Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dangbei.1.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) es####.dan####.net:80
- TCP(HTTP/1.1) devic####.api.m####.com:80
- TCP(HTTP/1.1) log-re####.com:80
- TCP(HTTP/1.1) up####.dan####.net:80
- TCP(HTTP/1.1) imghlsp####.y####.m####.com:80
- TCP(HTTP/1.1) sm.tv####.com:80
- TCP(HTTP/1.1) 360####.org:80
- TCP(HTTP/1.1) dbi####.ty####.com:80
- TCP(HTTP/1.1) apihlsp####.y####.m####.com:80
- TCP(TLS/1.0) apihls####.y####.m####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) dbi####.ty####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) cloud-i####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) c####.x####.com:443
- TCP(TLS/1.0) sto####.google####.com:443
- TCP(TLS/1.0) bellalu####.s3.ap-ea####.####.com:443
- TCP(TLS/1.0) av1.x####.com:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.2) 2####.58.208.99:443
- TCP(TLS/1.2) 1####.217.17.138:443
DNS requests:
- 240.64.89.####.arpa
- 360####.org
- 360####.org.8.####.8
- and####.cli####.go####.com
- and####.google####.com
- and####.google####.com.####.8
- apihls####.y####.m####.####.8
- apihls####.y####.m####.com
- apihls####.y####.m####.com
- apihlsp####.y####.m####.com
- apihlsp####.y####.m####.com
- av1.x####.com
- bellalu####.s3.ap-ea####.####.8
- bellalu####.s3.ap-ea####.####.com
- c####.x####.com
- c####.x####.com
- chec####.cc
- cloud-i####.oss-cn-####.aliy####.com
- dbi####.ty####.com
- devic####.api.m####.com
- e####.ty####.com
- e####.ty####.com
- e####.z####.net
- e####.z####.net.####.8
- es####.dan####.net
- es####.dan####.net.####.8
- esw.ty####.com
- imghlsp####.y####.m####.com
- log-re####.com
- m####.go####.com
- p####.google####.com
- p####.x####.com
- plb####.u####.com
- sdkt####.hu####.com
- sdkt####.hu####.com.####.8
- sm.tv####.com
- st####.tin####.com
- st####.tin####.com.####.8
- sto####.google####.com
- u####.u####.com
- up####.dan####.net
- w####.hu####.com
- www.google####.com
- www.google####.com.####.8
HTTP GET requests:
- 360####.org/feature/config?api_version=####&app_id=####&app_version=####...
- 360####.org/jd?a=####&av=####&d=####&p=####&v=####&vc=####
- dbi####.ty####.com/connect
- dbi####.ty####.com/dbGold/v1/sdkSwitch.do?appkey=####&channel=####&devic...
- dbi####.ty####.com/v109/index/getconfig?packagename=####&deviceEid=####&...
- imghlsp####.y####.m####.com/admin/2020-01-08/E863CAF5-0ECA-088D-62A0-AD4...
- imghlsp####.y####.m####.com/admin/2020-03-31/1A0AC08D-7247-A64B-6D4C-4F1...
- imghlsp####.y####.m####.com/admin/2020-05-21/2AE74040-4ADB-6358-C89F-95B...
- imghlsp####.y####.m####.com/admin/2020-05-21/91E5A6C7-C8E8-D7CC-CD3A-36D...
- imghlsp####.y####.m####.com/admin/2020-07-31/6490E155-CC9A-14E3-FD38-9D1...
- imghlsp####.y####.m####.com/admin/2020-11-09/E9812971-299E-8DB3-9E52-C66...
- imghlsp####.y####.m####.com/admin/2020-12-16/59890D1A-336B-8E64-D5BC-57D...
- imghlsp####.y####.m####.com/admin/2020-12-29/48229E13-8CFE-19D5-0627-C71...
- imghlsp####.y####.m####.com/admin/2020-12-31/B91572D3-73B9-98C1-F09F-137...
- imghlsp####.y####.m####.com/admin/2021-01-18/EB709303-C946-686C-88AD-A4F...
- imghlsp####.y####.m####.com/admin/2021-01-20/41186E86-4894-D192-F20A-FFF...
- imghlsp####.y####.m####.com/admin/2021-02-07/EF184A61-6B57-6F8E-5E21-9BA...
- imghlsp####.y####.m####.com/admin/2021-02-18/05589305-F970-C740-311C-8E4...
- imghlsp####.y####.m####.com/admin/2021-02-22/F2CECF74-9C94-BDDF-44E8-3C1...
- imghlsp####.y####.m####.com/admin/2021-02-24/22D132BC-D8E5-FD26-C2F8-9FC...
- imghlsp####.y####.m####.com/admin/2021-02-25/060BF2DE-019A-0AFD-06FD-C9E...
- imghlsp####.y####.m####.com/admin/2021-02-25/06FEB5B4-0D84-C3F7-1517-ADA...
- imghlsp####.y####.m####.com/admin/2021-02-25/13D44A9B-A3B9-0E42-6A0E-5C5...
- imghlsp####.y####.m####.com/admin/2021-02-25/407BBA75-6BAD-BC7F-4CA8-F7B...
- imghlsp####.y####.m####.com/admin/2021-02-25/B44D5F96-74C5-09F1-E749-B87...
- imghlsp####.y####.m####.com/tv/2020-05-11/4d802d6618ff49071e35ca10f87fe9...
- sm.tv####.com/v105/h5/url
- sm.tv####.com/v107/file/get_bg_img
- sm.tv####.com/v114/file/get_start_resource
- up####.dan####.net/api/updatea?deviceE####&token=####&appkey=####&sdkver...
HTTP POST requests:
- apihlsp####.y####.m####.com/v102/tv/recommend_open
- dbi####.ty####.com/dbGold/v1/deviceRegister.do
- dbi####.ty####.com/dbGold/v1/liveReveal.do
- dbi####.ty####.com/index/dbid
- dbi####.ty####.com/v109/index/statistics
- devic####.api.m####.com/v1/facserver/license/spauth
- es####.dan####.net/dbzs/m1/appActiveInfo.do
- es####.dan####.net/dbzs/m1/appInfo.do
- log-re####.com/report
- sm.tv####.com/sdk/sdktj
- sm.tv####.com/v112/nav/recommend
- sm.tv####.com/v112/tv/recommend_logout
Miscellaneous:
Uses special library to hide executable bytecode.
