{
	"id": "1a58dd33-3b2f-4f0c-a152-23f3634b3ed3",
	"created_at": "2026-04-06T00:19:51.635561Z",
	"updated_at": "2026-04-10T03:22:11.763274Z",
	"deleted_at": null,
	"sha1_hash": "9b0de9ea7e823c636c6f46256348b04432d93f22",
	"title": "A look at an Android bot from unpacking to DGA",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1240353,
	"plain_text": "A look at an Android bot from unpacking to DGA\r\nBy Jason Reaves\r\nPublished: 2021-03-05 · Archived: 2026-04-05 18:54:42 UTC\r\nPress enter or click to view image in full size\r\nRecently noticed large campaigns spreading Android malware which have been followed by both\r\nMalwareHunterTeam and Daniel Lopez[1]. Taking a quick glance at the manifest shows they are definitely packed\r\nas some of the manifest is referencing code that doesn’t exist in ‘com.example.myapplicationtest’.\r\nTo unpack it statically we just need to figure out where the next DEX file is stored at and how to decode it, the\r\nfirst thing I notice is the strings are encoded in sub functions:\r\npublic static String arenalake() {\r\n int i = 624;\r\n for (int i2 = 0; i2 \u003c 16; i2++) {\r\n i = 2517;\r\n }\r\n byte[] bArr = new byte[]{(byte) 65, (byte) 82, (byte) 80, (byte) 86, (byte) 19, (byte) 80, (b\r\n int i3 = 119;\r\n for (int i4 = 0; i4 \u003c 20; i4++) {\r\n i3 = (482832 / i) + 87;\r\n }\r\n byte[] bArr2 = new byte[14];\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 1 of 62\n\nint i5 = (i - 499322) + (290129 * i3);\r\n byte[] bArr3 = new byte[]{(byte) 51};\r\n int i6 = i;\r\n for (i = 0; i \u003c 1; i++) {\r\n i6 = ((i5 - i3) + 197680) + 571102;\r\n }\r\n if (i6 != i3) {\r\n i3 = ((815022 / i5) + 408432) - i6;\r\n }\r\n if (i5 \u003c= i3) {\r\n i5 = (i3 + (i6 * 56)) - 44;\r\n }\r\n for (i = 0; i \u003c 17; i++) {\r\n i3 = 112184 / i5;\r\n }\r\n for (i = 0; i \u003c 14; i++) {\r\n bArr2[i] = (byte) (bArr[i] ^ bArr3[i % 1]);\r\n }\r\n for (int i7 = 0; i7 \u003c 33; i7++) {\r\n }\r\n return new String(bArr2);\r\n }\r\nWe can decode these as simple arrays of bytes with a XOR key:\r\n\u003e\u003e\u003e a = [65, 82, 80,86,19,80,92,93,87,90,71,90,92,93]\r\n\u003e\u003e\u003e b = bytearray(''.join(map(chr,a)))\r\n\u003e\u003e\u003e b\r\nbytearray(b'ARPV\\x13P\\\\]WZGZ\\\\]')\r\n\u003e\u003e\u003e map(lambda x: x^51,b)\r\n[114, 97, 99, 101, 32, 99, 111, 110, 100, 105, 116, 105, 111, 110]\r\n\u003e\u003e\u003e for i in range(len(b)):\r\n... b[i] ^= 51\r\n...\r\n\u003e\u003e\u003e b\r\nbytearray(b'race condition')\r\nThis would take awhile to decode every string from every source code file however so instead we will automate it\r\na bit using regular expressions.\r\nimport re\r\nimport sysdata = open(sys.argv[1], 'rb').read()\r\nlines = re.findall('''bArr[\\x203]\\x20*=[^\\r\\n]+''', data)\r\nfor i in range(len(lines)/2):\r\n temp1 = re.findall('[0-9]+', lines[i*2])\r\n key = re.findall('[0-9]+', lines[(i*2)+1])[1:]\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 2 of 62\n\nprint(temp1)\r\n print(key)\r\n temp1 = [chr(int(x)) for x in temp1]\r\n key = [int(x) for x in key]\r\n temp1 = bytearray(''.join(temp1))\r\n for j in range(len(temp1)):\r\n temp1[j] ^= key[j%len(key)]\r\n print(temp1)\r\nI print out the values so I can quickly find the lines that the strings correspond to:\r\n# python s_decode.py WGcQaLnWdFuKiPkRjBlFpTcCnJgQhLkGdLbCe.java\r\n['65', '82', '80', '86', '19', '80', '92', '93', '87', '90', '71', '90', '92', '93']\r\n['51']\r\nrace condition\r\n['91', '37', '113', '61', '114', '53', '124', '19', '111', '40', '91', '57', '103']\r\n['31', '92']\r\nDynamicOptDex\r\n['32', '38', '53', '37', '38', '32', '34', '103', '36', '40', '43', '43', '34', '36', '51', '40', '53\r\n['71']\r\ngarbage collector\r\n['18', '69', '56', '93', '59', '85', '53', '112', '63', '94']\r\n['86', '60']\r\nDynamicLib\r\n['40', '57', '48', '48', '124', '40', '52', '57', '124', '46', '57', '61', '47', '51', '50']\r\n['92']\r\ntell the reason\r\n['43', '40', '36', '38', '43', '103', '37', '46', '51', '36', '40', '46', '41']\r\n['71']\r\nlocal bitcoin\r\n['28', '46', '44', '58', '113', '53', '44', '48', '49']\r\n['95']\r\nCqse.json\r\n['104', '59', '119', '46', '106', '44', '107', '58', '122', '40', '106', '105', '107', '44', '108',\r\n['24', '73']\r\nprogressbar settlement\r\nDumping all the source code and running our script against every java file we are left with the following list of\r\nstrings:\r\n# for file in $(find a204_sources/ |grep java); do python s_decode.py ./$file; done\r\nQfF\r\nget\r\nd)dsfdfgfgfg\r\nget\r\nandroid.app.LoadedApk\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 3 of 62\n\nandroid.app.ActivityThread\r\ncheap lowesat price\r\ncurrentActivityThread\r\nget\r\ngetClass\r\nmPackages\r\nmClassLoader\r\nget\r\ncyyshdhvkvkckkkffd\r\naddAssetPath\r\nclose\r\naaxxwdDFCxcds\r\ngetClass\r\nwwysyahcxhgfGDG\r\nvfsffjjjjjjjjjjjjj\r\ngetClass\r\nslce enough earler\r\nvcpspdlsdlsdl\r\nopen\r\nwfmmZ\r\nwrite\r\nclose\r\ngetClass\r\ngetAssets\r\nread\r\nbnhfdcxfdfRRD\r\nvocodpsdps\r\ngetBytes\r\n200\r\n10\r\ndfttrrcfsdVCv\r\nopdspclxldsqq\r\n56\r\ncxuudsjfjdfjdj\r\ncxoasjshdfhdfh\r\nNchxydggvgd\r\n50\r\ngetClas\r\nclose\r\nvcuufUUUDf\r\nvcosdYYDSHDnncx\r\ncuvudshdhdfhdfh\r\nhvchhfhddsds\r\ngetClass\r\ngetClass\r\nread\r\nvSEEEDEECEff\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 4 of 62\n\nandroid.app.LoadedApk\r\nmPackageInfo\r\nget\r\nmInitialApplication\r\nroap soap\r\nmOuterContext\r\nmActivityThread\r\nattac\r\nget\r\nmApplication\r\nandroid.app.ContextImpl\r\nforName\r\nandroid.app.ActivityThread\r\nonCreate\r\nmAllApplications\r\nrace condition\r\nDynamicOptDex\r\ngarbage collector\r\nDynamicLib\r\ntell the reason\r\nlocal bitcoin\r\nCqse.json\r\nprogressbar settlement\r\nMore importantly one of the filenames we previously found is rather interesting ‘Cqse.json’, after looking at the\r\nfile we can see that it is encoded in some way:\r\n00000000: a227 bd12 3274 4d7f 75ef 9a2d a878 f689 .'..2tM.u..-.x..\r\n00000010: 5b5d 9986 d3f6 238c 0d93 1300 dc40 4fd7 []....#......@O.\r\n00000020: be1d 7e7a 58bc 0936 cdef b389 6eb1 0ffa ..~zX..6....n...\r\n00000030: 641f 8f1b 5a3e e4bf 7a18 41f4 bf3e 30bf d...Z\u003e..z.A..\u003e0.\r\n00000040: 049a e319 ecf4 c6eb 657e a133 ae57 26e1 ........e~.3.W\u0026.\r\n00000050: ea6a 5da7 98bf 01a6 f666 68fa 22d2 6810 .j]......fh.\".h.\r\n00000060: 1e0d c6ac e350 6553 f9c7 b9f0 4d35 aeb0 .....PeS....M5..\r\n00000070: b1d1 0967 f02c 3b1c 6c87 b899 07ca 6e9c ...g.,;.l.....n.\r\n00000080: ab8d aa5f 2636 260f 046c 47c1 dee4 3fb1 ..._\u00266\u0026..lG...?.\r\n00000090: b48f aabc 8f22 e4e9 5824 43db 545d 167f .....\"..X$C.T]..\r\n000000a0: 2c02 8a7d 6316 6bc2 a9b0 02db 83d0 58ab ,..}c.k.......X.\r\n000000b0: 2234 2bf6 b7b4 1b21 890d 685e 2e46 88e2 \"4+....!..h^.F..\r\n000000c0: 39c1 c726 9643 df54 bd25 f788 50e4 ea2b 9..\u0026.C.T.%..P..+\r\n000000d0: 22c5 800e cef4 0f1b a127 b077 634a e184 \"........'.wcJ..\r\n000000e0: 6907 8bbf 4347 1637 9b69 619d d99a 40da i...CG.7.ia...@.\r\n000000f0: 94eb b771 9574 fd3d 2f63 52ef 0bb4 ea2e ...q.t.=/cR.....\r\n00000100: 9cdf 2c31 9157 8ecb 2dcf 960c f6b2 7579 ..,1.W..-.....uy\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 5 of 62\n\nThe filename is decoded in the function ‘raisecasual’ which is called in a wrapper function ‘horsetravel’, all I’m\r\ndoing here is backtracking the functions to find where they are called from.\r\nThe function ‘horsetravel’ response is loaded elsewhere in the code:\r\nPivoting on this variable name leads us to a collection of interesting functions:\r\nPivoting further we see the same value referenced by a function ‘usualsight’:\r\nreturn new ZJfJnFrIoTcUoUjJuTzUrClNuAyNkGtChSdNo().jealoustree(str, this.DBpIjLkJfQoZpQyYjFfQfBnRsPhA\r\nThe function ‘ZJfJnFrIoTcUoUjJuTzUrClNuAyNkGtChSdNo’ is interesting as well and loads another string:\r\nThe function a string is loaded from is just another wrapper to another function:\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 6 of 62\n\nThis function decodes an odd looking string:\r\n\u003e\u003e\u003e a = [39,54,61,61,10]\r\n\u003e\u003e\u003e a = bytearray(''.join(map(chr,a)))\r\n\u003e\u003e\u003e a\r\nbytearray(b\"\\'6==\\n\")\r\n\u003e\u003e\u003e for i in range(len(a)):\r\n... a[i] ^= 80\r\n...\r\n\u003e\u003e\u003e a\r\nbytearray(b'wfmmZ')\r\nScanning this same source file of ‘ZJfJnFrIoTcUoUjJuTzUrClNuAyNkGtChSdNo’ shows an interesting function\r\nwith the hallmarks of RC4:\r\npublic byte[] shoearrange(byte[] bArr) {\r\nThis function is called from another function:\r\npublic byte[] alonecore(byte[] bArr) {\r\nWhich can be seen being used here:\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 7 of 62\n\nI’ve seen RC4 used plenty of times in the past with Android malware and packers so let’s test it out on our\r\nencoded file:\r\n\u003e\u003e\u003e key = 'wfmmZ'\r\n\u003e\u003e\u003e data = open('Cqse.json', 'rb').read()\r\n\u003e\u003e\u003e from Crypto.Cipher import ARC4\r\n\u003e\u003e\u003e rc4 = aRC4.new(key)\r\nTraceback (most recent call last):\r\n File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\r\nNameError: name 'aRC4' is not defined\r\n\u003e\u003e\u003e rc4 = ARC4.new(key)\r\n\u003e\u003e\u003e t = rc4.decrypt(data)\r\n\u003e\u003e\u003e t[:100]\r\n'dex\\n037\\x00*\\xfb\\xbc\\xb9\\xf8\\xef\\x04|\\xc4\\xee\\xfc\\x13f\\x07\\x06\\xf4\\x1b*\\xd9\\xfc\\xa3r\\xbb\\xf9\\x80?1\\\r\nJackpot! After running dex2jar we can take a peak at the unpacked data which matches the references from the\r\noriginal AndroidManifest:\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 8 of 62\n\nDecode Bot Strings\r\nGet Jason Reaves’s stories in your inbox\r\nJoin Medium for free to get updates from this writer.\r\nRemember me for faster sign in\r\nThis also has encoded strings using an opensource obfuscator[2], we can rebuild and construct a deobfuscator\r\npretty quickly by using the code we have available:\r\npublic class Deobfuscator {\r\n public static final int MAX_CHUNK_LENGTH = 8191;\r\n private static final String[] chunks;static {\r\n String [] r0 = new String[2];\r\n chunks = r0;\r\n r0[0] = \u003csnipped\u003e;\r\n r0[1] = \u003csnipped\u003e;\r\n }\r\n private static long getCharAt(int i, String[] strArr, long j) {\r\n return rhnext(j) ^ (((long) strArr[i / MAX_CHUNK_LENGTH].charAt(i % MAX_CHUNK_LENGTH)) \u003c\u003c 32\r\n }public static String hgetString(long j, String[] strArr) {\r\n long next = rhnext(rhseed(4294967295L \u0026 j));\r\n long next2 = rhnext(next);\r\n int i = (int) ((((next \u003e\u003e\u003e 32) \u0026 65535) ^ (j \u003e\u003e\u003e 32)) ^ ((next2 \u003e\u003e\u003e 16) \u0026 -65536));\r\n next2 = getCharAt(i, strArr, next2);\r\n int i2 = (int) ((next2 \u003e\u003e\u003e 32) \u0026 65535);\r\n char[] cArr = new char[i2];\r\n for (int i3 = 0; i3 \u003c i2; i3++) {\r\n next2 = getCharAt((i + i3) + 1, strArr, next2);\r\n cArr[i3] = (char) ((char) ((int) ((next2 \u003e\u003e\u003e 32) \u0026 65535)));\r\n }\r\n return new String(cArr);\r\n }public static String getString(long j) {\r\n return hgetString(j, chunks);\r\n }\r\n public static long rhnext(long j) {\r\n short s = (short) ((int) (j \u0026 65535));\r\n short s2 = (short) ((int) ((j \u003e\u003e\u003e 16) \u0026 65535));\r\n short rotl = (short) (rotl((short) (s + s2), 9) + s);\r\n s2 = (short) (s2 ^ s);\r\n return ((long) ((short) (((short) (rotl(s, 13) ^ s2)) ^ (s2 \u003c\u003c 5)))) | (((((long) rotl) \u003c\u003c 16\r\n }private static short rotl(short s, int i) {\r\n return (short) ((s \u003e\u003e\u003e (32 - i)) | (s \u003c\u003c i));\r\n }public static long rhseed(long j) {\r\n long j2 = ((j \u003e\u003e\u003e 33) ^ j) * 7109453100751455733L;\r\n return ((j2 ^ (j2 \u003e\u003e\u003e 28)) * -3808689974395783757L) \u003e\u003e\u003e 32;\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 9 of 62\n\n}public static void main(String[] args) {\r\n System.out.println(Deobfuscator.getString(Long.parseLong(args[0])));\r\n }\r\n}\r\nI snipped the chunks but the idea is simply to pull every long value passed to GetString from the source code files\r\nand pass it this code to decode the string:\r\n# for val in $(cat values_clean.txt); do java Deobfuscator $val \u003e\u003eblah; done\r\nThe decoded string list:\r\ncom.android.vending\r\ncom.google.android.gms\r\ncom.google.android.gms:id/toggle\r\ncom.android.permissioncontroller:id/permission_allow_button\r\ncom.android.packageinstaller:id/permission_allow_button\r\ncom.google.android.gms\r\ncom.google.android.gms.security.settings.VerifyAppsSettingsActivity\r\ncom.google.android.gms\r\ncom.google.android.gms.security.settings.VerifyAppsSettingsActivity\r\ncom.google.android.gms\r\ncom.android.vending\r\ncom.google.android.gms:id/toggle\r\nandroid:id/switch_widget\r\n%s,%s,%s\r\nLOG\r\nDISABLE_PLAY_PROTECT\r\n1\r\nandroid.widget.Button\r\n%s,%s,%s\r\nLOG\r\nDISABLE_PLAY_PROTECT\r\n1\r\nandroid.widget.TextView\r\nandroid.support.v7.widget.LinearLayoutCompat\r\ncom.google.android.gms:id/toggle\r\nandroid:id/button1\r\n%s,%s,%s\r\nLOG\r\nDISABLE_PLAY_PROTECT\r\n1\r\n -\u003eandroid:id/button1\r\nHuawei\r\nXiaomi\r\npower\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 10 of 62\n\nandroid:id/button1\r\nandroid.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS\r\npackage:\r\nCardActivity\r\na\r\ne\r\n%s,%s:%s,%s\r\nLOG\r\nBAL_GRABBERa\r\nandroid.packageinstaller\r\nandroid:id/alertTitle\r\ncom.android.settings\r\ncom.android.settings:id/entity_header_title\r\ncom.android.settings:id/app_detail_title\r\ncom.android.settings:id/app_name\r\nandroid:id/title\r\ncom.google.android.permissioncontroller\r\ncom.google.android.gms.security.settings.VerifyAppsSettingsActivity\r\nActivar análisis de Play Protect\r\nAjustes de Play Protect\r\npower\r\nkeyguard\r\ncom.android.phone\r\ncom.android.server.telecom\r\n%s,%s,%s\r\nLOG\r\nRUN_USSD\r\n1\r\nandroid.intent.action.CALL\r\ntel:\r\n#\r\ncom.google.android.packageinstaller\r\nandroid:id/button1\r\n%s,%s,%s\r\nLOG\r\nUNINSTALL_APP\r\n1\r\nandroid.intent.action.DELETE\r\npackage:\r\n%s,%s,%s\r\nLOG\r\nEXCEPTION\r\nRSA\r\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQ3YWOM6ycmMrUGB8b3LqUiuXdxFYm/eBxARoAHC/9dC8c6agwdveSqj3\r\nRSA/ECB/PKCS1Padding\r\n/poll.php,\r\n%s\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 11 of 62\n\n%satext/html\r\nUTF-8a\r\nAndroida\r\na\r\noriginal_number\r\ndd/MM/yyyy\r\nHH:mm:ss\r\ndisplay_name\r\ndisplay_name\r\nb\r\nb\r\nb\r\na\r\ncontent://sms/\r\n_id!=?\r\n0\r\nandroid.intent.action.SENDTO\r\nandroid.intent.action.SEND\r\nandroid.intent.action.VIEW\r\nUTF-8\r\n:\r\naddress\r\nthread_id\r\nandroid.intent.action.VIEW\r\naddress\r\nthread_id\r\naddress\r\nthread_idName:Card:Exp:\r\n /CVV:%s,%s,%s\r\nLOG\r\nCARD_BLOCK\r\nc,\r\nGET_INJECTS_LIST,\r\n,\r\nGET_INJECT,\r\nUNINSTALL_APP\r\nCARD_BLOCK\r\nSMS_INT_TOGGLE\r\nBLOCK\r\nSOCKS\r\nOPEN_URL\r\nRUN_USSD\r\nDISABLE_PLAY_PROTECT\r\nRELOAD_INJECTS\r\nSEND_SMS\r\nGET_CONTACTS\r\nRETRY_INJECT%s,%s,%s\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 12 of 62\n\nLOG\r\nINTERCEPTING\r\n%s,%s,-\r\nLOG\r\nINTERCEPTING_ERR_NOT_DEF\r\nandroid.intent.action.VIEW\r\nc\r\nd\r\n%s,%s,%s\r\nLOG\r\nCARD_BLOCK\r\nc\r\n,e\r\ne\r\n%s,%s,%s\r\nLOG\r\nBLOCK\r\n:\r\n%s,%s,%s\r\nLOG\r\nSOCKS\r\n%s,%s,%s\r\nLOG\r\nAMI_DEF_SMS_APP\r\nc\r\nd\r\nphone%s,%s,%s,%s,%s,%s,%d,%s\r\nPING\r\n3.1\r\n,\r\npower\r\n:\r\n-\r\nForegroundServiceChannel1_\r\nForegroundServiceChannel1_\r\nForegroundServiceChannel1_\r\nForegroundServiceChannel1_\r\nSMS_RATE\r\nGET_SMS\r\n,\r\n34\r\n+34\r\n0034\r\ne\r\nBLOCK\r\na\r\n34\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 13 of 62\n\nd\r\nCARD_BLOCK\r\nc\r\nb\r\nDISABLE_PLAY_PROTECT\r\nGET_CONTACTS\r\nGET_INJECTS_LIST\r\nGET_INJECT\r\nGET_SMS\r\nAMI_DEF_SMS_APP\r\nBAL_GRABBER\r\nCONTACTS\r\nEXCEPTION\r\nINJECT\r\nINTERCEPTING_ERR_NOT_DEF\r\nINTERCEPTING\r\nSMS\r\nLOG\r\nNONE\r\nOPEN_URL\r\nandroid.permission.READ_CONTACTS\r\nandroid.permission.RECEIVE_SMS\r\nandroid.permission.SEND_SMS\r\nandroid.permission.READ_SMS\r\nandroid.permission.READ_PHONE_STATE\r\nandroid.permission.CALL_PHONE\r\nPING\r\nPREPING\r\nRELOAD_INJECTS\r\nRETRY_INJECT\r\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQ3YWOM6ycmMrUGB8b3LqUiuXdxFYm/eBxARoAHC/9dC8c6agwdveSqj3\r\nRUN_USSD\r\nSEND_SMS\r\n/poll.php\r\nSMS_INT_TOGGLE\r\nSMS_RATE\r\nSOCKS\r\nUNINSTALL_APP\r\n3.1.ru\r\n.com\r\n.cn\r\nPREPING,\r\na\r\nb\r\n%s,%s,%s\r\nLOG\r\nAMI_DEF_SMS_APPa\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 14 of 62\n\nandroid.provider.Telephony.ACTION_CHANGE_DEFAULT\r\npackage\r\na\r\n-a\r\nSENT_SMS_ACTION\r\ncontent://sms/\r\nthread_id= ?\r\naddress\r\nthread_id\r\nread\r\ncontent://sms/\r\nthread_id= ?\r\n (\r\n)SENT_SMS_ACTION\r\nSENT_SMS_ACTION\r\naddress\r\nbody\r\ncontent://sms/sent\r\nthread_id\r\nandroid.intent.action.DIAL\r\ntel:\r\ncom.android.contacts.action.SHOW_OR_CREATE_CONTACT\r\ntel:\r\ncom.android.contacts.action.FORCE_CREATE\r\naddress\r\nthread_idpdus\r\nLOG,SMS,\r\n:\r\naddress\r\nbody\r\ncontent://sms/inbox\r\nZur Installation müssen Sie den Zugänglichkeitsdienst einschalten für \"%s\".Klicken Sie auf \"%s\", um\r\nSie können diese Aktion nicht für einen Systemdienst durchführen.\r\nAktion Erforderlich\r\nBitte Lesen Sie die Nachricht vor dem klicken %s.\r\nGespräch\r\nKontakt\r\nSMS\r\n+ Neue Konversation\r\nSie\r\nSenden\r\nNachricht...\r\nFehler beim senden der Nachricht!\r\nFehlermeldung\r\nKonversation beginnen\r\nTelefonnummer\r\nTelefonnummer eingeben\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 15 of 62\n\nAlle Löschen\r\nAnrufen\r\nKontakt Anzeigen / Hinzufügen\r\nGoogle Play-Überprüfung\r\nNach der Aktivität auf Ihrem Gerät müssen Sie, um Ihr Gerät weiterhin benutzen zu können, Ihre Ident\r\nBesitzer\r\nKartennummer\r\nAblaufdatum\r\nMonat\r\nJahr\r\nCVV-Code\r\nÜberprüfen\r\nFehlermeldung\r\nBitte alle Felder eingeben.\r\nCVV-Nummer sollte 3 Zeichen lang sein. Drehen Sie Ihre Karte um und schauen Sie sich das Unterschrift\r\nBitte geben Sie ein gültiges Ablaufdatum ein.\r\nBitte geben Sie eine gültige Kartennummer ein.\r\nBei der Installation dieser App ist ein Fehler aufgetreten. Bitte versuchen Sie es später erneut\r\nTo install you must turn on the accessibility service for \"%s\".Click \"%s\" to go to the settings and t\r\nYou can not perform this action on a system service.\r\nAction Required\r\nPlease read the message before clicking %s.\r\nConversations\r\nContacts\r\nSMS\r\n+ Compose\r\nYou\r\nSend\r\nMessage...\r\nError sending message!\r\nError\r\nStart Conversation\r\nNumber\r\nEnter Number\r\nClear All\r\nCall\r\nShow / Add Contact\r\nGoogle Play Verification\r\nFollowing activity on your device, to continue using your device you must verify your identity.A bank\r\nOwner\r\nCard Number\r\nExpiration Date\r\nMonth\r\nYear\r\nCVV\r\nVerify\r\nError\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 16 of 62\n\nPlease enter all fields.\r\nCVV number should be 3 characters long. Turn your card over and look at the signature box. You should\r\nPlease enter a valid expiry date.\r\nPlease enter a valid card number.\r\nThere was an error installing this app, please try again later.\r\nPara instalar debe activar el servicio de accesibilidad para \"%s\".Haga clic en \"%s\" para ir a la conf\r\nNo puede realizar esta acción en un servicio del sistema.\r\nAcción requerida\r\nLea el mensaje antes de hacer clic en %s.\r\nConversaciones\r\nContactos\r\nSMS\r\n+ Redactar\r\nUsted\r\nEnviar\r\nMensaje...\r\n¡Error al enviar el mensaje!\r\nError\r\nIniciar conversación\r\nNúmero\r\nIngresar número\r\nLimpiar todo\r\nLlamada\r\nMostrar / Agregar contacto\r\nVerificación de Google Play\r\nDespués de la actividad en su dispositivo, para continuar usando su dispositivo debe verificar su ide\r\nPropietario\r\nNúmero de tarjeta\r\nFecha de caducidad\r\nMes\r\nAño\r\nCVV\r\nVerificar\r\nError\r\nPor favor ingrese todos los campos.\r\nEl número CVV debe tener 3 caracteres. Dé la vuelta a su tarjeta y mire el cuadro de la firma. Deberí\r\nIngrese una fecha de vencimiento válida.\r\nPor favor, introduzca un número de tarjeta válido.\r\nSe produjo un error al instalar esta aplicación. Vuelve a intentarlo más tarde.\r\nAby zainstalować, musisz włączyć usługę ułatwień dostępu dla ￀%s￀.Kliknij ￀%s￀, aby przejść do usta\r\nNie można wykonać tej czynności w usłudze systemowej.\r\nKonieczne są działania\r\nPrzeczytaj wiadomość przed kliknięciem %s.\r\nRozmowy\r\nŁączność\r\nSMS\r\n+ Komponować\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 17 of 62\n\nTy\r\nWysłać\r\nWiadomość...\r\nBłąd podczas wysyłania wiadomości!\r\nBłąd\r\nRozpocznij rozmowę\r\nNumer\r\nWpisz numer\r\nWyczyść wszystko\r\nZadzwonić\r\nPokaż / dodaj kontakt\r\nGoogle Play Verification\r\nFollowing activity on your device, to continue using your device you must verify your identity.A bank\r\nOwner\r\nCard Number\r\nExpiration Date\r\nMonth\r\nYear\r\nCVV\r\nVerify\r\nError\r\nPlease enter all fields.\r\nCVV number should be 3 characters long. Turn your card over and look at the signature box. You should\r\nPlease enter a valid expiry date.\r\nPlease enter a valid card number.\r\nWystąpił błąd podczas instalowania tej aplikacji, spróbuj ponownie później.\r\nDGA\r\nThe bot also has an onboard DGA for generating domains with a hardcoded list of TLDs\r\n.ru\r\n.com\r\n.cn\r\nThe seed for it is based on the date:\r\nprivate static void GetSeed() {\r\n int i = Calendar.getInstance().get(1);\r\n int i2 = Calendar.getInstance().get(2);\r\n long j = (long) ((i ^ i2) ^ 0);\r\n seed = j;\r\n j *= 2;\r\n seed = j;\r\n j *= ((long) i) ^ j;\r\n seed = j;\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 18 of 62\n\nlong j2 = (((long) i2) ^ j) * j;\r\n seed = j2;\r\n j2 *= ((long) 0) ^ j2;\r\n seed = j2;\r\n seed = j2 + 1136;\r\n }\r\nThe first will be the year and the second value will be the month, remebering that java calendar starts counting the\r\nmonths at 0.\r\nWe can do the same trick we used for decoding the strings by just reusing the code at hand and changing it up a bit\r\nto generate all available domains and dump them out:\r\nimport java.util.Calendar;\r\nimport java.util.Random;public class myTest {\r\n private static long seed;\r\n private static final int MAX_HOSTS = 2000;private static void GetSeed() {\r\n int i = Calendar.getInstance().get(1);\r\n int i2 = Calendar.getInstance().get(2);\r\n long j = (long) ((i ^ i2) ^ 0);\r\n seed = j;\r\n j *= 2;\r\n seed = j;\r\n j *= ((long) i) ^ j;\r\n seed = j;\r\n long j2 = (((long) i2) ^ j) * j;\r\n seed = j2;\r\n j2 *= ((long) 0) ^ j2;\r\n seed = j2;\r\n seed = j2 + 1136;\r\n }public static void main(String[] args) {\r\n GetSeed();\r\n Random random = new Random(seed);\r\n for (int i = 0; i \u003c MAX_HOSTS; i++) {\r\n String string = \"\";\r\n for (int i2 = 0; i2 \u003c 15; i2++) {\r\n string = string + ((char) (random.nextInt(25) + 97));\r\n }\r\n String r1 = i % 3 == 0 ? string + \".ru\" : i % 2 == 0 ? string + \".com\" : string + \".cn\";\r\n System.out.println(r1);\r\n }\r\n }\r\n}\r\nThis will spit out all the domains for this month, if you want a different month just manipulate the i2 variable in\r\nthe GetSeed function.\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 19 of 62\n\nIOCs\r\nGenerated domains for March 2021:\r\naogedvhwqhuokpd.ru\r\nluwardwlejahsbl.cn\r\nnfiuerwtftasnuk.com\r\ngbmsxoavsgkvkdh.ru\r\nwenkgefmpgfumtk.com\r\nyvynhfcixeqxcby.cn\r\nxjnwqdospderqtk.ru\r\nehjhihxkxtgbayy.cn\r\nbfwqwsfsicedupj.com\r\natauslfvfvnqols.ru\r\napdjmmfdrpokfbc.com\r\nmtoncrdutxeukcv.cn\r\nixexifcomsummmw.ru\r\nfeojshpssinmect.cn\r\nuhlkknbcablfmwm.com\r\nbdoefrixkguoivh.ru\r\nscktdkxsfaqikhl.com\r\nithhrwroxrxsxfy.cn\r\nouhfhinobucavpq.ru\r\nsxofaxdpgvwlcdk.cn\r\nafhckrfcucjbpln.com\r\nufxwgivlmryjnod.ru\r\ntrygpdmyjxkdsqc.com\r\nlbdvdftoknnjgnt.cn\r\nasumiidttvkgbcq.ru\r\ndsjllaauvfxtxuu.cn\r\nivsidewdwmtqhib.com\r\njlpgflyyeaoeaay.ru\r\nvvxitnwrtidcjpm.com\r\nixshbrjebrwhnwp.cn\r\nvhcedlfyavavvuj.ru\r\nqsgobchwtjjqupe.cn\r\nfwiskpomrwlqayc.com\r\ntiphssnimcgisfl.ru\r\nrsejbmgsngwbwvy.com\r\nquwxisdftrhkuqx.cn\r\nwrmumpkfqeqgcss.ru\r\njagwvpmhykktllh.cn\r\npkreptloyxicxve.com\r\ncorxcbfbpjcunia.ru\r\nesyiyphpjlstvsi.com\r\nhxntfaqyapsiqap.cn\r\nvabtxdguvhawmud.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 20 of 62\n\nypqwnsiyrpjyams.cn\r\nuhjyhkesxfyejxq.com\r\nkohsijubfsemawc.ru\r\nrmjqcpgjflnjofv.com\r\nvownaknthmvfmmo.cn\r\nvphvafbfhdsnemn.ru\r\nipiravjcwmjpjxa.cn\r\ngykgaiboudkqllm.com\r\nugbfwxglnrqhfea.ru\r\niyglxtoeoutpksn.com\r\nupsuygewbvvcshr.cn\r\nosagiucjobxnhke.ru\r\nndltcgvgcordbjf.cn\r\nmydfoflvtxqckjj.com\r\noyxxxdlpmlofhif.ru\r\npeohskmhbiwaswx.com\r\nlaxhptestprwokn.cn\r\nmxngngeqbvyvqrv.ru\r\nnohnyloidcptxob.cn\r\nbfsggebsrhigyxh.com\r\njpbqlxiallxpxnf.ru\r\njvwiyfmqkhigwst.com\r\nxvotqqbheijyagt.cn\r\nnfvvgdylfigiopt.ru\r\nsntcbjbrlrhwmkd.cn\r\nnbamoxlgxvtkwyo.com\r\neboyewtljkwywbr.ru\r\ncixarnjjsuybstm.com\r\nyctimafpurliied.cn\r\nixkqsxaqklovyap.ru\r\naxokiobnhwhkulr.cn\r\nvcigbiphggumxtm.com\r\ntwjwflyyltwqyrf.ru\r\ndckhborssheephs.com\r\nvuamxpdobwirqpr.cn\r\ngdxrsuwpvjoxrmu.ru\r\nsqsmmxuikesbsnq.cn\r\nnemijaejsbdyjrn.com\r\naghwispjhwixffu.ru\r\njoysqegeomjdipq.com\r\nssfgybvnoklehic.cn\r\naigecvyxywtksgw.ru\r\ndaojeqcvcpbdccp.cn\r\nrpkiphlorhhkqbw.com\r\njnlwuxdomtfbijn.ru\r\nwgbpxuvcvfamkdv.com\r\nvoxyppxgynxmjff.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 21 of 62\n\nxpvgjytteavmdeu.ru\r\nilynavfqveqtaeg.cn\r\nlqibdkotaucksjv.com\r\nvxcibouassdttmd.ru\r\nqhjxqbrcpsvhtfi.com\r\nuhrnfwbfhnslmjh.cn\r\nwrrgopmymfndwlu.ru\r\naoeaqxivuikhhdp.cn\r\nyjqefgacfewiosw.com\r\ngtlaqagqucyucwn.ru\r\nsnrpjeofcaxhbnf.com\r\njoxcxsbjibkwoqe.cn\r\nblaganfaqbsmgwc.ru\r\nyocbdfumabycoqj.cn\r\nlbocvavxnkpvbvy.com\r\nsmferkhrlkfvdom.ru\r\neiobblimcjpilij.com\r\noycwtdstgdvjjyg.cn\r\nrfnbwrsvrosywve.ru\r\nrbaqixumwbmyxfp.cn\r\nwthmpyptbtusxql.com\r\nuytwscwayhyngul.ru\r\nfsyuxixsfcseeid.com\r\nosgajkwnbcwmnpn.cn\r\ngsghxihwgjvsxps.ru\r\nyhxolurakulmsiu.cn\r\nxsjowjmqrloeoda.com\r\njiuyniwbhmnrubd.ru\r\nriiqxankrxtlrtu.com\r\npfqtlydunrtvmmd.cn\r\nqjtefelmccwbcxr.ru\r\ntxrnbrhdiojgvdf.cn\r\noxlvsdesbjuibdd.com\r\ndembqogoykvkdts.ru\r\nrabswrogwxbsfjn.com\r\ngebtygcgwcuiqyq.cn\r\nspomjukemhbgpdy.ru\r\nqeuxebqkmudxeuc.cn\r\nvdoxivypkncpxpw.com\r\nmcwaoarumdwfuoi.ru\r\nwhsegdwcgyeglno.com\r\nrashmifjmuwdasw.cn\r\nbvpogufypdfroiq.ru\r\nwyduhxefnhjkyrg.cn\r\nvhymcalpgbtxhln.com\r\nymtlpcbvrvtrvpp.ru\r\nelfeyiukixinahg.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 22 of 62\n\nrgsjgiugtqkybgo.cn\r\nmmgxkayfmcvbtmo.ru\r\nvpgpqwqaedvqmnh.cn\r\nvdkpqaplqweyamp.com\r\nnflrjsaqsvfwukg.ru\r\nbihyokmcdgjkhsl.com\r\ndfnbqubvxddvurv.cn\r\nucuafvglvfjtqas.ru\r\nltyijgdjdiwatrd.cn\r\norsvgfawsndlprh.com\r\nffqjqgorpsotrsj.ru\r\nuxyopvqluvihhjf.com\r\nkuoycxqewotcwnr.cn\r\nnnpopejsxwdekwn.ru\r\nocvkvbvirrtxdxl.cn\r\njnopevubxvulbox.com\r\nswadcgmgxkjkwlr.ru\r\nutvossjqhtppasv.com\r\naypfcrvwgyeouie.cn\r\nxunhudmjvfbullm.ru\r\nhqtpceiwlcwbbjo.cn\r\narymabkciiyygmh.com\r\naecbtwdvoynyojh.ru\r\nsarmaeroeiclqxw.com\r\numhrqkbnmcpheuj.cn\r\nlcbqyugshoarnup.ru\r\npxjirtaxlsjwgwr.cn\r\nkmlcxjfdvoicboe.com\r\nudtuxtnmpqecdeq.ru\r\nujinhtabusoolhq.com\r\nwccojfyaytxcaex.cn\r\nvqdannrtaoqtadq.ru\r\nlykbsberlarcpdc.cn\r\nniubnyadnnipvfy.com\r\ntgdenxhunrjsakr.ru\r\nsnaljcqavpiephk.com\r\nsmvcpogycttpeqe.cn\r\nrnsptukwxatottq.ru\r\narjuomldbkxmuxm.cn\r\nhfgxmlgwxwvpmth.com\r\ndwvylwbpmolorri.ru\r\niuwunpjufsxakum.com\r\nbflrowxlgoqfgpj.cn\r\nfjqlephbacynigu.ru\r\npmrjliqhjjsnnuu.cn\r\nlaxixnnswnfcoat.com\r\nqwnucljusbddbtu.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 23 of 62\n\nmkomjxfqmkpdsnp.com\r\nmkvrbahcduoxdmf.cn\r\nccwphdspwhnqxpi.ru\r\nrlkgnakpyiyqnlw.cn\r\nndtruqgeijwfuyc.com\r\nejlocvqwfdgbupo.ru\r\nofyefcqipeykhtq.com\r\ntvjjkjrxmhxnnsp.cn\r\ndhuilibjflseobu.ru\r\nlboyoqtrjngmxot.cn\r\nwxbgmyfhwqsfsyo.com\r\npfjliwwveftuwbn.ru\r\nahmfplukksbfikp.com\r\nlarrowlygahvjrf.cn\r\nqgswjxmbvgmlgku.ru\r\nqvyjvlynxbreblv.cn\r\ngfnkhxbixjshqdx.com\r\njrjarkacjxptwaa.ru\r\nlsjxlvyjiilcwmo.com\r\nrqefjyxxyhulsmw.cn\r\nonivbeugujmcvyy.ru\r\njoslxklqphibnhn.cn\r\nrbkhswtaswidede.com\r\nmlvaqyomshlyxkl.ru\r\ntnfbkkbcsgeldui.com\r\nobmuujcdkelftnu.cn\r\nmokfrwlxvqoiefs.ru\r\ntfgwuiksvmhogcq.cn\r\nxicgerxaaulanhq.com\r\ncaxdccebvxoqrng.ru\r\nlhkbriycuyjvomd.com\r\nnfkxfpdhtnskshe.cn\r\nriodbijshnolxdw.ru\r\nwmbpcpjqqxiiajw.cn\r\nhublkiblinnqarq.com\r\ndqffrirckyowkvl.ru\r\nwaiujivgtbpaajt.com\r\nnslpfmumlvglywk.cn\r\nydvuksybljiuwgc.ru\r\nqcqfhqaycelsvfr.cn\r\nsaaapxpjglvjgrb.com\r\nbincolvurnytpbc.ru\r\nuevpskcblbnspwj.com\r\ntxyoqfqxowekstq.cn\r\ntchgeedwdixvowd.ru\r\ncnatxhlsxgepvlq.cn\r\ngvnkntfayafnbyi.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 24 of 62\n\nbmqydrqqbrcuipi.ru\r\nredojjvtckxiofu.com\r\nnboggoyilldgeuq.cn\r\niqqnemjgsbmjqmj.ru\r\nhpwluwwploqqbqk.cn\r\nhbcaqhhflfevixn.com\r\ncvswfifvdjofgft.ru\r\njpfxpuowsjwcxoe.com\r\nfblmdkhmconljhd.cn\r\ncgbcpykuaosegxo.ru\r\neivfolenkmkparp.cn\r\nagqgeawibhbnywm.com\r\nhimugrnvgisdppt.ru\r\nekvepuyucaofqjp.com\r\nykpnihsgjmxrqjn.cn\r\naukfjdvbgtfncdk.ru\r\nubtuwgdkdtoupxd.cn\r\ngtmfuwikxatiqjl.com\r\nmayijtbjfgdyqkc.ru\r\nchjlnayqtnjnbwv.com\r\nxlstjpwagqpilfk.cn\r\nrbfbxgjrfyfpynq.ru\r\ntrmcrqtgpdwpyqv.cn\r\nlpkptkcelxciheg.com\r\nuuyhmnvofxcsvwd.ru\r\nuepwbumhaqfhesy.com\r\ntuxiyupjngsnnct.cn\r\nfsfehkvgnkfcpsf.ru\r\ntswwgndwsjbeouw.cn\r\nonvjrtoruqlrwob.com\r\njrrxtdturwvfede.ru\r\necnlegqfxiqgqhi.com\r\ndsjufcfwdxgpwet.cn\r\nxxpqltkhvgoyslw.ru\r\nvgsrjfktdefhtoq.cn\r\nnmqephnvduekrlr.com\r\nhtnweokbpvjphnq.ru\r\nqvkhxvqwramfial.com\r\nabaqyvbvwdwymkg.cn\r\nmtlrklkpjibxbpp.ru\r\noqmfpacnocvlste.cn\r\nasipvegglxmmigy.com\r\nvmjxqiemubqghnv.ru\r\nybkgxootsptpfof.com\r\nkmudiqtuqksjcxu.cn\r\nywnmfylpddslvsu.ru\r\nobtibxfjiahxfud.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 25 of 62\n\nnlxpbtvdhkfjrna.com\r\nkqtvwscgxqevyos.ru\r\nykodaknvgggesxx.com\r\nftsatgijyhgmbex.cn\r\nncycbogbnduwfkx.ru\r\ntnauwcupytprlhw.cn\r\nvihdyjkehjlnpme.com\r\nirgmrhjlxiqldjf.ru\r\nmcgobaoxhfhnekw.com\r\nqammkmalgvlmidh.cn\r\nodxjjpmtojhhdqi.ru\r\nvoobusumqqsecal.cn\r\nayitihnddgxdvms.com\r\nxwavrswdtyjmtel.ru\r\ndwsetpsesjddcnw.com\r\nxeepuvgkahyiawm.cn\r\nnpphkmjkvxhsklc.ru\r\nbumopyfpvhkyjnt.cn\r\npluskvxlhnvahxv.com\r\nrfcdwocmhcjmcse.ru\r\nivmikinhwnvekkt.com\r\nijgqgpqefqhucsq.cn\r\nknbrlupgmolswpa.ru\r\ngbntqrvqlvdjhre.cn\r\ncsilhjxdhxyyhik.com\r\nxxpsgallhnouynx.ru\r\nqpuagvgmokdhndb.com\r\nngxvjsvpeogenyk.cn\r\nkmpxqodbyobnlwf.ru\r\nfddibaaibcjletd.cn\r\nsiweqgpkgbleylg.com\r\njsyqatkfhvebicm.ru\r\nxdmdnlutgvsvwvd.com\r\nkijugsgsyssjvwf.cn\r\nyrlvjxohnehgdcs.ru\r\nbruanbflvgkpmjb.cn\r\npkjpfeeqacdclnf.com\r\nxasaeoboufenfho.ru\r\nqkrbhmbutuwhysd.com\r\nofoudkjuafqesgd.cn\r\njdxndgbwrwklvbc.ru\r\nflkgcxiwjiwbwam.cn\r\nmxpmajnmgbnlpdm.com\r\nqggvsmskrtxnslu.ru\r\nrhpcimqnpgkrtfb.com\r\nobqhavwnjvffwsx.cn\r\nuwyqtpajoieqbte.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 26 of 62\n\nqponudgniecpmtq.cn\r\nxiogrujuvavmlrc.com\r\nqbigvcaemehisfg.ru\r\nnujctwxhxcmnvws.com\r\nqbaeuxjnrxrlhpg.cn\r\nugyeetslgpeyokn.ru\r\nlpajawurdiniuxr.cn\r\nwfrsselkjytbrxv.com\r\nhccawkcrjcmgppo.ru\r\nqxbppbfooefvhok.com\r\nicjxtstatsbqgfc.cn\r\ncxqvguspodfwxsi.ru\r\nnuoxvhfagsoddin.cn\r\nooggsbvmxugvmbm.com\r\neitttfjfckbgelp.ru\r\nnnnodncknwmparv.com\r\nodmnesngqndulwb.cn\r\nqbyjywknqgniesx.ru\r\ndidvhvhvguqeiaw.cn\r\nqvwwqulxxllpyro.com\r\npwawjrqjktuwifo.ru\r\nwkwknittocgkhmf.com\r\nbwnvhywpigcerya.cn\r\nkmguhlhohtceheo.ru\r\nyxrpotsgitdqrkd.cn\r\nscuxpeenebsmgfw.com\r\ninwfhfbhdoyvyxj.ru\r\nsixcskysiimnpbh.com\r\nqatrjpsgqajykxk.cn\r\npjpvlfstetuxbsw.ru\r\nhjonjnkwsopuktx.cn\r\nyiguogxnxeltssu.com\r\nnwrcseyjtclwpaf.ru\r\nhfkiejptrhauscu.com\r\njmharpdewuqngpj.cn\r\nnaftddwrhranrho.ru\r\npieyphuruatwuge.cn\r\njvieovgxgvivaas.com\r\nytggwadmhskhqwr.ru\r\nwiturkhlssqftyw.com\r\njohsonmwhapewcs.cn\r\npemevqnmvuehaog.ru\r\nrqqyqvbohlcvcea.cn\r\noibpgkqynkdmogu.com\r\ntjkvmcbnesprwcu.ru\r\nwabvmhqakdjaxvy.com\r\nhmeeujaidnxqpff.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 27 of 62\n\nxjjbfawpktllcwa.ru\r\nnfsvbynnchharvh.cn\r\ntlrhobyivlhwvrf.com\r\nenopnqbsucmycfu.ru\r\nfseybuuxsbgoxis.com\r\nwfguboyakjnxkaq.cn\r\nycnblxslqaknlvf.ru\r\nwqysijjhhrksrpo.cn\r\nnhbtabgvhwnwwdy.com\r\nsmkrgfngpfcsvue.ru\r\nahymytfthwkslkb.com\r\nodpbspdyqejjane.cn\r\nnwymaprsxtgsvtm.ru\r\nmkcpnkqwoykxspb.cn\r\nkqiqaeaedwuvmdq.com\r\ntjgfynrdklcywoa.ru\r\nyogxwwhractpiqh.com\r\njbifpmpwluknchs.cn\r\nxmrdxebtsbuidlw.ru\r\npcaoutglcfanlyf.cn\r\neokirtabqfettfs.com\r\nqeottcvclllaqsa.ru\r\nhvmobqyuehwvwgm.com\r\nhnbnfhyxixbwffk.cn\r\naskibtsycguocko.ru\r\ntvsxogbqvnixteu.cn\r\nqtudlrkbxuicwuq.com\r\norhkshgnsliaejp.ru\r\nfgbpmlmdtunbfoj.com\r\ndsedhqimgoonplh.cn\r\njwjpnujrxpdxmrw.ru\r\nioemlragqvibuwq.cn\r\nltwspqijppaoyuf.com\r\nvkscchkdminylis.ru\r\ncrsmjwyfjquabwt.com\r\nunpvnakqcabjfjp.cn\r\nqcickeaewpwjjmt.ru\r\niuamqcewitonico.cn\r\nqqicvwionpxlfas.com\r\nubroehhqeankynd.ru\r\nsvmbnqaestsfida.com\r\ndiweofefbyokkrd.cn\r\njskdbxchrlocsrp.ru\r\nbrctrmrolkefqno.cn\r\npqrsvsdbhmlnltm.com\r\nxxdcirjfgbwtqyq.ru\r\nxgkcmoeudncfwuc.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 28 of 62\n\njleoagjgmvvjixh.cn\r\nocadpphyhewpueq.ru\r\nqiamjkmwkotxioj.cn\r\nbitfdsumfbayvcd.com\r\nvfnoxlueflkvicr.ru\r\nfwtoglabonflqdb.com\r\nyjasimvpggrgapw.cn\r\nnywneqknxvycqqe.ru\r\nhjodpknqmsvwiyo.cn\r\ncfydnesmksoocrs.com\r\noglmhqsxtpoealu.ru\r\njppvtokpawavgiy.com\r\ngpcaiqfxdwnldrp.cn\r\norhvcwuvelcxfem.ru\r\nntouoqjignvqrum.cn\r\nnhaypwtufcelxwh.com\r\nnuikpgbclumcigm.ru\r\njguamfempnwdxns.com\r\nfpyxeyqmiawsjji.cn\r\nhtwftjonkhydjae.ru\r\nfvsejjndsgqlyla.cn\r\njvlfuewqadxtpry.com\r\nblarbkptgeegope.ru\r\ncmlqcqxrkjtolol.com\r\nifsijntpgnurcbx.cn\r\njoxmonwmfpwlnar.ru\r\nvhuwpdyxynwtjhl.cn\r\njdawgpryehptdoy.com\r\nxogbjeolridayeu.ru\r\nhiuaicesfcnyijn.com\r\ngvsgqqfuveagcqi.cn\r\nkxfugpttlgvsnud.ru\r\ncscqivciepxhfhv.cn\r\nxcmjhxnejykvnoe.com\r\nfkdburuxgpvejqk.ru\r\nehknerdgapaswcw.com\r\nrvdglfsanirqkxs.cn\r\nyrpoqxlsxspqxbh.ru\r\nptvmnusjosaeypy.cn\r\nwrsgljyxnrbbieh.com\r\nsifbrfacvevhmfe.ru\r\ndjvaujwkafjlwvy.com\r\noqequdjirnelmtq.cn\r\nlxlawxxbfaduayy.ru\r\ncmssqqirfmbnbci.cn\r\nreyepkyynibnqsl.com\r\nnbjjetcmlmpdmfd.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 29 of 62\n\nfblptyfksljymrw.com\r\nxhvmlamubviamxd.cn\r\nqlebrfvtysnwbju.ru\r\nlcwjgbglmemsedq.cn\r\nmbymjpepuiwadmj.com\r\nfcfvbhifutslicr.ru\r\nmbhpikampombehi.com\r\ntjhvlaphddqpnqj.cn\r\nfhjqsisslkkivml.ru\r\nllhldlioajjbcqw.cn\r\nyibpjvhgskgnxwj.com\r\ngedbelsylbvfyif.ru\r\nsxddokildnokumg.com\r\nuonhmcnhemcolgx.cn\r\nvwjpquwohtjuuml.ru\r\nkekdovdtkpwedjf.cn\r\nrwahjqsrclpiyka.com\r\ntmkkhxnotegfqfp.ru\r\nmjafkuqkdmldiku.com\r\nyugqphjmorfxvsr.cn\r\nkhftkckeutensfh.ru\r\ngpcsaiepxjcnwah.cn\r\nibuqoujxedungqk.com\r\nxamekqbcohvyswd.ru\r\nrtnjcdvyjfkllqq.com\r\nfredmxftwnsrrkq.cn\r\nmbuoibybvhvspkr.ru\r\ngtpjvfnrmpfbtic.cn\r\ngrltlfxcrsristd.com\r\nylgivvovkdlyujb.ru\r\nmfiwvrnhgefmyqi.com\r\ncrsjdobggfxcaqo.cn\r\nfcynfmkepbwdeai.ru\r\njauqngbkiwrjqky.cn\r\nodcwftwemgichjh.com\r\nvrewqedlgimwiou.ru\r\nkmgdwleygemgjkr.com\r\neoodnwcpnojgbde.cn\r\nxfmvipybmfkfbij.ru\r\nrxnjymtgutplksn.cn\r\nweihullvexvnars.com\r\nborvetplxgxtukg.ru\r\nsmnmjippcpirhhu.com\r\ngjdqfjtkdraddfx.cn\r\nxgffcqqcatogeds.ru\r\nyftwxitflnkydkj.cn\r\ndldweihumrtnmeg.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 30 of 62\n\nhjicbocmssehnuc.ru\r\nmpctevbvepuomkw.com\r\negmsqfsfexdjisl.cn\r\nreswulypwfcvxkq.ru\r\nfqtylhqrtrecoon.cn\r\nhcfjdxgqibbvrwu.com\r\njdcuvauhylovfly.ru\r\nghfitfonkilwxjq.com\r\npsimdmianbjhlnc.cn\r\npsddlvirdlvvyww.ru\r\nlxgfdjgostmdxjf.cn\r\nmwroruybfihyifi.com\r\nxrjadlngomhinck.ru\r\njvommgvakotibyv.com\r\nnhxtfpoembfvhsx.cn\r\nsvcwvdvkegfrmqn.ru\r\njqcwcytygfwtvil.cn\r\ngvsnhrpkjrgfnih.com\r\nircetjsdbkstthn.ru\r\nvuesxvucgdicgxc.com\r\nceasffdrtammuib.cn\r\nbdcysblrsgyjqub.ru\r\nxffrcclqlvbfbrt.cn\r\nlvoejsfiguknkhk.com\r\nqeajbnonthwfatc.ru\r\nxoxkjbmkpneostm.com\r\nygiqudoeifarbbo.cn\r\nnkbxfalorbybuow.ru\r\ncsmeynjsxwdojcp.cn\r\njtgouatxlgyqeld.com\r\nyclmnbbevsvdbhf.ru\r\nqfltykaotnparcu.com\r\ntfutesscnajqcxo.cn\r\nohnhkhkqrmbqnah.ru\r\npglexgtnegvhvbd.cn\r\ndplhecxvniwihsv.com\r\nluefxyltcekvwmf.ru\r\nmppxbnvcyuqicab.com\r\nnxfkqkftfayxjaf.cn\r\nelbrnckiithspxt.ru\r\nhhsqiangddqytbl.cn\r\nlolrmdcybferhex.com\r\ninnnklaxjhqitnx.ru\r\nbtboyihmscyovei.com\r\nntdbmycqexrunna.cn\r\ntdmxinoscqmifdi.ru\r\nximsuadccplmgii.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 31 of 62\n\nvdlxrewxeoyvlbo.com\r\nvjvtfnehrsuejoo.ru\r\nxvslwshoqffbkej.com\r\ngjwmbsqkfhensvx.cn\r\nnccirnjhhxsbbjv.ru\r\nwmbamchwoownvnf.cn\r\ngqnsmdgrdffmtol.com\r\nlaufhkhsadhmnse.ru\r\njjfyfrsdhrydjxs.com\r\nxoypjqbstbrkwiq.cn\r\nhoremwgqxwicwns.ru\r\nekhwxlokffjpihw.cn\r\nvncdaglubvghxnf.com\r\nlrlmlmcewhhswge.ru\r\nrdnyrstxecgwaoy.com\r\nulbbsuhjbnxmcjk.cn\r\nhvabktexebetqkl.ru\r\nathmmowwiahavxq.cn\r\ncrvhdkjquyrvbpd.com\r\ngvqibrmmrdgebdw.ru\r\ndohdnmhlhqoqpsu.com\r\nmnivkikfomffyjw.cn\r\nfpemegqpipbtqfs.ru\r\nyhfqbujgchumfqn.cn\r\nenotjmlgtdnfyyh.com\r\nockhtvflukcrcyn.ru\r\nrrgtinpjuqilvkn.com\r\nfigflinildrukpm.cn\r\nyadlubmysvxwvwo.ru\r\ntenxtrvqkgreowl.cn\r\nmfksmyhyabqxkwx.com\r\nudqhvejajyxjiyc.ru\r\nturgtkvmgwvshls.com\r\nfhpydsvmgvgnrff.cn\r\nblmhueokumvuvrj.ru\r\nnseikggljxtuube.cn\r\neujkglihomdmrky.com\r\ndwduvhvucxtbpfj.ru\r\niijcclnehrcueoy.com\r\nsggmxlhrsuutiuy.cn\r\nukqafmwpfgwbuoo.ru\r\njvsytcxsxhdbgmd.cn\r\nintlioxjnyspumn.com\r\nbrmkdgugkptocwr.ru\r\nluvvbetwcgmaxpl.com\r\nphddjxlarowyoml.cn\r\nkggmnugishoxbgy.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 32 of 62\n\naktqowjcsexcbls.cn\r\nugxabiuovlpyhdx.com\r\nqlwpfjdqrtehcct.ru\r\nceueauomgnjydhu.com\r\nesycmlkdioxiolj.cn\r\nuqvxmcherwjnoow.ru\r\njuvtkmduoygscvt.cn\r\nkelxaxdqstfunys.com\r\nnnekhbrtkbjlfhn.ru\r\nklpqittcotqdnxm.com\r\nqpukbdmwunvxbwx.cn\r\npestqecgtmjvxni.ru\r\nwtgllikqyqubcjv.cn\r\nnvsblqtnifdtgoh.com\r\nyiwfikcppimiwle.ru\r\nlfjnvxjgxtsygbv.com\r\nmcalbfnjswahwou.cn\r\nnmmljskqpvxupjb.ru\r\ngkficpqyiiqmwga.cn\r\nuaoxmcwyuphjhhu.com\r\nibkgmmqvxjdspis.ru\r\nyqacqfbqrmbyipb.com\r\ntneubbcipjuvwuc.cn\r\nvqcwpteetiidbmo.ru\r\nydihpkptqostjpj.cn\r\ndayanxglxqewsxe.com\r\nysulndoywnlqbld.ru\r\nqeyfriuhbtflmuu.com\r\nvlyarcpfytojqaq.cn\r\nlkwyedlvjnrtlhb.ru\r\nwqbqndaldvtobbd.cn\r\nngubqjfprmyirrv.com\r\ndlcjtkdcunxodch.ru\r\nxqsksgjcaeqmexa.com\r\nnrwrcgdcwbhymqm.cn\r\nxjhqtchtlynntep.ru\r\nyksmaydiilmhgtr.cn\r\nhlcmixxsihgmmmj.com\r\nxctnnontjphmgwr.ru\r\nspnuavkgysscros.com\r\nudrjlmwicslmbxm.cn\r\ncjievjnyswqjhep.ru\r\nngsuhwkxktffdhu.cn\r\noodmpqvkkvurndn.com\r\nocyqnecrjdnqeeb.ru\r\nugviufqvutxkpqi.com\r\nmagqobsrkbbmhyp.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 33 of 62\n\nyppwurmwoqqtfxg.ru\r\nryghuygrwhihbpm.cn\r\npeeiqkymjweohhc.com\r\ngbrfbglcmdsgapt.ru\r\ntggjwdxqwkrstcd.com\r\nsohsgdlwdcwgdfo.cn\r\nulcmrktheyrqhdv.ru\r\nbepovpskrtqpsbh.cn\r\nnipivfishlivqan.com\r\ngasclegchigdssn.ru\r\ndbkxgwjrwgxruix.com\r\nwgtnjwaskynetar.cn\r\nbsinurgdqerespb.ru\r\nijhfvnqaowaigkd.cn\r\nceglcdfglpuuxut.com\r\nlmcdbqyjvyjfupq.ru\r\niusmdbkxemyoxfc.com\r\nsvxcnuvulymsxnl.cn\r\nighhqavdlcuapsj.ru\r\nlesxgnrelwsyrsr.cn\r\noahrqjriptyoiee.com\r\neervsxqdgyikmhg.ru\r\nsmwrtaaacuvtgui.com\r\nmsmevngikaxhqvn.cn\r\ngdrlrixvmloxqyb.ru\r\ngfoxslgshvlclby.cn\r\nvncqjhyvxylvaqs.com\r\nuxdhbiqoorlmulo.ru\r\nthiklaqxmcdefgi.com\r\npiqmjvaqwpawoom.cn\r\nmgffrredqrdbwai.ru\r\ngmskmttajqphkdn.cn\r\niolsqbophtxpsix.com\r\nfdoeicdtatbclsn.ru\r\nktyboglppvgoblx.com\r\nrcwbtpqlmmvxljk.cn\r\nprcpyxvotdebcbw.ru\r\netribuyxdxsrbtx.cn\r\nuivfmpvkoskuvqy.com\r\naiooqkonpxpydga.ru\r\nmaakpgiayhvibol.com\r\nrrxekrjcdbsdxbg.cn\r\njgnvcdcysfgkjeo.ru\r\nltytcuxgngcwvdf.cn\r\nwprxaunaofvhgde.com\r\nunveuhypbnpgjwb.ru\r\nhyuhggotookublh.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 34 of 62\n\nmofgfssdokpgvbr.cn\r\nqtyogpejjhobtdj.ru\r\noexwvkrxrgbjgcw.cn\r\ncrykcssqrtndjeu.com\r\nkudcbrcljqiiett.ru\r\nilollpdqurdwlnl.com\r\ngdjkkfkqrgoyycg.cn\r\nfinlginfigjdbhe.ru\r\nibkuvipprsdkdmx.cn\r\nbvtcvjnyrmgxber.com\r\npmsbdcijdknqtem.ru\r\nqwmnmgldxsimrhw.com\r\nnuosikjhalxqlmk.cn\r\nsgmhknphcopiuge.ru\r\numgeboxveycartf.cn\r\nvwltfaqrkvklfac.com\r\nncgshviaiedghuf.ru\r\nrbouffjfqkowepl.com\r\nfugjnjbjextdkbr.cn\r\npcxsvijobpuaxmf.ru\r\nbvdpisnlgvpmlrl.cn\r\nwihkplbpmwamyea.com\r\nqjilaekcflngllk.ru\r\nnhcdsfogdrvhrty.com\r\ngibgtygisqspofq.cn\r\npyyrujubbkngfnl.ru\r\nrgqgnrrpoxbiwmp.cn\r\netdqrxcjyfsowxh.com\r\nwbffilpufoxbgfp.ru\r\nspmbasvyodiybor.com\r\nfpskitgfkmlvgfv.cn\r\nyvajqgncnmtwckn.ru\r\ndlllwgoikehodhg.cn\r\nwtjihfjmmuqcqvj.com\r\nrnemujlobnbrrjy.ru\r\ndaklcjvrppyyukv.com\r\ntslncxgamhtqkee.cn\r\njfbeexkqkhhmjov.ru\r\ndaxyveofsrpdchm.cn\r\nuiytimvquvtvwuf.com\r\nbufundsmlqtoaen.ru\r\navabkyuwuwvvqti.com\r\npmqrdbijejeicdi.cn\r\nrxwujkpkglodgcf.ru\r\nxvxulrlwvgyerxu.cn\r\nendvwysmqyypigu.com\r\njpdpeoxojofwkqf.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 35 of 62\n\nldashduxbatderp.com\r\nikeanrrniwbispq.cn\r\nrhkyguuepeffcni.ru\r\nntbykonhaegwqaq.cn\r\nqgomqvsvvxftclu.com\r\ntjfhnhhtbwqoiwe.ru\r\nixvigdsdfpvixdf.com\r\nlebllhcilwiatfs.cn\r\nmktaividtytjmuk.ru\r\nwnegbkqlkkvsptx.cn\r\njslfayaigibymuw.com\r\nmuprnynrioeifkx.ru\r\nbiridgcxbgrecor.com\r\nvdhyylgtyocjkov.cn\r\ngeetrjixkfhejgw.ru\r\ntbkoonxlqnaijrs.cn\r\nfxsupwigjfvmysm.com\r\nsycyqeuiqqvktdf.ru\r\nfvoioljkloqxykn.com\r\njejgkjwrgxidtkh.cn\r\ntkqpletwtyifyts.ru\r\nkjdsewqlkrbouoy.cn\r\nggddjtkfpgdllkh.com\r\njtvreluilwmiqyg.ru\r\nbnwubbwpitvobjs.com\r\ndjldndhxrhhwlcq.cn\r\nmijwllgmyvjtcvv.ru\r\nnoowxisiwemgcev.cn\r\nsjiptefabdwcvys.com\r\ntnktpjgbcqcxeyq.ru\r\nekbhankbvyvjyfk.com\r\nbrdbhphqbjrjqgf.cn\r\nphjwalfidbxxvlb.ru\r\nycjcdvrocejyooq.cn\r\nxmnpjigtgumbqas.com\r\nmvpokngbpjrjgnc.ru\r\nibunsvfjjhehwqi.com\r\nhvqaohpuhrqxlsc.cn\r\ncpwowgpuvjbigjn.ru\r\nceecrqowordefbt.cn\r\nqgxcdrxqqenovrt.com\r\nbpptsubhhkurkwx.ru\r\nxtxuyybfkggiyxb.com\r\nxvjpqtxnwqkbmed.cn\r\nkdstpdbmlywaiqf.ru\r\nughytfhyedxdenn.cn\r\nhethldbhrjmpkpw.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 36 of 62\n\nhgkwtdwoulnvshy.ru\r\npkwdpwfjhvhqklw.com\r\nnmewlchldlsfswy.cn\r\nsjyyamcqhnpaptv.ru\r\ncwikspgbntnehiq.cn\r\nybcguhgbpqpuaww.com\r\nhtsceyyyfuptvsj.ru\r\nxrckjircsfoeghd.com\r\nusqdkvaphfvcnml.cn\r\nxnjhvknxlmycsvp.ru\r\nwefjdyrunjntwan.cn\r\njtlbwewyktfaauy.com\r\nnkjtebqgfrrcbhe.ru\r\nruutqusfmorpduc.com\r\nodcevlqjgftiktv.cn\r\nxlexhpbwguprkrw.ru\r\nttrhkevhwbfujdp.cn\r\ninkeqnajyhlxmel.com\r\nfpboftdrqowkils.ru\r\nsewlvyisxriwryu.com\r\ntnyhqdfchnlpjje.cn\r\nfqxxyynkkqavkef.ru\r\neoldkojaydfrwry.cn\r\nmdfcjgfarakqetd.com\r\nsuhuudxakjlmxgx.ru\r\nsftjyoqohpwvgvy.com\r\nedpnyyfisrveijh.cn\r\nxstjppxdiwxyrud.ru\r\ncheygafmhjagmet.cn\r\nvrclgnghwdialyv.com\r\ndtawyaewclnvpft.ru\r\npwgpeyhbdoaysid.com\r\nyncgdlgsiqqqnxi.cn\r\ntttxhkrglnxplbj.ru\r\npwgjecvdfafouiv.cn\r\nsaosicgvdlqcsal.com\r\nqnpwmprnlxhgnms.ru\r\nagoidhopruhpqbr.com\r\nsfdyeikqfkbjxwa.cn\r\nauikshmtpnfklhr.ru\r\nhoakmswyiemghih.cn\r\nykviqmqrysrjgee.com\r\nfjqwnvuftjohsce.ru\r\nbletwtogqjqykno.com\r\nrvpcarvsaeynbpq.cn\r\nnfgbjpdttcumbgq.ru\r\njfnolqrlvlflkve.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 37 of 62\n\ndjeatpxpwxhjpgf.com\r\nkdvhnjqfcbokwma.ru\r\nlpythjpscsvqdwr.com\r\nhlhygqvktjdijcu.cn\r\nkdamuuvwfoqybhs.ru\r\nunjxcfetigwbwxt.cn\r\niojoduvvjcvrrbn.com\r\nwetjkwocrbwlqgk.ru\r\nkrspraspytjrcrf.com\r\ndxumfoyacrgvmwb.cn\r\nhsaeoudtywyswvn.ru\r\njlijecfcswohmhg.cn\r\ntfiwiixnnxdyxqt.com\r\ndtgqbiovmefaydg.ru\r\ntuntmfkixigfuxd.com\r\nivspgusvdchsjvl.cn\r\nrhcvroigmnpcmip.ru\r\nhiwhrxcbqqfbaxf.cn\r\nwaxkenrjmgentmp.com\r\nurnylulslxqgvnh.ru\r\npgkhqdviamlocyv.com\r\nymyjinqefxnptys.cn\r\nbiivcgfhawlmhcp.ru\r\nwbujlfhreoauosr.cn\r\nuwtfxsiirnkpdry.com\r\nsyospbqkrdmvutx.ru\r\nfjxfoqpexukvmfa.com\r\nmicswknesfhoyeg.cn\r\njrvdxxevpfcwybr.ru\r\nskdpvqdcjpwkmiu.cn\r\nibripifvqhvedmp.com\r\njijcrsgklimppop.ru\r\nhxmgsbyeuyymmxv.com\r\nsqjkwbrmjelgnqc.cn\r\njgygjcitxyybhdq.ru\r\nxmctkfecsnbbnpk.cn\r\nxwfxgvymquujjjs.com\r\nonmocmsbqqtigfp.ru\r\ntswoipibjghgyvp.com\r\nthewvvvvdjibhie.cn\r\nwljxfkfylotppck.ru\r\nwbnsgqfiytbyvca.cn\r\neuyamavfrcgosru.com\r\nruvjvjaumarrhvf.ru\r\nnwiaadcsifyagtt.com\r\npwqaetbfpgknakl.cn\r\ncvouglamxhqjlwh.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 38 of 62\n\nlltvmtlrcujufwv.cn\r\nprhpjlrxengpvde.com\r\nsjqxlspmolbtybj.ru\r\nayodlhitcajhlym.com\r\nfisinjitvdoclpm.cn\r\nclxdffdsyecweye.ru\r\nsyjrydlhhvqgmfj.cn\r\nntdlhorkxjfwhnl.com\r\nhowyfplfobxaoly.ru\r\nknmqcmsildcvubw.com\r\nstnentvgfvjtgfg.cn\r\nlexiqlhmpyicjwh.ru\r\nmgbabjbddqyemds.cn\r\naouyrjbxmbiofja.com\r\nxvqlhkhdfvwqlcb.ru\r\nrmldyeedowakkpg.com\r\nmtfsbucedrspkyb.cn\r\nhvryciivofxdamv.ru\r\nbborbtxmirwkfpr.cn\r\nmuvfrrnpvtbigro.com\r\nagqvfjmdggvxskb.ru\r\nhkfvdfcugujudih.com\r\ntjtptjbyitnsjmq.cn\r\nxgetymwmrvaofmc.ru\r\nhvecqetryyiuxry.cn\r\namohdnlwcudcjmf.com\r\nxxghoxturvaromb.ru\r\nldddykcowpwyiec.com\r\nnjvvpltajsprifm.cn\r\noahvupbgoulycjo.ru\r\ntfkdogjgryxwoil.cn\r\nqqahropfoessxiy.com\r\nynwqyylyuvlpkiu.ru\r\nvlviigjcdbmiryi.com\r\nqdjixwoxceogeys.cn\r\nepvaofsgfjwvewd.ru\r\nanbtmgqxpgqwmxn.cn\r\nqajigwtgbrabsxr.com\r\nrqjhcrpyatmiijh.ru\r\ntsdjvwgmgsfkpqy.com\r\nxxiqjycnawpiaxe.cn\r\nthmjbjifpogjyat.ru\r\niloxoqypyyivykt.cn\r\nbhsuhgpctoxncij.com\r\naavigshrqqcwhem.ru\r\nwiqviudjnndbulh.com\r\nesxowvfhljxjfyy.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 39 of 62\n\nppcruoucttxxvpv.ru\r\nsnhygjimebquitq.cn\r\nquiijmrcjnieyqg.com\r\ncxaxtowletkvedk.ru\r\ncmuhknysbhkvgtf.com\r\nlotisuiafmbjoyd.cn\r\nmrsrgoclpnpxaup.ru\r\nakrtkfofyrdcuru.cn\r\nwfweyrxgoolisdl.com\r\nxqyvqbimdwrhore.ru\r\nfqsulgegarbletw.com\r\nemaxdmdauuykgxo.cn\r\ntqarmddmhsyplpl.ru\r\ngilwcyfpcxiruox.cn\r\nmhgdpyyefuqtmef.com\r\nfukhpmmrosvaksv.ru\r\noqpuecvegbkgjff.com\r\niegrdvneuurwknd.cn\r\nsreucyyfpyibrji.ru\r\nsojvpfualvevysf.cn\r\nlhsehfdwxffuitx.com\r\nunoabtkyhmmbxvs.ru\r\nkrnlwxdokipxofg.com\r\nsjbnevwvlbkvrjb.cn\r\nbgkbfdfnlqmslsp.ru\r\nabkuqsgihqjsdkk.cn\r\nrpeentwgftdqbxl.com\r\ncryfmgiwyxfqsko.ru\r\nwkmxyhqjbygyvxg.com\r\nmseimpmyuffhjwp.cn\r\nqnxlaqkufnhvkuu.ru\r\nrqtrmecierqubnc.cn\r\ncjctkxsjhwbtqpf.com\r\ndxkxrdmimarxjud.ru\r\nudnscciadmxrurh.com\r\njddfrwffpfvanrc.cn\r\nyxanbytphtjovhk.ru\r\ngpproteylbebpxr.cn\r\notkktvxwdponfea.com\r\nfksvcerdpfiobnc.ru\r\nhotosgljetqolxu.com\r\ntffhotoqtisagqh.cn\r\ngyegoctuxmihswe.ru\r\nxcnsxtocwmirxbh.cn\r\nirhrqjnqcgsxufy.com\r\nwdmwradxjogfemf.ru\r\nyrriqoorpxmoegu.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 40 of 62\n\nntjhokdwpfqgsoc.cn\r\nvykujwnniejtvmk.ru\r\novutkqttxajigwn.cn\r\ninupmqhfyyferls.com\r\nqgqcnkckfteufqt.ru\r\npafnuhfmuadmsva.com\r\nykigqqcalungqmv.cn\r\nmvsrbvalscoimun.ru\r\nkervbcihuyeheuh.cn\r\nludbguwoikqxexd.com\r\nfloqkhxdslrqhyu.ru\r\nauaslgryykxgsjk.com\r\nlqpneeqqcgcxpan.cn\r\nwphqaxyokobxoju.ru\r\nowygvbfoqtuvwkw.cn\r\nmoypsxfakoxtohc.com\r\nersmoqajysxxuwy.ru\r\nvgyfgkbnfwjpcdv.com\r\nshpxscwienqulyd.cn\r\nondkumsvthdtuus.ru\r\ntsgkqyjpxhvkbem.cn\r\neuuooaujeigksos.com\r\nfcpqxivwruqjcbg.ru\r\nqxmoeyvclfqcgke.com\r\nekifpakfrinpfdi.cn\r\npacjnfytysxcfui.ru\r\nbuusiwieuednapm.cn\r\nesvsoopomllayfo.com\r\nnqyoaqlcafjkrbn.ru\r\njdrxrxwtsgpvdpd.com\r\nxrthydqegupctiw.cn\r\nfwahuhqonhyugyi.ru\r\nkuifprqfriiyyhn.cn\r\ntuhfftjunbscpyu.com\r\ncclfqmulkcgugov.ru\r\nbsutfuggtvlwwym.com\r\ncydvtrovghbbqeh.cn\r\nvelkiqantccnkxc.ru\r\nphkafcariucsvee.cn\r\ndrnyblvlekicdfp.com\r\ntejgjpphnvysfhc.ru\r\nfnnqwswwduhywkj.com\r\npjqplnutovdyrgw.cn\r\nwahrplqeblafhfy.ru\r\nbuqtfgdxsfxsrqe.cn\r\nfhciaixfuovlcfl.com\r\nxywbeirqvewnysu.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 41 of 62\n\nrsjwffoqypgwtkr.com\r\nhhcskrbeigrkqyx.cn\r\nmuystuxqgardbrg.ru\r\npodhflxrllvjreg.cn\r\nkkrnxbaftkbvlgx.com\r\niglytxfaixjkgrn.ru\r\nbsuubrfhdbfmhfk.com\r\ngubtdcfhoqstpjt.cn\r\nbgcngjveoesovva.ru\r\ndphrelhqsmpsiby.cn\r\nqyesevbidecbpiw.com\r\nskyabutsjilmtgr.ru\r\ntvugdbqqlkntocd.com\r\nlgripewviyxykks.cn\r\nymkykfrseemaxrh.ru\r\ndrkrqnmrxpluikm.cn\r\ngqqvruivxrlglgy.com\r\nulrdyhubprmvbud.ru\r\naqfmeltowaikphv.com\r\nexhmpccovbbggkg.cn\r\nklwgrbbgqjbvegt.ru\r\ntcqjldtlvarpeup.cn\r\nevodbijvbxnkylp.com\r\namvoeknphsgwlgn.ru\r\naoeurhpolnrsbuo.com\r\nbvtuwfilquchdxq.cn\r\nhwpypcqsjfjbptu.ru\r\nxvxygrgauepvqwg.cn\r\nvsxbyomxngxqoqf.com\r\ndlcopdvxqkrngwh.ru\r\nwouexgdtpknogwt.com\r\nfyaqtugfdearsrs.cn\r\nleritkmfandcnsx.ru\r\npvotvooxhrwtycc.cn\r\nhneiwdsipujmyxo.com\r\nsulnetiebkxhnsf.ru\r\nfxmviwqanmcgacf.com\r\nbimdhukmbaqepvh.cn\r\ncoksrvpebyjoxif.ru\r\nucxmlljsrwjarea.cn\r\nihxgchbxeteduhm.com\r\ngvrcwnpqhcoporj.ru\r\nilbplpkwqmfaqiq.com\r\nfrpelhahhaivtok.cn\r\nlbkinctgqgokunr.ru\r\npijwnklruikrefq.cn\r\nobfuvlvkypaxxvm.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 42 of 62\n\nkianuwmdyormcsx.ru\r\nbyyhgwarkwinors.com\r\njsopoilgqenycqe.cn\r\nojohpnlgiajgnea.ru\r\njiyujaefxrapwyp.cn\r\nfdfoajaajtwtggt.com\r\nbofkooxjmwqfbpc.ru\r\nqhwnykpbovwxekc.com\r\npctyfximjhjbuya.cn\r\nikpbpafguqsetyq.ru\r\nrveljnlrebrfwgb.cn\r\nuudntdaylsrmtib.com\r\nimcspxjsmncjejd.ru\r\napvqxcvijueewul.com\r\nogwynwflobucuai.cn\r\ngnvdqhhqsibfaax.ru\r\ncqrdoudynxonrvp.cn\r\nujqhccabflyfrei.com\r\neuwqoogdacjshcf.ru\r\ntkgynnjlfytrjqm.com\r\nyybrifghaetcvar.cn\r\nakdekfmthpymsvf.ru\r\ngnhqspioevywbgj.cn\r\nfyerlcvvqhembjt.com\r\nligsuytjimraqgl.ru\r\nquorpahotosbrqt.com\r\nbudveqrqhgcgrus.cn\r\nllmfymialqgocvh.ru\r\nivkpniwiaartwsa.cn\r\nyiwnkkjmqakwdhx.com\r\nwqmacjhrmyxrutd.ru\r\nicrhjpnqxmblbhb.com\r\negnnoimnkcsqgwd.cn\r\nmqdvahgexyifnru.ru\r\natyoyqfuvkhslhw.cn\r\nwrefokwrdxkwkhv.com\r\nlmedbobsiyycnnb.ru\r\nqojimbvxwedjksl.com\r\nqvcuobfqfnjotry.cn\r\njdbhuqkkkrpujqc.ru\r\nttyvbtnanulfotd.cn\r\nypgrkvftxsagpfh.com\r\nugclewaolsublri.ru\r\nxctaxyrlolfxbgu.com\r\nsufpuwjgyeklvyn.cn\r\ncgkyjnqvebwibep.ru\r\ndyuplccuphuxplk.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 43 of 62\n\nuftjrfktbaptvra.com\r\nxldorhbvusdexfd.ru\r\npbnapirnvrrtsnd.com\r\nneibgywnpfwinoi.cn\r\nnhvymheoqmbxhrr.ru\r\nacnyysxxdwiuoxm.cn\r\ngmpdlnnoeaebpyp.com\r\niidusekofefebje.ru\r\ncvnuwpysuxawwhc.com\r\nadrvkxptajgukxg.cn\r\nhcgsppgiihswkca.ru\r\nsrxvtmvonpddwjg.cn\r\nthsiisscliofoyw.com\r\nracfnestntxrqdc.ru\r\njlxyfjoblhbtgfu.com\r\njoonbwdkwnsmquq.cn\r\nuduwyammfxiwcah.ru\r\nfnaktpcwfotoffn.cn\r\njgfnwbrygsrgcqv.com\r\nlyjipqgvatsuogp.ru\r\nbjtedattupifimd.com\r\nicnbgjhgqutnfqu.cn\r\nheihvrtmmikwbkr.ru\r\nhlttrxoxbitkpij.cn\r\nkrcvryajincvjhq.com\r\nlfjrqfymehxnvpm.ru\r\nceilwfssimwovwm.com\r\ncgbxvyihkijnxdt.cn\r\ncnittxhbhmftivl.ru\r\nnarasjeydddvoha.cn\r\nywkmhayhhcecnem.com\r\nmriwxiaxtfkvrgo.ru\r\nitltddbxhtbjlcl.com\r\nklsxojtrvnfxrvb.cn\r\nspspcywaafwputv.ru\r\novkcfxnyenovqyt.cn\r\nwiomdwwwpucmdpu.com\r\njrrpafgmcyebmpa.ru\r\nbknddknwurhijts.com\r\ndwkgucifeuyhrch.cn\r\nvirexyglgholqkn.ru\r\nrwvtsjpfpvbjfed.cn\r\nmbbdocsmxnkhgpw.com\r\nsumubredcxmhgfe.ru\r\njwasamjfpxypplr.com\r\nctfdkahllnywbos.cn\r\nnhanuoxaoaamuxp.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 44 of 62\n\nmbhifpishvrkpad.cn\r\nmmvasmgytxjvtbr.com\r\ncepkpicfqsxnbmm.ru\r\npdrucdrpniwtufr.com\r\nbbeelaxdyuromws.cn\r\nhxntucebwblyhqa.ru\r\njnwikurtkocdfqq.cn\r\nbxmphnskyvpvxrn.com\r\nwvgsolxytuuvaka.ru\r\nruhkeetodffwpwf.com\r\nbgmqouiwmqckmol.cn\r\ncgqowqmmupekcgd.ru\r\nxnksgaytcvgroli.cn\r\nbjrurnmflipmcvc.com\r\nolcougqfvmtonqa.ru\r\nitnvgfcafcbljrh.com\r\nkuqhibmddorxxia.cn\r\nohxutsoqiteuwni.ru\r\ntkmqxpwwbpmuqrx.cn\r\nvvpjaufxdxdamaq.com\r\nikqmrxdqubkbgjy.ru\r\nhflnkqtraecrpmj.com\r\nsflwmivnswlsspj.cn\r\nbhsvjnmnbpnbitt.ru\r\nbodxhdxmdhswjpn.cn\r\nehkkfnsoiqmxkgm.com\r\nenrpsessngqnpyl.ru\r\nwimxghdrehapwcc.com\r\nvcyepklwfxuxbwk.cn\r\nxfakqljxxavbpnn.ru\r\njsrbobrgyoxndcu.cn\r\njsbspckglrbyrkr.com\r\npupnpvlvturbixv.ru\r\nescfjiunnyxfoht.com\r\nnuhelqaabeqclfa.cn\r\njqbgniiqyepiavu.ru\r\napmturiybvhqetg.cn\r\nwskhtjchntdnaxl.com\r\nyqykdihdxuqawwd.ru\r\ncmywoctgwltdoln.com\r\nqwxvhhhmnapcfak.cn\r\ndjtyscqssdgcxfu.ru\r\nlabouhtpopraafx.cn\r\nrarafiofkaapjyb.com\r\nwdlvcsxsfkqjrht.ru\r\nlwfhvjmxhuufvkx.com\r\njpyrsudpyamperh.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 45 of 62\n\ntkddtdeqorpihdf.ru\r\nrqvylowmrxxkdgy.cn\r\nbvhmgsvojsmeqfc.com\r\nvlunphswwbrunjj.ru\r\nffhvvqpgqcnjudr.com\r\nttbyywsyktvqspy.cn\r\ndaxkoxuwbwymhvn.ru\r\nrmhwkotdnnoylvr.cn\r\nqvxdioqwujvmqpm.com\r\nquwdqfaidqhrcfo.ru\r\nyiaurqxrolfpmjj.com\r\ncypguqfdsenyukt.cn\r\nfjbbiecmajlgymw.ru\r\nkcilahyhpvfmvek.cn\r\npmaynpnkoqmmcpm.com\r\nyomgxbkwrvwlqia.ru\r\nxwirwhkbcvcavjl.com\r\nkakmxljlrtmcond.cn\r\nmxmpinsvyflnocr.ru\r\nxgxiiwafrghmagl.cn\r\nxktdtvvnkwfjnrp.com\r\njfptmqidnspvamf.ru\r\njrvvglrlisxtokn.com\r\nutlnqwolvufmccw.cn\r\nqesaceleubgkmri.ru\r\nrvtpjweiltjyrnc.cn\r\nnpyurxerjvhxkfl.com\r\njdswxuymjrjnwgn.ru\r\nmwofisrwbxwnhxq.com\r\ndswtiognsrjbgox.cn\r\nlpgjnbtcgfgaopd.ru\r\npgsuygiurhakcun.cn\r\nmirgvmrwufrntdc.com\r\nqwwlxmhrkbmpjnt.ru\r\nqoyvokggjcwsync.com\r\nagtteuqdyiyogbk.cn\r\npljruegguihgwdk.ru\r\ntfnefbylngsyjfr.cn\r\nhjdjjevlrafnqfw.com\r\nqowpiwttvipejqy.ru\r\naiwdwadrqdryqvv.com\r\nmclephhixqglxae.cn\r\nltqdmuqkddaghhc.ru\r\nbitrpaxmsqgokyw.cn\r\nahiyngamqpeejtx.com\r\nwkyvyhvunqwgmgt.ru\r\nriycdwgvdwwtdnu.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 46 of 62\n\noxtomfoipilbtpn.cn\r\nbamelrnolgxwsrl.ru\r\nrwjcltptfyablvx.cn\r\nlnnrpwtstcbmdhn.com\r\nxuwjfmtbdknpyry.ru\r\ninxoscqjqqjvnqp.com\r\nsynknaepmhpuwtp.cn\r\nuqvnctbkmnqfvwi.ru\r\nqccouxbjrkosgvk.cn\r\nkaewulipnastptd.com\r\nmtsnijrqkkadoec.ru\r\nbmpfkgsottkswfh.com\r\nyafhgpnkgckvdgj.cn\r\nheivrlaivutrohd.ru\r\nyjbieaivbikqhmp.cn\r\nhxbgwylxlmffjxp.com\r\noniyartsuhjkuyu.ru\r\neqhrternbgeiqmv.com\r\nqudxpqcqsgujbhs.cn\r\ndnlbedcsgfjinvt.ru\r\nouoyumusyujheor.cn\r\nctvwjwnhjhlkiux.com\r\nklqaqtiiqvqbimw.ru\r\nuiepagnqxchwiuy.com\r\ndeykclsdoqbpqqf.cn\r\ndssvcmuwasgoocu.ru\r\nnbocgwtxxkhegni.cn\r\nxnsqwljdqslsybm.com\r\nskrfuerskhgsdyl.ru\r\nxbyvmteuefhclxr.com\r\nspxawnystuourms.cn\r\nvfrvavfscrqoapa.ru\r\nysihskwayqiayot.cn\r\nrfkulugwaaiavnl.com\r\nmtadrqkijcjkxgp.ru\r\nxmpmxuyvrmvfkah.com\r\nxqgncdiossylkpl.cn\r\nhfimbtfpsiwcmde.ru\r\nufskexwjglrdtay.cn\r\ntyahmbnowfeassn.com\r\nhquvfwllrtpjnvx.ru\r\noqogaxohvmpniaa.com\r\nldwhrpqqkurdrnv.cn\r\nxgvhefdcmikxofr.ru\r\nxpkywctxtcxoxtm.cn\r\nwacphvldihlrert.com\r\nnusdxluvftfrkjk.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 47 of 62\n\npnjjyyjquwkrvrb.com\r\ncpsdhnmqondlllr.cn\r\neljyuobnbnkljkp.ru\r\nabivljtehikymfx.cn\r\nualoxpgjmjxwkpp.com\r\nfnytlcrsviukqbj.ru\r\naeqponrhgasiemd.com\r\nokqkommvkuldmyq.cn\r\niygpiblfarefmgo.ru\r\nlvwwoecyqvfrjte.cn\r\nhnlgeffcfxctasu.com\r\nukqwixkgtmvsfwa.ru\r\nqdvmafunbyrergh.com\r\novtbqbynfosiwot.cn\r\nynnceqjnafqjjrj.ru\r\njoymxsninrcrcll.cn\r\nchkglkcfkiimkwa.com\r\ngpoojxjyjgqubeb.ru\r\nvkkjmjemuxvhncm.com\r\nrbuvahshhtixfjd.cn\r\nrsbklnqmpabsdxa.ru\r\ndejrxcotiwgdlte.cn\r\nfyqocjretpcakug.com\r\nmsniauejingsaao.ru\r\nudeudwmyvrlwplo.com\r\nhtqmsorfpxwyemc.cn\r\nkkxxajfsfdfplkc.ru\r\nljfkbiiiymptplu.cn\r\ntagypxecprqdbfn.com\r\nwbgwmrswhwxcwkx.ru\r\nblxacuifmgklrmp.com\r\njovxsdevvgptfey.cn\r\nshuupbbfwcaygyg.ru\r\nymfteqotdvyvtog.cn\r\ngbkvumsiaaidimg.com\r\nbcatjjemqanspfg.ru\r\nwgvsjuhhrxcsjli.com\r\nfliihanfesboeej.cn\r\nryvmhsshmvcomgp.ru\r\npkaeggrclinelqg.cn\r\nuqhfbckltoeyass.com\r\nmwidejisrxepklj.ru\r\nunjkltxvuusycvi.com\r\nlqbmruyybsvftfn.cn\r\nohiwaegsycnotic.ru\r\nysuvsuxhrgtrlfm.cn\r\nnidhwiuhmgrjfdq.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 48 of 62\n\nxsyenrpmtnuxjur.ru\r\nkidplmbgvuluaag.com\r\ndrcljmdxapulomt.cn\r\nctackwqinkrfugj.ru\r\nquxaceahjppwgrx.cn\r\ntbyxkyclmuewgwh.com\r\nitoacqyihfkdkhm.ru\r\netwldwundwomfli.com\r\nhwixieauctuakwi.cn\r\ndhbcndtpqurbpyd.ru\r\nfxdkpqnjhqqnupt.cn\r\nndhhidicebrdbys.com\r\naranfpalqugldgd.ru\r\nfmdtcspmxacbutm.com\r\ngjbfpfuwodjvfdj.cn\r\nanhsuqkdakeaiur.ru\r\nbbxglobwofglhpg.cn\r\nqbvvellsuyqiqst.com\r\nomeffvgmrmhadhg.ru\r\nxdgusyvppuwewio.com\r\nnuwvblhdxxfmekp.cn\r\neopbvltetfslbkn.ru\r\nfnediurxjfmfhvl.cn\r\nnllmqwdfqodeolf.com\r\neglrycoxoldkhos.ru\r\npdewbhkiholjjkn.com\r\nhhsxmbbtmologyl.cn\r\nivkfxicfnhxwign.ru\r\nqfgojmvsmtriapm.cn\r\njwtypxttgkxgkib.com\r\nyovievfcfrpjsig.ru\r\nomxrdkrsqncdjle.com\r\nnkrbpyspnruwnuo.cn\r\nokoufarxbwultjr.ru\r\ndehsyenodrftkaj.cn\r\nicimcdjucudffbr.com\r\njhqqvfmikuslykr.ru\r\nnxbhjnnbagyncbe.com\r\nrbsunvmbtipcujc.cn\r\ndmkpheoqsfuvwxo.ru\r\nwmlrmceqrrihhjg.cn\r\nycnbmrorcldwdpc.com\r\nysppldxbgrvfukb.ru\r\nvfhtibjgdodvaeu.com\r\njvvltegvvqllpnc.cn\r\nuqvmbmkmnijqaue.ru\r\ncoqenmtlhfweakv.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 49 of 62\n\nonuanuhffjbsqbm.com\r\nlmryiwxkakblkkd.ru\r\nvneugtrknyfngos.com\r\nftdhrmkbiehcrwe.cn\r\nlbijaqxhfqegiou.ru\r\nkaijeakafbayhhf.cn\r\nvdcsyoagpmolayc.com\r\nvnkhfaiueysjprm.ru\r\nofpgldafgifivjr.com\r\njnttknndqhsbxrq.cn\r\negusnkbawrrmqvj.ru\r\nthyesvueyqyjdak.cn\r\nnejlqrdlrcpqxqa.com\r\ngjbtsodgjqblmcu.ru\r\ngawcwxndhnlnest.com\r\nmxwbjhhuqjfadet.cn\r\nubixqreastoxkki.ru\r\nprhprotjldkcdkw.cn\r\nmhhklmfsyheabmo.com\r\ncuqgckaomyovqkt.ru\r\nirsqnrtvrnulasj.com\r\neokomnhxsqufhpt.cn\r\nrkccxwrlqxvegji.ru\r\ngiflgpyoybrkxlb.cn\r\nwplekgtpwqxhkiu.com\r\nahwcobmsjffvmar.ru\r\nljkeurdkbhbcnpy.com\r\nanekoevrqvrnaro.cn\r\nffjpbxhthftrgfb.ru\r\nxnntuqaauibibwv.cn\r\nsrrimwjtplqxpcl.com\r\nyeiorxqggpdkwgr.ru\r\nsmqkvhdwkbbfmil.com\r\njfrpkkraehinxwi.cn\r\nnrryptctfqdqaph.ru\r\nhcilwmpodpjnjdq.cn\r\nxkegjsghydeflng.com\r\nultsftcntlurpmo.ru\r\npoecmcdnfmpqyoo.com\r\nhwpshloyytqdfkx.cn\r\najkkumutpbvwmnu.ru\r\nvstdcydmycqngve.cn\r\nyobcajybttpmqik.com\r\nqhqjadkstomnvkk.ru\r\nsnlkvqhxjmfkjyd.com\r\nlohdrgogelpkxxb.cn\r\njeuybpjaqcvbxoe.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 50 of 62\n\nimouhdfimqejmtg.cn\r\nvgghrdlqjvspvhq.com\r\naxeheqrjvybyjsx.ru\r\npsnnkrirmvibgru.com\r\nmrdwiqgjfoctpbx.cn\r\ngejlnmjwievrcle.ru\r\nlycqxiacdiybcev.cn\r\nuohvvxldlmmqtwv.com\r\nsgkfhikallctycs.ru\r\nvmkjsugiayohdlr.com\r\nqenhnuiymmdcnyy.cn\r\nlpmaloptkddmmpc.ru\r\nxgxpqstuhgdmwja.cn\r\ngfjwkiinckfvnut.com\r\nmchbkrnshathtcg.ru\r\ngtadbgtndryfbdq.com\r\nhwehtxnheitrfmi.cn\r\nklfuwqdrtgojsvx.ru\r\nymgvgfasqqnpjck.cn\r\nttvlewlqeixwvjr.com\r\nsvysbsmurpvwtxa.ru\r\nqjtwxuqfiflawuw.com\r\nsklykravgkpvcfk.cn\r\nxbikmmvflgaeihq.ru\r\nqrfmbnpbgugsgcu.cn\r\nyyrmcmexidwhaaj.com\r\nuxqxupmngjddayn.ru\r\nlvgexkblrfusxey.com\r\nqoveocxdhxmhppq.cn\r\nyewlwqxegfofueq.ru\r\ndskdippixfieoeh.cn\r\ngbrjwucoqfycwbo.com\r\nxkmddlaoixisuyi.ru\r\nrfvfrxerhtamuwt.com\r\nyavaaewapsuvpkw.cn\r\neaogarkiulwvqkf.ru\r\ndsqunoillmcdoxj.cn\r\nkrguxcnjtgiffnx.com\r\nfvhecirrypjiklv.ru\r\naphvvldptjxbgsg.com\r\naphjrqyelibfbiy.cn\r\nffwajhiiycnoncm.ru\r\nvmwvoyserpyhtqc.cn\r\nkayeqerdnowbeho.com\r\njbysuxgqvpbslbe.ru\r\nrwryosuacapohkn.com\r\nketjhcufecyksyk.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 51 of 62\n\nkemrnfjddolhvpv.ru\r\nvpxgndvnlnnsxmq.cn\r\nmwnpkedwloggrwd.com\r\nlesbfbtbdddaraw.ru\r\nkktfyhffboygfrv.com\r\nugowrrnvlsnrufd.cn\r\nkfdighielasgcat.ru\r\nooxkkdmshtfdbrd.cn\r\ntycmmlbtvuqgycr.com\r\nimdpilojxfrmaje.ru\r\ndrlonepqaxbbblt.com\r\ngkbslsbenwduqar.cn\r\nivoxdenxbfirjvw.ru\r\nsrvqqnlailsmcft.cn\r\nuwvgwdwaahgmqrg.com\r\nuwxkplkameogipr.ru\r\nbjmikbcebyjiajh.com\r\ntnwajvigiyamegh.cn\r\ngmqpxcqdquhoeyb.ru\r\ngodwufnoymhxvvp.cn\r\ndmnftllhsixnjkn.com\r\njweooplojjqukkb.ru\r\ngketipnukrqlkjq.com\r\nujvgbcynqvjktku.cn\r\npofbwypclnxessq.ru\r\nkqeevuebrlilnvl.cn\r\ndxhwgoxfbumjrnt.com\r\npbqftskkdpafhwm.ru\r\njkjfejrtyvfmjcm.com\r\nkbrynpphwjoggbi.cn\r\nhiofqijxkyjdnrg.ru\r\nlysewrbftcamylc.cn\r\naksxqdqljsdsywe.com\r\ncviuvbhhchvcbnx.ru\r\nlycalcsldsefynv.com\r\nqlntlfolppxwlxa.cn\r\ndpepbyxwwdhxerg.ru\r\nwlyaurxwwcpmbms.cn\r\njskfljawdtevnnl.com\r\nlouvudcpvictngt.ru\r\nsuaxtqrksgchcwn.com\r\ninvgonfgclevfvp.cn\r\noycdwjjyoysfqeh.ru\r\nyllohjknjroemwo.cn\r\nqglrxmiupcesvdp.com\r\nbhstsmqykaoqslc.ru\r\njtnmybraaiscerf.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 52 of 62\n\nsnwjcifkilqkgrb.cn\r\nmpumnbeqvvwwdoo.ru\r\ncwsvwcjblfrmlwe.cn\r\nimlueusvwsqkorx.com\r\nvbrhpoogaxrlsbj.ru\r\nkjktgowyjpwqsop.com\r\nvavahbmvitpywtk.cn\r\nsibnaidxlsawdul.ru\r\njawharaaucnhvbl.cn\r\njblsycuvgfhofbn.com\r\nlivxufbvrrfhojo.ru\r\nywtnsinipoqrtrv.com\r\njcnslkruwtqifvg.cn\r\nmtjsvrlkfvgybsh.ru\r\nwwefjuqcelkbllg.cn\r\ngwhpnfdfwosyseu.com\r\neyfukoxmkmmhuin.ru\r\nwdqcjaolqwoypvu.com\r\ndjpfeisbctohidh.cn\r\nniawjsysgtwcdwl.ru\r\naxxtuijvrggusbl.cn\r\nfxfalwypxibyhfa.com\r\ndjubiuwyeqbhrmc.ru\r\nilflhdcyhkrgagu.com\r\nbnhxqyaromcrpxu.cn\r\nbyqxjoqgyvmiujx.ru\r\nptokfjafudwymel.cn\r\nyyajsnjrqsvpcwj.com\r\nahpmjkmbpkwaxla.ru\r\ncxyoxwtieqhtugy.com\r\nvusempmflextugq.cn\r\nxwppsxlcxcslbhp.ru\r\nwvpuhhnkofutdgr.cn\r\nqswkgxgfuoaafer.com\r\niijmfmmecrfppuq.ru\r\newnhlxayyasbxlj.com\r\nlmaqoqjleypsipq.cn\r\niurmewpaixanrbc.ru\r\nqqtsbuwtionvduh.cn\r\nmpnpxmjwaqbfwgc.com\r\nrotixicxnhtrile.ru\r\nwujqilfwradhkfm.com\r\ncffdhjivgwgxoio.cn\r\npawdpysfhntxopx.ru\r\numcdwrqxrrrljkq.cn\r\nvjwglxgfpwklloi.com\r\nnhdwrmvhsrfouum.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 53 of 62\n\nwocqeupbnyglyqy.com\r\niouqfidrvhjtojj.cn\r\nmpjxffasubdgvyv.ru\r\nvpequhofgnegsna.cn\r\nubvxodutprbmpaf.com\r\nndfyqcjamlsgyoa.ru\r\nymacvotkvebbxoq.com\r\ndhgjomvybhyorfc.cn\r\ngidvapccvvlmcvb.ru\r\nlgjbgggbdnwtqii.cn\r\nariwdxibmqcxlbt.com\r\ncdwnkpbfmtkvpgl.ru\r\nxmtbvrcaybjexgo.com\r\nsacpiasuhmlksrq.cn\r\npdqvwjdjvxxkvor.ru\r\nhgygpujjdxinutk.cn\r\nfnldugwukayjrif.com\r\nabqmbwnsltqrxge.ru\r\nsvtuhceqtucxpjs.com\r\nyohjeyufjhmmqff.cn\r\nhsbxuxcgbaqmwwa.ru\r\nudstrfqdvyfpfat.cn\r\nokmqovbevdshrsl.com\r\nybkbnhmbrqqywmq.ru\r\nxiijsihhsybevmf.com\r\ntgiovhdtcxnhspa.cn\r\ndcmatyhtgqucqlg.ru\r\nqqwscbqhxhgomhp.cn\r\nycrautpmqxcwvjx.com\r\nabuyvxmvevjqdie.ru\r\ncnacpeflfclwdwa.com\r\nvlkagekhmybtcvu.cn\r\nsjqbpacqlsvikqw.ru\r\naqoxitqxsrfdxhh.cn\r\nwervofbudbgydmx.com\r\nphbbohvjpdjmvsv.ru\r\negtfwvqpsbftiqa.com\r\npfdljbpmpepjaby.cn\r\ncjhxukevdnejcjg.ru\r\njvkfvbokmapaobx.cn\r\ncixaviwqjomfkun.com\r\nxdhvougdfybggkx.ru\r\nslujlggxqkcwxuq.com\r\nhotiysgxoqhwgbd.cn\r\nykwqlnhejrbnyng.ru\r\ncmcoshcyowfjtuc.cn\r\nwcdsolyaxomvmjf.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 54 of 62\n\nnhbdmddwrllcfsi.ru\r\nqtrowsuxeikobjp.com\r\nxtvoynvjjpdmvbt.cn\r\nnlpwdbsakpqhlss.ru\r\nqvmpblesqcyposy.cn\r\nckqnqtyilbomabf.com\r\nackddoceceviupn.ru\r\ntnolychicxnajsj.com\r\nykbdbfmeromwewm.cn\r\njgqqsfrkxrangri.ru\r\neomwshqgmxqdyyf.cn\r\nbrxgetebqchavyf.com\r\nntpcakrkwoxklyy.ru\r\nnpytmyoluqbusxt.com\r\nqbtaylolelgydal.cn\r\nxyfrycveytlsqgd.ru\r\nanoibynldnpdmgu.cn\r\nqioinnfcccciqml.com\r\nhbaslltkyptgjuq.ru\r\nvfsboacfetskcad.com\r\narethubvybffyjj.cn\r\nabjokehvdhxfaub.ru\r\nlpkbiosgxpngnot.cn\r\nrgjljbyhksffwdm.com\r\njxjdrmlcrlgoain.ru\r\nifgrtdetlsaamma.com\r\nhcuxlpvqnfjilkc.cn\r\needjiskdrhmdlnf.ru\r\niawbqxvakkbuyyh.cn\r\nihlieqonsxmomcd.com\r\neswejveljmfnpbs.ru\r\ngghhmlfuqffokdr.com\r\nelnjophrqpvdkrm.cn\r\nlqvcyjyuecncaof.ru\r\nydfeeeahmtlptmp.cn\r\ntbbqsuuydilnokv.com\r\nndhqamuvxbysugi.ru\r\nsmehfveengreisb.com\r\nuvwpbiebxqugxlh.cn\r\nfyaywquolnaijsq.ru\r\neodisglugpjgsob.cn\r\nuqrjskvyomqikow.com\r\nfxbmnfgfwyfskvm.ru\r\nfgdkjgqesgmjoub.com\r\nfdusnrcucpbdhpd.cn\r\nqgaafhclxdyofsb.ru\r\nlpmvrglihcikjpt.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 55 of 62\n\nrjfdxyigsmecjuj.com\r\nxdpxmxdjpuhnkfu.ru\r\nuayebvonqtrekbo.com\r\nskkqukefosipfno.cn\r\nvwdneesevcqgmbn.ru\r\nilknxcgshkfkotg.cn\r\nchykcodlxuqmqyr.com\r\nrsgshunlgbgjswa.ru\r\nsrneaygnvxyoaxo.com\r\ngqdtmxibgldfmqt.cn\r\ntpqlojcfohqjgkl.ru\r\niqavohvublkqivi.cn\r\nqetqjlvqlbjyfkx.com\r\ndvdtlpkeylbhwiv.ru\r\nuupwfgohkegvkis.com\r\nkvuxjbbrkgevquq.cn\r\nvqmbdkpqhlwmpky.ru\r\nlhbvioolmlyahhl.cn\r\naoycnjpsgrilxur.com\r\nxbqtflvliyposxx.ru\r\nvertosjyocjpnun.com\r\nelnldorqxtdhdfk.cn\r\nungfajcjxsbtbqe.ru\r\ndxpttfpovphhwjp.cn\r\nemiqdgukgnaqvkd.com\r\ndxqdtafvldcbwbj.ru\r\nxfjwcfdwskqojof.com\r\nrcofhhkonqyiskn.cn\r\navxkystxmiufgjb.ru\r\ncqadckqdbwacjof.cn\r\ndtydedgqmgfvhjc.com\r\nabrogfemvrpmqlf.ru\r\nesiolbgxxtqoqyi.com\r\nkjhydpjvymndhif.cn\r\ndmtsapgopieksdy.ru\r\nbgmqabqtpfubgbp.cn\r\nlwdegehhdpixixn.com\r\nxsedhwjcenjwfpc.ru\r\nrkyebpixyrtivoa.com\r\ngorpubwdrxmuepd.cn\r\nebhprklyvccrnds.ru\r\ntygfaerbmoetwhy.cn\r\nkyrmfgfxjrwiubm.com\r\nyqgrdvgopenxqtb.ru\r\nelconsvbsaphsxm.com\r\nrdpxvfwdcleuovy.cn\r\nxkmvwyjwqeumcvw.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 56 of 62\n\nxrhiybtaoktyppm.cn\r\npjabybmqjvlbjbp.com\r\nyjtkfdsolgdmpwk.ru\r\nhltfpjlrmgivomx.com\r\ncmeqnbdnwuuqbak.cn\r\nlgxeonqtdlcprfg.ru\r\ntgasbdqveabyeal.cn\r\nuotwpjtxodigsof.com\r\nvyltabhgqmlfwgb.ru\r\nfbphqmsnjmibhro.com\r\ntfrjfxjtdidoflb.cn\r\nvoivqvrrwagubjp.ru\r\nodritbcjlxuortn.cn\r\nqqwyodxlpqovqaa.com\r\nrdjodwmhkuqtrxt.ru\r\nsrgyhsmifjrckkt.com\r\npdveppjojfjjkfb.cn\r\nfinflscoixxdmts.ru\r\njjbvaojkqugrvrv.cn\r\nwiaynymrrammomc.com\r\nsonrdtyaajbpvqo.ru\r\nyrhbsjscypdrgve.com\r\njbfbfsabuouicef.cn\r\nxboiicxyxrxyvlw.ru\r\ncncxpyqekiapnaq.cn\r\njgotdpwyyxvrwig.com\r\ndfipojcjrlfexsu.ru\r\nccarslklosnigqn.com\r\ndrlwspsiwlwxaqg.cn\r\nbpuukdshgebsvri.ru\r\nwbbbjhsuxcvxixj.cn\r\nhkxksxsdsrovhbh.com\r\nexvbikmoshowtxk.ru\r\naenwlgjmgssrdqq.com\r\nimfkqexptrthtkv.cn\r\nhdbdicsgkssmfnw.ru\r\nmncvffuvbhnkxfr.cn\r\nrvsctxyjtefudvi.com\r\nrbrdvdfwsjutrtj.ru\r\nmofwynkgfqnmogl.com\r\nhjkwgpqsyrpcncq.cn\r\njsqcwohqrioelol.ru\r\nnxbpdrjvedygoss.cn\r\nhdexytfkocrbtxm.com\r\nvdfcdnbsjneyney.ru\r\nroabfoimxieleok.com\r\nypybcufwprqhmst.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 57 of 62\n\ningcwarosbruwwd.ru\r\nctovacsppfxekmp.cn\r\newdmrjxyqkiabor.com\r\nmjiyaomaxrhkulm.ru\r\nwbksngotsmqaebu.com\r\ntjjiohwyysveywk.cn\r\nolkyuuprspfuceh.ru\r\nvemvbetaoahdtkf.cn\r\nisydpjklrkvimjm.com\r\nnwrvbhfukfqlfqc.ru\r\nottrghukicssdll.com\r\nkkoudpflctwxpru.cn\r\njtshpirfvbfkrru.ru\r\noolerbvsagmkdvb.cn\r\nlkrsixhcvtavkel.com\r\nmcfaeiftyenjrwl.ru\r\ngoosuuwoqtxlncv.com\r\neteggipxvarqvcx.cn\r\ngvidfkulycniaip.ru\r\nwhvdrubfwaliorc.cn\r\nwkkkplgpynomkpe.com\r\ncjtrkebtmhumqii.ru\r\nupfwwfkehtmwbrg.com\r\nbeaolwvgijvycxb.cn\r\nglatpucckyfadye.ru\r\nidnlsvoopmolecq.cn\r\ndcffsdfvgiabgbc.com\r\ntmgftdsljayiief.ru\r\nhbpdygpqsmobunq.com\r\nkrhjpesftsonewh.cn\r\nkwfkliquvcsgfmi.ru\r\nifbpvmtsmdfoaqf.cn\r\ndrqrlvjfldttnbj.com\r\nteheeyiexcxyprc.ru\r\ncwtlvfttsdkafdx.com\r\nvuqyuxfxbrbmxvj.cn\r\nocdcwjnhwtdyouv.ru\r\nwygmlkpuddsqqeb.cn\r\nsauyvxbxbevvrdc.com\r\nodupwjtcxlepyqj.ru\r\nbsrjvxishfxxiui.com\r\nxylrfggefdhxbpk.cn\r\ngoompwsqyrsmpcq.ru\r\nyviwpelubuwiqdr.cn\r\ntqujoohyveamxtr.com\r\nvgnhpbvyfemejct.ru\r\ncfbeegbsqhockhh.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 58 of 62\n\nddwuicyulopnwie.cn\r\nteniknkcdfayntv.ru\r\njirlfljshfyknxn.cn\r\nawjbreptpqrgfxc.com\r\nttrtbhpngdyppco.ru\r\nowuddgyplnfyuvy.com\r\nipnvicxhllpsscb.cn\r\nbljrqbuodcefsgg.ru\r\nmjohslntcfetrnp.cn\r\nsubwoonxriklbcy.com\r\nnpajtiulqcqptcp.ru\r\nalaqrymbgscbupu.com\r\nvebkukusyirjttv.cn\r\nldegfaqyuwboqwk.ru\r\nkpughxusvhnuesa.cn\r\nnmrmsbujehctdeh.com\r\njkdqeluavgnnuyf.ru\r\nylhovncsvjilobi.com\r\ndsaqcvyevjyskgf.cn\r\nbmaketvexknvsbn.ru\r\nkqgbwkstxniuowm.cn\r\natpfktawilygcla.com\r\nufssgmjsmjyowah.ru\r\ntpqyfuuhvyogsof.com\r\nxgloxtluqqmmrxm.cn\r\nmmpurstlmlofffg.ru\r\noavbveucikrleln.cn\r\nkmmcdwkgubwrkvw.com\r\nevpjdirrcophrid.ru\r\njwmeahbtcstihxp.com\r\nhhjhghrtodmylpc.cn\r\nxbixsaxlvqvwwbf.ru\r\ngdilojgksgesdbd.cn\r\noeoskxfehfucimi.com\r\nvyhvepgntidqvys.ru\r\ntanorafjtajykpx.com\r\ndogfsscrataocov.cn\r\noaejnrtgxtnnjil.ru\r\npdvotrlklhcakbs.cn\r\ncenfqfgxvcbpotr.com\r\nfetpvmonhrklifb.ru\r\nbaxkhsmtetiawrr.com\r\nupvacoibigjjpyk.cn\r\nblwktvggsmbmayq.ru\r\nnhdstrtdnwcwkhm.cn\r\nlrbtqxdmtwhrxle.com\r\nlrygcistkurvfvp.ru\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 59 of 62\n\nyawnrobjorctcqg.com\r\nbuatigdjhpaurht.cn\r\nluhbrtabueogpef.ru\r\naoybmqukbbyqcjp.cn\r\njbswukaqhoeaioj.com\r\nkdrhtteyfleutyq.ru\r\nwpxwtdqlxqeataj.com\r\nfyrughjhllslovv.cn\r\nrnayepmwiunlyrm.ru\r\ngpweqfxunhlmtgx.cn\r\nhsmxiqvoiijtayr.com\r\nmwjaxydhoexrjyq.ru\r\najtphuhnlcuvjbq.com\r\nieysddhrghwqnem.cn\r\nyqadvxtcaoomfne.ru\r\npnjwqxmjbeohcbu.cn\r\ndqujuccmckmpmpg.com\r\nkariujsfgdocdox.ru\r\nwliifqojvddxeik.com\r\newleehcpfyydswu.cn\r\nnarlyrohtnrmthp.ru\r\nhvgqjgkwugjqkig.cn\r\nonuscmkhfrilish.com\r\nnbfpyrcrvmgiljg.ru\r\nxpkogssnkjyjnep.com\r\nffvxdkphbkhndty.cn\r\njwcxsijoyhievto.ru\r\nxcyjnqkbbpegaji.cn\r\nlkbkepmdfhnfryv.com\r\ntsqccfroccanics.ru\r\ntsstdjjtnhnuvpr.com\r\nitbdwtmtoumslcm.cn\r\nvyupwkrconaqjff.ru\r\nuwejetklsmmifbn.cn\r\nmdsvavtebswlfyv.com\r\npijgngpcmxvyvdb.ru\r\npimghpkweyawjch.com\r\nqaarisivivypivd.cn\r\ncbrarfjxpyltalb.ru\r\nyoymrubhmxpubme.cn\r\ndxrpjvurhgifouv.com\r\nqtlvhfxobnjcbio.ru\r\nkeucqpkqlyycans.com\r\nkchhxkfxrwamgqf.cn\r\nuohyqmgpgckqtjk.ru\r\nylswtbbqwftujbb.cn\r\nierpdtrfifslpwo.com\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 60 of 62\n\ndfmwtulrioceoev.ru\r\nmmjpfoqjfmtyirq.com\r\nqevbeuiegarvjsk.cn\r\npuiwlmgemkosjre.ru\r\nbeltapyttyrmbll.cn\r\nfapvkscxurbhbml.com\r\ntubsovpxrguaehq.ru\r\nipbmedqiueakrpa.com\r\nocnkirqxwlfnjgb.cn\r\nwbaxodbutxfheqy.ru\r\nmyrpledycyxoxma.cn\r\nmvpguvtdlkkcqrw.com\r\niuglewsxdxtypdb.ru\r\nuedyfhictiaeqiy.com\r\noaucwtyydncadvj.cn\r\nngkqtdfwdidsbgw.ru\r\nouojtejqonvhkvi.cn\r\ntkxnpvwoyenrdjx.com\r\nnwuatybejfmrvsn.ru\r\nyftfwxmebmdoveu.com\r\nkvugsfxknvdbcge.cn\r\nytnhlrxptdxivum.ru\r\nligbibqbndingpc.cn\r\ncwmklceidlfsbuf.com\r\ntnlatgijooiliqg.ru\r\negwrngbeixlnjaf.com\r\ncubputikmxqupyt.cn\r\nvffgbcxicxafyfy.ru\r\ngytbfrbixfjpnpl.cn\r\njrcugvvawkmkyyw.com\r\nyhsqhehjnsveayu.ru\r\nflqvnrjrgdkekcd.com\r\noiitvayptapelvp.cn\r\naojacbcaoloqmww.ru\r\nqcaomwbxwuqrife.cn\r\nmxfcoicvmlbprqd.com\r\nucdeadyegprewuj.ru\r\njvowpfvfarsgtwl.com\r\naacwkoibblgtgxi.cn\r\nyqeslhwpvheysmf.ru\r\newaxkcsigvuxxhj.cn\r\ndwqbbtonbjoqiqp.com\r\ntrqecilbapxgxpk.ru\r\nejjujfqskttvlfq.com\r\nnsnffpxvcxwvsqd.cn\r\nvdmnpbfylttfvbc.ru\r\najfcredldvrmemg.cn\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 61 of 62\n\nasahoqougtvgqjy.com\r\nhyrxfqlnntfirxk.ru\r\njudemedpohduvaj.com\r\nbnsrtfxoyfeuxvh.cn\r\nbotwmdtnoeoplog.ru\r\nfwuqlwbljcjkfnb.cn\r\ndwccaomocwmsnwx.com\r\nokwkvjawvcqdxtj.ru\r\nyqdkuwcfkpebajf.com\r\nlenlfyrrkuhonqw.cn\r\nyrsfwckvlegfehc.ru\r\ndhgmgbbjynidolw.cn\r\nrtoorginnbpimkb.com\r\npwlgltftkcnxare.ru\r\nywoybsicgyilreq.com\r\nrmkvivyskxoamth.cn\r\ngdrbjtqgmwpvghg.ru\r\nqbmdpqadqqxwrvx.cn\r\nhjkbomefqvcoxyj.com\r\niudubocosabncaw.ru\r\nqghnymshrphvupx.com\r\nfgoojtgeotggwrk.cn\r\ncgavxyvxbsxgjhb.ru\r\nmgrxuodshwybknh.cn\r\ndafodwmftctprdb.com\r\nbmunrasbrqlqqxb.ru\r\nhfkhlwbbomjopyk.com\r\nfeyhbtqtbiwetjm.cn\r\nksslvaotocfldln.ru\r\nxffqslcosfmqbiw.cn\r\nReferences\r\n1:https://twitter.com/malwrhunterteam/status/1364710504044908555\r\n2:https://github.com/MichaelRocks/paranoid\r\nSource: https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nhttps://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9\r\nPage 62 of 62\n\nMore importantly file we can see one of the that it is encoded filenames we in some previously way: found is rather interesting ‘Cqse.json’, after looking at the\n00000000: a227 bd12 3274 4d7f 75ef 9a2d a878 f689 .'..2tM.u..-.x..\n00000010: 5b5d 9986 d3f6 238c 0d93 1300 dc40 4fd7 []....#......@O.\n00000020: be1d 7e7a 58bc 0936 cdef b389 6eb1 0ffa ..~zX..6....n...\n00000030: 641f 8f1b 5a3e e4bf 7a18 41f4 bf3e 30bf d...Z\u003e..z.A..\u003e0.\n00000040: 049a e319 ecf4 c6eb 657e a133 ae57 26e1 ........e~.3.W\u0026.\n00000050: ea6a 5da7 98bf 01a6 f666 68fa 22d2 6810 .j]......fh.\".h.\n00000060: 1e0d c6ac e350 6553 f9c7 b9f0 4d35 aeb0 .....PeS....M5..\n00000070: b1d1 0967 f02c 3b1c 6c87 b899 07ca 6e9c ...g.,;.l.....n.\n00000080: ab8d aa5f 2636 260f 046c 47c1 dee4 3fb1 ..._\u00266\u0026..lG...?.\n00000090: b48f aabc 8f22 e4e9 5824 43db 545d 167f .....\"..X$C.T]..\n000000a0: 2c02 8a7d 6316 6bc2 a9b0 02db 83d0 58ab ,..}c.k.......X.\n000000b0: 2234 2bf6 b7b4 1b21 890d 685e 2e46 88e2 \"4+....!..h^.F..\n000000c0: 39c1 c726 9643 df54 bd25 f788 50e4 ea2b 9..\u0026.C.T.%..P..+\n000000d0: 22c5 800e cef4 0f1b a127 b077 634a e184 \"........'.wcJ..\n000000e0: 6907 8bbf 4347 1637 9b69 619d d99a 40da i...CG.7.ia...@.\n000000f0: 94eb b771 9574 fd3d 2f63 52ef 0bb4 ea2e ...q.t.=/cR.....\n00000100: 9cdf 2c31 9157 8ecb 2dcf 960c f6b2 7579 ..,1.W..-.....uy\n    Page 5 of 62",
	"extraction_quality": 1,
	"language": "NL",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9"
	],
	"report_names": [
		"a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9"
	],
	"threat_actors": [],
	"ts_created_at": 1775434791,
	"ts_updated_at": 1775791331,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9b0de9ea7e823c636c6f46256348b04432d93f22.pdf",
		"text": "https://archive.orkl.eu/9b0de9ea7e823c636c6f46256348b04432d93f22.txt",
		"img": "https://archive.orkl.eu/9b0de9ea7e823c636c6f46256348b04432d93f22.jpg"
	}
}