Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Was.1.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) api.ad.xi####.####.net:80
- TCP(HTTP/1.1) g####.62####.com:8001
- TCP(HTTP/1.1) a.da####.com:9127
- TCP(HTTP/1.1) suggest####.k####.com:80
- TCP(TLS/1.0) static-####.edg####.net:443
- TCP(TLS/1.0) events####.adco####.com:443
- TCP(TLS/1.0) prd-le####.cdp.inte####.####.com:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) i####.superso####.com:443
- TCP(TLS/1.0) android####.adco####.com:443
- TCP(TLS/1.0) eve####.adco####.com:443
- TCP(TLS/1.0) networ####.ss####.com:443
- TCP(TLS/1.0) sdkco####.ad.xi####.com:443
- TCP(TLS/1.0) co####.uca.c####.####.com:443
- TCP(TLS/1.0) 64.2####.164.95:443
- TCP(TLS/1.0) f.ma####.mi####.####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) adc3-la####.adco####.com:443
- TCP(TLS/1.0) wd.adco####.com:443
- TCP(TLS/1.0) z####.ad.xi####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) pm-gat####.superso####.com:443
- TCP(TLS/1.0) f.ma####.c.####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) l####.iro####.mobi:443
- TCP(TLS/1.2) 64.2####.162.139:443
- TCP firebas####.crashly####.com:443
DNS requests:
- a.da####.com
- adc-ad-####.ad####.com
- adc3-la####.adco####.com
- android####.adco####.com
- api.ad.xi####.com
- app-mea####.com
- c4d####.adco####.com
- cdn.appsups####.com
- cdp.c####.uni####.com
- co####.uca.c####.####.com
- eve####.adco####.com
- events####.adco####.com
- f3.ma####.xi####.com
- f5.ma####.mi####.com
- firebas####.crashly####.com
- firebas####.google####.com
- firebas####.google####.com
- g####.62####.com
- g####.face####.com
- googl####.g.doublec####.net
- i####.superso####.com
- l####.iro####.mobi
- m####.go####.com
- networ####.ss####.com
- outcome####.superso####.com
- pm-gat####.superso####.com
- sdkco####.ad.xi####.com
- wd.adco####.com
- www.face####.com
- z####.ad.xi####.com
HTTP GET requests:
- a.da####.com:9127/ll/gs?baseversion=####&version=####&channel=####&appid...
- f.ma####.c.####.com:443/download/AdCenter/0daf4e46c0867466ca319f831b2e3a...
- f.ma####.mi####.####.com:443/download/AdCenter/0daf4e46c0867466ca319f831...
- i####.superso####.com:443/sdk/v7.1.1?request####
- networ####.ss####.com:443/mobileSDKController/mobileController.html
- sdkco####.ad.xi####.com:443/api/checkupdate/lastusefulversion2?av=####&c...
- static-####.edg####.net:443/adc/3.11.0/b5/abd3a46e440a34b4b43b0a20ad970b...
- static-####.edg####.net:443/launch-rules/production/__controllers__/4.0....
- static-####.edg####.net:443/launch/__controllers__/4.0.0/2.2.0.2/ADCAdUn...
- static-####.edg####.net:443/launch/__libs__/legacy-mraid-3x/2.2.3/ADCMRA...
- static-####.edg####.net:443/launch/__libs__/omsdk/1.3.4/omsdk-v1.js
- static-####.edg####.net:443/libs/adunit-banner/1.4.0/c0fe21537985207c3e1...
- static-####.edg####.net:443/libs/adunit/3.9.6/0345e729e33c8e9964dd34ebf2...
- static-####.edg####.net:443/libs/composer/3.11.0/0f17c16a07c5f1381db0347...
- static-####.edg####.net:443/libs/interstitial-mraid/3.9.6/5dfe98c747773a...
- static-####.edg####.net:443/omw-ads/image/7e/f815b7d6ab1c3db7d0381f065bf...
- static-####.edg####.net:443/output_sdk_assets/end-card-close-normal-x2.png
- suggest####.k####.com/Gaming/gaming_exit.json
HTTP POST requests:
- a.da####.com:9127/ll//uu?t=####
- adc3-la####.adco####.com:443/v4/launch
- android####.adco####.com:443/configure
- api.ad.xi####.####.net/union/fetchAds
- eve####.adco####.com:443/t/5.0/install?pl=####
- events####.adco####.com:443/t/5.0/session_start?pl=####
- f.ma####.c.####.com:443/mediation?adUnit=####&sessionId=####&appKey=####
- f.ma####.c.####.com:443/mediation?adUnit=####&sessionId=####&appKey=####...
- firebas####.google####.com:443/v1/projects/479877390937/namespaces/fireb...
- firebas####.google####.com:443/v1/projects/mega-ramps---galaxy-race-3b55...
- g####.62####.com:8001/adStatistics
- g####.62####.com:8001/addNewApp
- g####.62####.com:8001/gameState
- pm-gat####.superso####.com:443/auction?appKey=####&SDKVersion=####&initC...
- wd.adco####.com:443/logs
- z####.ad.xi####.com:443/client/upgrade/mimo/v1
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
