Technical information
Malicious functions:
Sends SMS messages:
- 50501: 128362929
- 737471: 175657949
- 83215: 128362929
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) aa45f8a####.pro####.j####.####.net:80
- TCP(HTTP/1.1) e-cha####.ir:80
- TCP(HTTP/1.1) lib####.te####.net:80
- TCP(HTTP/1.1) a3a95f5####.pro####.b####.####.net:80
- TCP(HTTP/1.1) img.te####.net:80
- TCP(HTTP/1.1) cloudfr####.amazo####.com:80
- TCP(HTTP/1.1) m####.webg####.ir:80
- TCP(HTTP/1.1) i####.te####.net:80
- TCP(HTTP/1.1) www.te####.net:80
- TCP(HTTP/1.1) src.te####.net:80
- TCP(HTTP/1.1) art####.te####.net:80
- TCP(HTTP/1.1) a33e779####.pro####.n####.####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) d5nxst8####.cloudf####.net:443
- TCP(TLS/1.0) img.te####.net:443
- TCP(TLS/1.0) src.te####.net:443
- TCP(TLS/1.0) crea####.magneta####.com:443
- TCP(TLS/1.0) api.te####.net:443
- TCP(TLS/1.0) cdn.yekt####.com:443
- TCP(TLS/1.0) srv.magneta####.com:443
- TCP(TLS/1.0) i####.te####.net:443
- TCP(TLS/1.0) f####.yekt####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) www.te####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) lib####.te####.net:443
- TCP(TLS/1.0) art####.te####.net:443
- TCP(TLS/1.0) d31qbv1####.cloudf####.net:443
- TCP(TLS/1.0) c####.magneta####.com:443
DNS requests:
- a####.te####.net
- a33e779####.pro####.n####.####.net
- a3a95f5####.pro####.b####.####.net
- aa45f8a####.pro####.j####.####.net
- api.te####.net
- art####.te####.net
- c####.magneta####.com
- cdn.yekt####.com
- cloudfr####.amazo####.com
- crea####.magneta####.com
- d31qbv1####.cloudf####.net
- d5nxst8####.cloudf####.net
- e-cha####.ir
- f####.yekt####.com
- i####.te####.net
- img.te####.net
- lib####.te####.net
- m####.webg####.ir
- s####.g.doublec####.net
- src.te####.net
- srv.magneta####.com
- tr2.magneta####.com
- www.google-####.com
- www.te####.net
HTTP GET requests:
- art####.te####.net/271615/ثبت-نام-مجردها-در-سامانه-همسان-گزینی
- art####.te####.net/378353/قباد-پادشاهی-که-فراموش-شد
- art####.te####.net/5114/ارتباط-با-ما
- cloudfr####.amazo####.com/x.png
- e-cha####.ir/show.php
- i####.te####.net/Small/1396/06/17024728562024353171195479722211919555105...
- i####.te####.net/TS/Persian/Registration_V2/pix.png
- i####.te####.net/Ts/Persian/Registeration/left.gif
- i####.te####.net/Ts/Persian/Registeration/sabt.png
- i####.te####.net/Ts/rss.gif
- i####.te####.net/big/1396/07/2379171621579817652216118109213161209157.jpg
- i####.te####.net/mainParts/persian/services/Advertisement/2017/6/14/New_...
- i####.te####.net/small/1396/07/11811852253289252150461164011613322523117...
- i####.te####.net/small/1396/07/13337102412924931591141872121411603818914...
- i####.te####.net/small/1396/07/14923224222915120472157166137172241302208...
- i####.te####.net/small/1396/07/2379171621579817652216118109213161209157....
- i####.te####.net/small/1396/07/24222011002047314041441052292197156149199...
- i####.te####.net/small/1396/07/35161218971331602202128016570939524025043...
- i####.te####.net/small/1396/07/436812060137127761211864217818411171131.jpg
- i####.te####.net/small/1396/07/56101537824617010113021737140318216216666...
- i####.te####.net/small/1396/07/57842162521246216115232191112492141718020...
- i####.te####.net/small/1396/07/77191771710787662151851811209225116125166...
- i####.te####.net/ts/1024/green/Header.png?seed=####
- i####.te####.net/ts/1024/green/Header_Footer.jpg?seed=####
- lib####.te####.net/image/BHrMenu.png
- lib####.te####.net/image/WHrMenu.png
- src.te####.net/gen/js/ws/Services/GetSocketCount.js
- src.te####.net/gen/js/ws/Services/TebyanNotification.js
- src.te####.net/gen/js/ws/Services/TebyanSocketUser.js
- src.te####.net/gen/js/ws/TebyanWebSocket.js
- src.te####.net/proj/teb/js/Notification/UserNotification.js
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.google-####.com/collect?v=1&_v=j64&a=1020901133&t=pageview&_s=1&dl=h...
- www.google-####.com/plugins/ua/linkid.js
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/f_000044
- <Package Folder>/cache/####/f_000045
- <Package Folder>/cache/####/f_000046
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
Miscellaneous:
Displays its own windows over windows of other applications.
