Technical information
Malicious functions:
Sends SMS messages:
- 50501: 128909210
- 737471: 975352971
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) e-cha####.ir:80
- TCP(HTTP/1.1) img.te####.net:80
- TCP(HTTP/1.1) i####.te####.net:80
- TCP(HTTP/1.1) art####.te####.net:80
- TCP(HTTP/1.1) m####.webg####.ir:80
- TCP(TLS/1.0) d5nxst8####.cloudf####.net:443
- TCP(TLS/1.0) img.te####.net:443
- TCP(TLS/1.0) src.te####.net:443
- TCP(TLS/1.0) crea####.magneta####.com:443
- TCP(TLS/1.0) api.te####.net:443
- TCP(TLS/1.0) cdn.yekt####.com:443
- TCP(TLS/1.0) srv.magneta####.com:443
- TCP(TLS/1.0) i####.te####.net:443
- TCP(TLS/1.0) d31qbv1####.cloudf####.net:443
- TCP(TLS/1.0) lib####.te####.net:443
- TCP(TLS/1.0) f####.yekt####.com:443
- TCP(TLS/1.0) www.te####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) art####.te####.net:443
- TCP(TLS/1.0) c####.magneta####.com:443
DNS requests:
- a####.te####.net
- api.te####.net
- art####.te####.net
- c####.magneta####.com
- cdn.yekt####.com
- crea####.magneta####.com
- d31qbv1####.cloudf####.net
- d5nxst8####.cloudf####.net
- e-cha####.ir
- f####.yekt####.com
- i####.te####.net
- img.te####.net
- lib####.te####.net
- m####.webg####.ir
- src.te####.net
- srv.magneta####.com
- tr2.magneta####.com
- www.google-####.com
- www.te####.net
HTTP GET requests:
- art####.te####.net/271615/ثبت-نام-مجردها-در-سامانه-همسان-گزینی
- e-cha####.ir/show.php
- i####.te####.net/mainParts/persian/services/Advertisement/2017/6/14/New_...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
Miscellaneous:
Displays its own windows over windows of other applications.