Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.101.origin
- Android.HiddenAds.67.origin
Network activity:
Connecting to:
- s####.####.com
- go####.com
- u####.####.com
- busi####.####.com
- mo####.####.com
- i####.####.com
- d####.####.com
- pl####.####.com
- real####.####.org
- acc####.####.com
- a####.####.org
- mobile-####.####.com
- gl####.####.com
- t####.####.info
- a####.####.com
- bro####.####.fyi
HTTP GET requests:
- a####.####.com/strategy/api/v1/game/get?la=####&pt=####&sv=####&ch=####&...
- s####.####.com/mbrowser/guanxing/website/imgs/v5/d2570c0ef3e142218002c96...
- a####.####.com/strategy/api/v1/adv/get?la=####&pt=####&sv=####&ch=####&a...
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub####&af...
- acc####.####.com/browser/conf/global
- bro####.####.fyi/search
- a####.####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=####&sd...
- mobile-####.####.com/mbrowser/popup/getPopup?api=####&pt=####&co=####&la...
- i####.####.com/sorry/index?continue=####&q=####
- s####.####.com/mbrowser/guanxing/Sug/images/c53da90440434c71acb30955588e...
- u####.####.com/postback/getOfferjurl?info=####&adc=####&retry=####
- s####.####.com/mbrowser/guanxing/website/imgs/v5/c16fa9da40d6496aaf3d0e0...
- u####.####.com/index.php/OfferList/getOfferListNew?start=####&limit=####...
- t####.####.info/click?_type=####&sdk_redir=####&campid=####&sub_channel=...
- mobile-####.####.com/mbrowser/management/apk_version_update.do?&api=####...
- acc####.####.com/browser/search?cc=####&q=####
- a####.####.org/rule?platform=####&os_version=####&package_name=####&app_...
- mobile-####.####.com/mbrowser/sug/list?pt=####&co=####&la=####&ch=####&a...
- mobile-####.####.com/mbrowser/deeplink/getLinkedApps?pack=####
- mobile-####.####.com/mbrowser/management/config.do?api=####&pt=####&co=#...
- go####.com/search?q=####
- mobile-####.####.com/mbrowser/home/getContentCardConfig?api=####&pt=####...
- mobile-####.####.com/mbrowser/home/getContentCardData?api=####&pt=####&c...
- go####.com/complete/search?output=####&q=####&oe=####
- d####.####.com/M01/01/A9/CvJMDVkRjnCAHd75AAP-f5xf2zM635.zip
- mobile-####.####.com/mbrowser/search/hotword?api=####&pt=####&co=####&la...
- mobile-####.####.com/mbrowser/getlist?api=####&pt=####&co=####&la=####&c...
- mobile-####.####.com/mbrowser/nav.do?api=####&pt=####&co=####&la=####&ch...
- s####.####.com/mbrowser/guanxing/website/imgs/v5/b4e576b5aaed4115ad059e9...
- s####.####.com/mbrowser/guanxing/website/imgs/v5/c156b56dafda469abe920d6...
- mo####.####.com/
- real####.####.org/realtime?platform=####&os_version=####&package_name=##...
- mobile-####.####.com/mbrowser?function=####&ver=####&dver=####&cuid=####...
- i####.####.com/public/uploads/store_3/a/7/d/a7d1f062a204a0194505c3d1069f...
- a####.####.com/strategy/api/v1/ad/url/get?la=####&pt=####&sv=####&ch=###...
- a####.####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pro...
- u####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&prod...
- acc####.####.com/browser/stat?q=####
HTTP POST requests:
- pl####.####.com/ad_dex.php
- busi####.####.com/business/active
- mobile-####.####.com/mbrowser/stat/act.do
- mobile-####.####.com/heartbeat/stat/pv.do
- s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- busi####.####.com/business/click
- busi####.####.com/business/impression
- mobile-####.####.com/mbrowser/stat/pv.do
Miscellaneous:
Contains functionality to send SMS messages automatically.
