Technical information
Malicious functions:
Downloads the following detected threats from the Internet:
- Android.BankBot.748.origin
Network activity:
Connects to:
- UDP(???) pla####.google####.com:443
- UDP(???) rr6---s####.g####.com:443
- UDP(???) and####.google####.com:443
- UDP(???) rr3---s####.g####.com:443
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pic.aiseewh####.a####.tv:80
- TCP(HTTP/1.1) uv.aiseewh####.a####.tv:80
- TCP(HTTP/1.1) vod.tv####.com.cn:80
- TCP(HTTP/1.1) rec.tv####.com.cn:80
- TCP(HTTP/1.1) i####.opensp####.cn:80
- TCP(HTTP/1.1) api.tv####.com.cn:80
- TCP(HTTP/1.1) pic.agino####.com:80
- TCP(TLS/1.0) rr3---s####.g####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) playsto####.google####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) 1####.250.150.105:443
- TCP(TLS/1.2) playsto####.google####.com:443
- TCP(TLS/1.2) 74.1####.205.102:443
DNS requests:
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- api.tv####.com.cn
- connect####.gst####.com
- d####.aiseewh####.a####.tv
- d####.aiseewh####.a####.tv
- d####.tv####.com.cn
- d####.tv####.com.cn
- devicei####.google####.com
- firebas####.google####.com
- i####.opensp####.cn
- i.y####.com
- ms.tv####.com.cn
- p####.aiseewh####.a####.tv
- p####.aiseewh####.a####.tv
- p####.aiseewh####.a####.tv
- p####.aiseewh####.a####.tv
- p####.google####.com
- pass####.tv####.com.cn
- pic.agino####.com
- pic.aiseewh####.a####.tv
- pic.tv####.com.cn
- pla####.google####.com
- pla####.googleu####.com
- playsto####.google####.com
- prod-lt####.google####.com
- rec.tv####.com.cn
- rr3---s####.g####.com
- rr6---s####.g####.com
- rr6---s####.g####.com
- u.tv####.com.cn
- uv.aiseewh####.a####.tv
- v####.tv####.com.cn
- vod.mo####.com.cn
- vod.tv####.com.cn
- wl####.agino####.com
- www.google####.com
HTTP GET requests:
- api.tv####.com.cn/Service/findLocation
- api.tv####.com.cn/Service/getDate.jsp
- api.tv####.com.cn/date/now
- api.tv####.com.cn/quality/
- api.tv####.com.cn/weather/sixday/?full=####
- i####.opensp####.cn/v3/registerapp/?&firm=####&devid=####&tvmodel=####&v...
- pic.agino####.com/case/getNormalUrl?url=https://account.moretv.com.cn/lo...
- pic.agino####.com/case/getWxUrl?mac=####&userid=####&connectid=####&pinc...
- pic.aiseewh####.a####.tv/20150915/20150915150954435.png
- pic.aiseewh####.a####.tv/20181112/20181112120016779_600x338.png
- pic.aiseewh####.a####.tv/20190328/20190328135635849_600x338.jpg
- pic.aiseewh####.a####.tv/20251102/20251102080402593.jpg
- pic.aiseewh####.a####.tv/20260124/20260124134632705_492x348.jpg
- pic.aiseewh####.a####.tv/20260209/20260209140414771_230x348.jpg
- pic.aiseewh####.a####.tv/20260213/20260213111009921_230x348.jpg
- pic.aiseewh####.a####.tv/20260213/20260213143220168_230x348.jpg
- pic.aiseewh####.a####.tv/Service/getDate.jsp
- pic.aiseewh####.a####.tv/getQrcode?type=####&moretvid=####&userid=####&m...
- pic.aiseewh####.a####.tv/login/Service/enlogin?mac=####&WifiMac=####&use...
- pic.aiseewh####.a####.tv/loopOldVersionAccount?type=####&connectid=####
- pic.aiseewh####.a####.tv/upgrade/Service/JudgePlatform?platformModel=####
- pic.aiseewh####.a####.tv/upgrade/Service/LoginPic?plateformType=####&pro...
- pic.aiseewh####.a####.tv/upgrade/Service/Setting?mac=####&WifiMac=####&u...
- pic.aiseewh####.a####.tv/upgrade/Service/channelBlackList?mac=####&wifiM...
- pic.aiseewh####.a####.tv/upgrade/Service/component?componenttype=####
- pic.aiseewh####.a####.tv/upgrade/Service/component?ver=####&from=####
- pic.aiseewh####.a####.tv/upgrade/Service/upgrade?version=####&mac=####&s...
- pic.aiseewh####.a####.tv/uploadlog/?log=####
- pic.aiseewh####.a####.tv/uploadlog/?log=####&location=####
- pic.aiseewh####.a####.tv/user/Service/getCollectByType?userType=####&uid...
- pic.aiseewh####.a####.tv/user/Service/getCollectsAll?userType=####&uid=#...
- pic.aiseewh####.a####.tv/user/Service/getHistoriesByCreateTimeDes?userTy...
- pic.aiseewh####.a####.tv/user/Service/getHistoryUpdate?userType=####&uid...
- pic.aiseewh####.a####.tv/user/Service/getKidsMessages?userType=####&uid=...
- pic.aiseewh####.a####.tv/user/Service/getMaoerges?userType=####&uid=####...
- pic.aiseewh####.a####.tv/user/Service/getMatchs?uid=####&token=####&user...
- pic.aiseewh####.a####.tv/user/Service/getMessagesNew?userType=####&uid=#...
- pic.aiseewh####.a####.tv/user/Service/getSubPrograms?uid=####&userType=#...
- pic.aiseewh####.a####.tv/user/Service/getTags?uid=####&token=####&userTy...
- pic.aiseewh####.a####.tv/web/device?userid=####&ip=####&port=####&name=#...
- rec.tv####.com.cn/hotlist/otherWatchedMovie/5/4
- uv.aiseewh####.a####.tv/ruaupdate/20191128/dynamic_1.2.65.zip
- uv.aiseewh####.a####.tv/ruaupdate/20220615/lua_src_2.34.13.zip
- uv.aiseewh####.a####.tv/version/20230814/MoreTV_4.1.9_41901_20230811_114...
- vod.tv####.com.cn/20181127/20181127142734636.jpg
- vod.tv####.com.cn/Service/HomePage?promotionChannel=####&modelGroupCode=...
- vod.tv####.com.cn/Service/V2/findChannelGroup?defendVersion=####
- vod.tv####.com.cn/api_meta?sids=####
File system changes:
Creates the following files:
- /data/app/####/.x86_64
- /data/app/####/com.android.vending.apk
- /data/app/####/config.en
- /data/app/####/config.x86_64
- /data/app/####/libandroidx.graphics.path.so
- /data/app/####/libapkanalysis.so
- /data/app/####/libbrotli.so
- /data/app/####/libcronet.145.0.7582.0.so
- /data/app/####/libmappedcountercacheversionjni.so
- /data/app/####/libtensorflowlite_jni.so
- /data/app/####/libzucchini.so
- /data/app/####/libzwrapper.so
- /data/data/####/2tgbaaok1fxo2oqwpfh1rmkym
- /data/data/####/7fr5x54e8aa4p4nybkuppzft1
- /data/data/####/7fr5x54e8aa4p4nybkuppzft1.tmp
- /data/data/####/MoreTV.apk
- /data/data/####/UpdateCheck.xml
- /data/data/####/appInfo.xml
- /data/data/####/appInfo.xml.bak
- /data/data/####/com.moretv.android_preferences.xml
- /data/data/####/crypto.dex
- /data/data/####/crypto.dex.flock (deleted)
- /data/data/####/dynamic.json
- /data/data/####/dynamic.xml
- /data/data/####/dynamic.zip
- /data/data/####/dynamic_wrapper.dex
- /data/data/####/dynamic_wrapper.dex.flock (deleted)
- /data/data/####/key.dat
- /data/data/####/kids.zip (deleted)
- /data/data/####/libsecurities_sdk.so
- /data/data/####/liburlauth.so
- /data/data/####/luaSrcTmp.zip
- /data/data/####/moretv_data-journal
- /data/data/####/moretv_httpData-journal
- /data/data/####/pptv_key.dex
- /data/data/####/pptv_key.dex.flock (deleted)
- /data/data/####/proc_auxv
- /data/data/####/sohu.dex
- /data/data/####/sohu.dex.flock (deleted)
- /data/data/####/sports.zip (deleted)
- /data/media/####/-1248250611
- /data/media/####/-1978305020
- /data/media/####/-535658945
- /data/media/####/.nomedia
- /data/media/####/1530102830
- /data/media/####/1618502908
- /data/media/####/1703246900
- /data/media/####/1734331211
- /data/media/####/492246781
- /data/media/####/9301160
Miscellaneous:
Executes the following shell scripts:
- ps 5033
- ps 5286
Loads the following dynamic libraries:
- libluajava_moretv
- libmoretv
- libsecurities_sdk
- libsecurity
Displays its own windows over windows of other apps.
Requests the system alert window permission.
Attempts to detect sandbox environment.
