.com
- st####.what####.net
- v####.cz####.com
- vi####.wit####.com
- wa.zc####.com
- www.google####.com
- www.gst####.com
HTTP GET requests:
- cdn.hey####.cloud:443/res/am_stickers_emoji.zip
- cdn.hey####.cloud:443/res/cc_call_video.mp4
- cdn.hey####.cloud:443/res/lib/libjlibtorrent-1.2.14.1.so.7z
- cdn.za####.cloud:443/res/lib/faceunity-sdk-core-8.0.0-full.7z
- dwq.fs####.com:443/plugins/applh0723.zip
- dwq.fs####.com:443/plugins/dp2.zip
- dwq.fs####.com:443/plugins/yz058Uc30i0524.zip
- firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:548258886...
- n####.w1####.com:443/modellog/DFE98RW94TR98DSWEO5R.cl
- n####.w1####.com:443/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
- st####.what####.net:443/downloadable?category=####
- st####.what####.net:443/sticker?cat=####&lg=####&ver=####
- wa.zc####.com:443/waApi/getStatCfg?zt_channel=####&uuid=####
HTTP POST requests:
- con####.koc####.com:443/track/json
- d####.fl####.com:443/v1/flr.do
- d####.m####.com:13001/ck0k66o/
- d####.m####.com:13001/v1jyved/
- d####.m####.com:13003/84gcjmo/
- d####.m####.com:13003/v1jyved/
- d####.m####.com:16001/h7bj93/
- firebas####.google####.com:443/v1/projects/548258886856/namespaces/fireb...
- firebas####.google####.com:443/v1/projects/heymods-wa/installations
- kvinit-####.api.koc####.com:443/track/kvinit
- safebro####.google####.com:443/v1/firelog/legacy/batchlog
- v####.cz####.com:443/getjar/
- v####.cz####.com:443/getsol/
- wa.zc####.com:443/waApi/getStrategy
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
