Technical information
Malicious functions:
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) en####.webg####.ir:80
- TCP(HTTP/1.1) l####.saman####.ir:80
- TCP(HTTP/1.1) s10.his####.com.####.me:80
- TCP(HTTP/1.1) s4.his####.com:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) koha####.com:80
- TCP(HTTP/1.1) 4.i####.me:80
- TCP(HTTP/1.1) www.webg####.com:80
- TCP(HTTP/1.1) www.webg####.ir:80
- TCP(HTTP/1.1) api.p####.co:80
- TCP(HTTP/1.1) 1.grav####.com:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) wtfis####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) 1####.217.20.110:443
- TCP(TLS/1.0) f####.google####.com:443
DNS requests:
- 1.grav####.com
- 4.i####.me
- api.p####.co
- ca.p####.ir
- en####.webg####.ir
- f####.google####.com
- f####.gst####.com
- i####.me
- koha####.com
- l####.saman####.ir
- mt####.go####.com
- s10.his####.com
- s4.his####.com
- wtfis####.com
- www.go####.com
- www.gst####.com
- www.koha####.com
- www.webg####.com
- www.webg####.ir
HTTP GET requests:
- 1.grav####.com/avatar/a5b1ca24f48d534ab2b72116427195f6?s=####&d=####&r=#...
- 4.i####.me/json
- api.p####.co/static/popupmodal.css
- api.p####.co/static/popupmodal.js
- api.p####.co/static/webpush-http.js
- en####.webg####.ir/c.aspx?Code=####&t=####
- en####.webg####.ir/counter/xstat.aspx?t=####&code=####&rnd=####&s=####&c...
- f####.google####.com/css?family=####&subset=####&ver=####
- koha####.com/fa/apps
- koha####.com/fa/apps/
- koha####.com/favicon.ico
- koha####.com/pip
- koha####.com/pip/
- koha####.com/wp-content/plugins/akismet/_inc/form.js?ver=####
- koha####.com/wp-content/plugins/contextual-related-posts/css/default-sty...
- koha####.com/wp-content/plugins/easy-digital-downloads/assets/js/edd-aja...
- koha####.com/wp-content/plugins/easy-digital-downloads/templates/edd.min...
- koha####.com/wp-content/plugins/menu-icons/css/extra.min.css?ver=####
- koha####.com/wp-content/plugins/revslider/public/assets/css/settings.css...
- koha####.com/wp-content/plugins/revslider/public/assets/js/jquery.themep...
- koha####.com/wp-content/plugins/wordpress-popular-posts/public/css/wpp.c...
- koha####.com/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4....
- koha####.com/wp-content/themes/kohanweb/css/responsive.css?ver=####
- koha####.com/wp-content/themes/kohanweb/css/rtl.css?ver=####
- koha####.com/wp-content/themes/kohanweb/css/style.css?ver=####
- koha####.com/wp-content/themes/kohanweb/framework/css/font-awesome.css?v...
- koha####.com/wp-content/themes/kohanweb/framework/css/font-mdfi.css?ver=...
- koha####.com/wp-content/themes/kohanweb/framework/css/us-base.css?ver=####
- koha####.com/wp-content/themes/kohanweb/framework/fonts/fontawesome-webf...
- koha####.com/wp-content/themes/kohanweb/framework/fonts/mdfonticon.ttf
- koha####.com/wp-content/themes/kohanweb/framework/fonts/yekan.ttf
- koha####.com/wp-content/themes/kohanweb/framework/js/imagesloaded.js?ver...
- koha####.com/wp-content/themes/kohanweb/framework/js/jquery.easing.min.j...
- koha####.com/wp-content/themes/kohanweb/framework/js/jquery.magnific-pop...
- koha####.com/wp-content/themes/kohanweb/framework/js/jquery.simpleplaceh...
- koha####.com/wp-content/themes/kohanweb/framework/js/us.core.js?ver=####
- koha####.com/wp-content/themes/kohanweb/framework/js/us.widgets.js?ver=#...
- koha####.com/wp-content/themes/kohanweb/framework/vendor/royalslider/jqu...
- koha####.com/wp-content/themes/kohanweb/framework/vendor/royalslider/roy...
- koha####.com/wp-content/themes/kohanweb/js/us.theme.js?ver=####
- koha####.com/wp-content/themes/kohanweb/rtl.css
- koha####.com/wp-content/uploads/BestNovels.png
- koha####.com/wp-content/uploads/BestNovels2.png
- koha####.com/wp-content/uploads/BestNovels3-150x150.png
- koha####.com/wp-content/uploads/BestNovels3-350x350.png
- koha####.com/wp-content/uploads/FalHafez1.png
- koha####.com/wp-content/uploads/Kids-Dress.png
- koha####.com/wp-content/uploads/Profile-150x150.png
- koha####.com/wp-content/uploads/Profile-350x350.png
- koha####.com/wp-content/uploads/download1.png
- koha####.com/wp-content/uploads/download3.png
- koha####.com/wp-content/uploads/jokenorouz.png
- koha####.com/wp-content/uploads/pip-350x350.png
- koha####.com/wp-content/uploads/pip.png
- koha####.com/wp-content/uploads/police-150x150.png
- koha####.com/wp-content/uploads/police-350x350.png
- koha####.com/wp-content/uploads/smile_fonts/Defaults/Defaults.css?ver=####
- koha####.com/wp-content/uploads/tanz-150x150.png
- koha####.com/wp-content/uploads/tanz-350x350.png
- koha####.com/wp-content/uploads/tarsnak-150x150.png
- koha####.com/wp-content/uploads/tarsnak-350x350.png
- koha####.com/wp-content/uploads/tele-mebestnovels-150x150.png
- koha####.com/wp-content/uploads/wordpress-popular-posts/166-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/343-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/393-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/469-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/481-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/513-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/545-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/551-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/552-featured-80x...
- koha####.com/wp-content/uploads/wordpress-popular-posts/575-featured-80x...
- koha####.com/wp-includes/css/dashicons.min.css?ver=####
- koha####.com/wp-includes/fonts/dashicons.ttf
- koha####.com/wp-includes/js/comment-reply.min.js?ver=####
- koha####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- koha####.com/wp-includes/js/jquery/jquery.js?ver=####
- koha####.com/wp-includes/js/wp-embed.min.js?ver=####
- koha####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
- l####.saman####.ir/logo.aspx?id=####&p=####
- s10.his####.com.####.me/js15.js
- s4.his####.com/stats/0.php?313####&@####&@####&@####&@####&@j15473####&@...
- www.webg####.com/counter/pic/stat5.gif
- www.webg####.ir/c.aspx?Code=####&t=####
HTTP POST requests:
- koha####.com/wp-json/wordpress-popular-posts/v1/popular-posts/
File system changes:
Creates the following files:
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/unsent_requests
Miscellaneous:
Gets information about location.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
