A look at an Android bot from unpacking to DGA
By Jason Reaves
Published: 2021-03-05 · Archived: 2026-04-05 18:54:42 UTC
Press enter or click to view image in full size
Recently noticed large campaigns spreading Android malware which have been followed by both
MalwareHunterTeam and Daniel Lopez[1]. Taking a quick glance at the manifest shows they are definitely packed
as some of the manifest is referencing code that doesn’t exist in ‘com.example.myapplicationtest’.
To unpack it statically we just need to figure out where the next DEX file is stored at and how to decode it, the
first thing I notice is the strings are encoded in sub functions:
public static String arenalake() {
 int i = 624;
 for (int i2 = 0; i2 < 16; i2++) {
 i = 2517;
 }
 byte[] bArr = new byte[]{(byte) 65, (byte) 82, (byte) 80, (byte) 86, (byte) 19, (byte) 80, (b
 int i3 = 119;
 for (int i4 = 0; i4 < 20; i4++) {
 i3 = (482832 / i) + 87;
 }
 byte[] bArr2 = new byte[14];
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 1 of 62

int i5 = (i - 499322) + (290129 * i3);
 byte[] bArr3 = new byte[]{(byte) 51};
 int i6 = i;
 for (i = 0; i < 1; i++) {
 i6 = ((i5 - i3) + 197680) + 571102;
 }
 if (i6 != i3) {
 i3 = ((815022 / i5) + 408432) - i6;
 }
 if (i5 <= i3) {
 i5 = (i3 + (i6 * 56)) - 44;
 }
 for (i = 0; i < 17; i++) {
 i3 = 112184 / i5;
 }
 for (i = 0; i < 14; i++) {
 bArr2[i] = (byte) (bArr[i] ^ bArr3[i % 1]);
 }
 for (int i7 = 0; i7 < 33; i7++) {
 }
 return new String(bArr2);
 }
We can decode these as simple arrays of bytes with a XOR key:
>>> a = [65, 82, 80,86,19,80,92,93,87,90,71,90,92,93]
>>> b = bytearray(''.join(map(chr,a)))
>>> b
bytearray(b'ARPV\x13P\\]WZGZ\\]')
>>> map(lambda x: x^51,b)
[114, 97, 99, 101, 32, 99, 111, 110, 100, 105, 116, 105, 111, 110]
>>> for i in range(len(b)):
... b[i] ^= 51
...
>>> b
bytearray(b'race condition')
This would take awhile to decode every string from every source code file however so instead we will automate it
a bit using regular expressions.
import re
import sysdata = open(sys.argv[1], 'rb').read()
lines = re.findall('''bArr[\x203]\x20*=[^\r\n]+''', data)
for i in range(len(lines)/2):
 temp1 = re.findall('[0-9]+', lines[i*2])
 key = re.findall('[0-9]+', lines[(i*2)+1])[1:]
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 2 of 62

print(temp1)
 print(key)
 temp1 = [chr(int(x)) for x in temp1]
 key = [int(x) for x in key]
 temp1 = bytearray(''.join(temp1))
 for j in range(len(temp1)):
 temp1[j] ^= key[j%len(key)]
 print(temp1)
I print out the values so I can quickly find the lines that the strings correspond to:
# python s_decode.py WGcQaLnWdFuKiPkRjBlFpTcCnJgQhLkGdLbCe.java
['65', '82', '80', '86', '19', '80', '92', '93', '87', '90', '71', '90', '92', '93']
['51']
race condition
['91', '37', '113', '61', '114', '53', '124', '19', '111', '40', '91', '57', '103']
['31', '92']
DynamicOptDex
['32', '38', '53', '37', '38', '32', '34', '103', '36', '40', '43', '43', '34', '36', '51', '40', '53
['71']
garbage collector
['18', '69', '56', '93', '59', '85', '53', '112', '63', '94']
['86', '60']
DynamicLib
['40', '57', '48', '48', '124', '40', '52', '57', '124', '46', '57', '61', '47', '51', '50']
['92']
tell the reason
['43', '40', '36', '38', '43', '103', '37', '46', '51', '36', '40', '46', '41']
['71']
local bitcoin
['28', '46', '44', '58', '113', '53', '44', '48', '49']
['95']
Cqse.json
['104', '59', '119', '46', '106', '44', '107', '58', '122', '40', '106', '105', '107', '44', '108',
['24', '73']
progressbar settlement
Dumping all the source code and running our script against every java file we are left with the following list of
strings:
# for file in $(find a204_sources/ |grep java); do python s_decode.py ./$file; done
QfF
get
d)dsfdfgfgfg
get
android.app.LoadedApk
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 3 of 62

android.app.ActivityThread
cheap lowesat price
currentActivityThread
get
getClass
mPackages
mClassLoader
get
cyyshdhvkvkckkkffd
addAssetPath
close
aaxxwdDFCxcds
getClass
wwysyahcxhgfGDG
vfsffjjjjjjjjjjjjj
getClass
slce enough earler
vcpspdlsdlsdl
open
wfmmZ
write
close
getClass
getAssets
read
bnhfdcxfdfRRD
vocodpsdps
getBytes
200
10
dfttrrcfsdVCv
opdspclxldsqq
56
cxuudsjfjdfjdj
cxoasjshdfhdfh
Nchxydggvgd
50
getClas
close
vcuufUUUDf
vcosdYYDSHDnncx
cuvudshdhdfhdfh
hvchhfhddsds
getClass
getClass
read
vSEEEDEECEff
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 4 of 62

android.app.LoadedApk
mPackageInfo
get
mInitialApplication
roap soap
mOuterContext
mActivityThread
attac
get
mApplication
android.app.ContextImpl
forName
android.app.ActivityThread
onCreate
mAllApplications
race condition
DynamicOptDex
garbage collector
DynamicLib
tell the reason
local bitcoin
Cqse.json
progressbar settlement
More importantly one of the filenames we previously found is rather interesting ‘Cqse.json’, after looking at the
file we can see that it is encoded in some way:
00000000: a227 bd12 3274 4d7f 75ef 9a2d a878 f689 .'..2tM.u..-.x..
00000010: 5b5d 9986 d3f6 238c 0d93 1300 dc40 4fd7 []....#......@O.
00000020: be1d 7e7a 58bc 0936 cdef b389 6eb1 0ffa ..~zX..6....n...
00000030: 641f 8f1b 5a3e e4bf 7a18 41f4 bf3e 30bf d...Z>..z.A..>0.
00000040: 049a e319 ecf4 c6eb 657e a133 ae57 26e1 ........e~.3.W&.
00000050: ea6a 5da7 98bf 01a6 f666 68fa 22d2 6810 .j]......fh.".h.
00000060: 1e0d c6ac e350 6553 f9c7 b9f0 4d35 aeb0 .....PeS....M5..
00000070: b1d1 0967 f02c 3b1c 6c87 b899 07ca 6e9c ...g.,;.l.....n.
00000080: ab8d aa5f 2636 260f 046c 47c1 dee4 3fb1 ..._&6&..lG...?.
00000090: b48f aabc 8f22 e4e9 5824 43db 545d 167f ....."..X$C.T]..
000000a0: 2c02 8a7d 6316 6bc2 a9b0 02db 83d0 58ab ,..}c.k.......X.
000000b0: 2234 2bf6 b7b4 1b21 890d 685e 2e46 88e2 "4+....!..h^.F..
000000c0: 39c1 c726 9643 df54 bd25 f788 50e4 ea2b 9..&.C.T.%..P..+
000000d0: 22c5 800e cef4 0f1b a127 b077 634a e184 "........'.wcJ..
000000e0: 6907 8bbf 4347 1637 9b69 619d d99a 40da i...CG.7.ia...@.
000000f0: 94eb b771 9574 fd3d 2f63 52ef 0bb4 ea2e ...q.t.=/cR.....
00000100: 9cdf 2c31 9157 8ecb 2dcf 960c f6b2 7579 ..,1.W..-.....uy
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 5 of 62

The filename is decoded in the function ‘raisecasual’ which is called in a wrapper function ‘horsetravel’, all I’m
doing here is backtracking the functions to find where they are called from.
The function ‘horsetravel’ response is loaded elsewhere in the code:
Pivoting on this variable name leads us to a collection of interesting functions:
Pivoting further we see the same value referenced by a function ‘usualsight’:
return new ZJfJnFrIoTcUoUjJuTzUrClNuAyNkGtChSdNo().jealoustree(str, this.DBpIjLkJfQoZpQyYjFfQfBnRsPhA
The function ‘ZJfJnFrIoTcUoUjJuTzUrClNuAyNkGtChSdNo’ is interesting as well and loads another string:
The function a string is loaded from is just another wrapper to another function:
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 6 of 62

This function decodes an odd looking string:
>>> a = [39,54,61,61,10]
>>> a = bytearray(''.join(map(chr,a)))
>>> a
bytearray(b"\'6==\n")
>>> for i in range(len(a)):
... a[i] ^= 80
...
>>> a
bytearray(b'wfmmZ')
Scanning this same source file of ‘ZJfJnFrIoTcUoUjJuTzUrClNuAyNkGtChSdNo’ shows an interesting function
with the hallmarks of RC4:
public byte[] shoearrange(byte[] bArr) {
This function is called from another function:
public byte[] alonecore(byte[] bArr) {
Which can be seen being used here:
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 7 of 62

I’ve seen RC4 used plenty of times in the past with Android malware and packers so let’s test it out on our
encoded file:
>>> key = 'wfmmZ'
>>> data = open('Cqse.json', 'rb').read()
>>> from Crypto.Cipher import ARC4
>>> rc4 = aRC4.new(key)
Traceback (most recent call last):
 File "<stdin>", line 1, in <module>
NameError: name 'aRC4' is not defined
>>> rc4 = ARC4.new(key)
>>> t = rc4.decrypt(data)
>>> t[:100]
'dex\n037\x00*\xfb\xbc\xb9\xf8\xef\x04|\xc4\xee\xfc\x13f\x07\x06\xf4\x1b*\xd9\xfc\xa3r\xbb\xf9\x80?1\
Jackpot! After running dex2jar we can take a peak at the unpacked data which matches the references from the
original AndroidManifest:
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 8 of 62

Decode Bot Strings
Get Jason Reaves’s stories in your inbox
Join Medium for free to get updates from this writer.
Remember me for faster sign in
This also has encoded strings using an opensource obfuscator[2], we can rebuild and construct a deobfuscator
pretty quickly by using the code we have available:
public class Deobfuscator {
 public static final int MAX_CHUNK_LENGTH = 8191;
 private static final String[] chunks;static {
 String [] r0 = new String[2];
 chunks = r0;
 r0[0] = <snipped>;
 r0[1] = <snipped>;
 }
 private static long getCharAt(int i, String[] strArr, long j) {
 return rhnext(j) ^ (((long) strArr[i / MAX_CHUNK_LENGTH].charAt(i % MAX_CHUNK_LENGTH)) << 32
 }public static String hgetString(long j, String[] strArr) {
 long next = rhnext(rhseed(4294967295L & j));
 long next2 = rhnext(next);
 int i = (int) ((((next >>> 32) & 65535) ^ (j >>> 32)) ^ ((next2 >>> 16) & -65536));
 next2 = getCharAt(i, strArr, next2);
 int i2 = (int) ((next2 >>> 32) & 65535);
 char[] cArr = new char[i2];
 for (int i3 = 0; i3 < i2; i3++) {
 next2 = getCharAt((i + i3) + 1, strArr, next2);
 cArr[i3] = (char) ((char) ((int) ((next2 >>> 32) & 65535)));
 }
 return new String(cArr);
 }public static String getString(long j) {
 return hgetString(j, chunks);
 }
 public static long rhnext(long j) {
 short s = (short) ((int) (j & 65535));
 short s2 = (short) ((int) ((j >>> 16) & 65535));
 short rotl = (short) (rotl((short) (s + s2), 9) + s);
 s2 = (short) (s2 ^ s);
 return ((long) ((short) (((short) (rotl(s, 13) ^ s2)) ^ (s2 << 5)))) | (((((long) rotl) << 16
 }private static short rotl(short s, int i) {
 return (short) ((s >>> (32 - i)) | (s << i));
 }public static long rhseed(long j) {
 long j2 = ((j >>> 33) ^ j) * 7109453100751455733L;
 return ((j2 ^ (j2 >>> 28)) * -3808689974395783757L) >>> 32;
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 9 of 62

}public static void main(String[] args) {
 System.out.println(Deobfuscator.getString(Long.parseLong(args[0])));
 }
}
I snipped the chunks but the idea is simply to pull every long value passed to GetString from the source code files
and pass it this code to decode the string:
# for val in $(cat values_clean.txt); do java Deobfuscator $val >>blah; done
The decoded string list:
com.android.vending
com.google.android.gms
com.google.android.gms:id/toggle
com.android.permissioncontroller:id/permission_allow_button
com.android.packageinstaller:id/permission_allow_button
com.google.android.gms
com.google.android.gms.security.settings.VerifyAppsSettingsActivity
com.google.android.gms
com.google.android.gms.security.settings.VerifyAppsSettingsActivity
com.google.android.gms
com.android.vending
com.google.android.gms:id/toggle
android:id/switch_widget
%s,%s,%s
LOG
DISABLE_PLAY_PROTECT
1
android.widget.Button
%s,%s,%s
LOG
DISABLE_PLAY_PROTECT
1
android.widget.TextView
android.support.v7.widget.LinearLayoutCompat
com.google.android.gms:id/toggle
android:id/button1
%s,%s,%s
LOG
DISABLE_PLAY_PROTECT
1
 ->android:id/button1
Huawei
Xiaomi
power
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 10 of 62

android:id/button1
android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
package:
CardActivity
a
e
%s,%s:%s,%s
LOG
BAL_GRABBERa
android.packageinstaller
android:id/alertTitle
com.android.settings
com.android.settings:id/entity_header_title
com.android.settings:id/app_detail_title
com.android.settings:id/app_name
android:id/title
com.google.android.permissioncontroller
com.google.android.gms.security.settings.VerifyAppsSettingsActivity
Activar análisis de Play Protect
Ajustes de Play Protect
power
keyguard
com.android.phone
com.android.server.telecom
%s,%s,%s
LOG
RUN_USSD
1
android.intent.action.CALL
tel:
#
com.google.android.packageinstaller
android:id/button1
%s,%s,%s
LOG
UNINSTALL_APP
1
android.intent.action.DELETE
package:
%s,%s,%s
LOG
EXCEPTION
RSA
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQ3YWOM6ycmMrUGB8b3LqUiuXdxFYm/eBxARoAHC/9dC8c6agwdveSqj3
RSA/ECB/PKCS1Padding
/poll.php,
%s
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 11 of 62

%satext/html
UTF-8a
Androida
a
original_number
dd/MM/yyyy
HH:mm:ss
display_name
display_name
b
b
b
a
content://sms/
_id!=?
0
android.intent.action.SENDTO
android.intent.action.SEND
android.intent.action.VIEW
UTF-8
:
address
thread_id
android.intent.action.VIEW
address
thread_id
address
thread_idName:Card:Exp:
 /CVV:%s,%s,%s
LOG
CARD_BLOCK
c,
GET_INJECTS_LIST,
,
GET_INJECT,
UNINSTALL_APP
CARD_BLOCK
SMS_INT_TOGGLE
BLOCK
SOCKS
OPEN_URL
RUN_USSD
DISABLE_PLAY_PROTECT
RELOAD_INJECTS
SEND_SMS
GET_CONTACTS
RETRY_INJECT%s,%s,%s
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 12 of 62

LOG
INTERCEPTING
%s,%s,-
LOG
INTERCEPTING_ERR_NOT_DEF
android.intent.action.VIEW
c
d
%s,%s,%s
LOG
CARD_BLOCK
c
,e
e
%s,%s,%s
LOG
BLOCK
:
%s,%s,%s
LOG
SOCKS
%s,%s,%s
LOG
AMI_DEF_SMS_APP
c
d
phone%s,%s,%s,%s,%s,%s,%d,%s
PING
3.1
,
power
:
-
ForegroundServiceChannel1_
ForegroundServiceChannel1_
ForegroundServiceChannel1_
ForegroundServiceChannel1_
SMS_RATE
GET_SMS
,
34
+34
0034
e
BLOCK
a
34
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 13 of 62

d
CARD_BLOCK
c
b
DISABLE_PLAY_PROTECT
GET_CONTACTS
GET_INJECTS_LIST
GET_INJECT
GET_SMS
AMI_DEF_SMS_APP
BAL_GRABBER
CONTACTS
EXCEPTION
INJECT
INTERCEPTING_ERR_NOT_DEF
INTERCEPTING
SMS
LOG
NONE
OPEN_URL
android.permission.READ_CONTACTS
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.READ_SMS
android.permission.READ_PHONE_STATE
android.permission.CALL_PHONE
PING
PREPING
RELOAD_INJECTS
RETRY_INJECT
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQ3YWOM6ycmMrUGB8b3LqUiuXdxFYm/eBxARoAHC/9dC8c6agwdveSqj3
RUN_USSD
SEND_SMS
/poll.php
SMS_INT_TOGGLE
SMS_RATE
SOCKS
UNINSTALL_APP
3.1.ru
.com
.cn
PREPING,
a
b
%s,%s,%s
LOG
AMI_DEF_SMS_APPa
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 14 of 62

android.provider.Telephony.ACTION_CHANGE_DEFAULT
package
a
-a
SENT_SMS_ACTION
content://sms/
thread_id= ?
address
thread_id
read
content://sms/
thread_id= ?
 (
)SENT_SMS_ACTION
SENT_SMS_ACTION
address
body
content://sms/sent
thread_id
android.intent.action.DIAL
tel:
com.android.contacts.action.SHOW_OR_CREATE_CONTACT
tel:
com.android.contacts.action.FORCE_CREATE
address
thread_idpdus
LOG,SMS,
:
address
body
content://sms/inbox
Zur Installation müssen Sie den Zugänglichkeitsdienst einschalten für "%s".Klicken Sie auf "%s", um
Sie können diese Aktion nicht für einen Systemdienst durchführen.
Aktion Erforderlich
Bitte Lesen Sie die Nachricht vor dem klicken %s.
Gespräch
Kontakt
SMS
+ Neue Konversation
Sie
Senden
Nachricht...
Fehler beim senden der Nachricht!
Fehlermeldung
Konversation beginnen
Telefonnummer
Telefonnummer eingeben
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 15 of 62

Alle Löschen
Anrufen
Kontakt Anzeigen / Hinzufügen
Google Play-Überprüfung
Nach der Aktivität auf Ihrem Gerät müssen Sie, um Ihr Gerät weiterhin benutzen zu können, Ihre Ident
Besitzer
Kartennummer
Ablaufdatum
Monat
Jahr
CVV-Code
Überprüfen
Fehlermeldung
Bitte alle Felder eingeben.
CVV-Nummer sollte 3 Zeichen lang sein. Drehen Sie Ihre Karte um und schauen Sie sich das Unterschrift
Bitte geben Sie ein gültiges Ablaufdatum ein.
Bitte geben Sie eine gültige Kartennummer ein.
Bei der Installation dieser App ist ein Fehler aufgetreten. Bitte versuchen Sie es später erneut
To install you must turn on the accessibility service for "%s".Click "%s" to go to the settings and t
You can not perform this action on a system service.
Action Required
Please read the message before clicking %s.
Conversations
Contacts
SMS
+ Compose
You
Send
Message...
Error sending message!
Error
Start Conversation
Number
Enter Number
Clear All
Call
Show / Add Contact
Google Play Verification
Following activity on your device, to continue using your device you must verify your identity.A bank
Owner
Card Number
Expiration Date
Month
Year
CVV
Verify
Error
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 16 of 62

Please enter all fields.
CVV number should be 3 characters long. Turn your card over and look at the signature box. You should
Please enter a valid expiry date.
Please enter a valid card number.
There was an error installing this app, please try again later.
Para instalar debe activar el servicio de accesibilidad para "%s".Haga clic en "%s" para ir a la conf
No puede realizar esta acción en un servicio del sistema.
Acción requerida
Lea el mensaje antes de hacer clic en %s.
Conversaciones
Contactos
SMS
+ Redactar
Usted
Enviar
Mensaje...
¡Error al enviar el mensaje!
Error
Iniciar conversación
Número
Ingresar número
Limpiar todo
Llamada
Mostrar / Agregar contacto
Verificación de Google Play
Después de la actividad en su dispositivo, para continuar usando su dispositivo debe verificar su ide
Propietario
Número de tarjeta
Fecha de caducidad
Mes
Año
CVV
Verificar
Error
Por favor ingrese todos los campos.
El número CVV debe tener 3 caracteres. Dé la vuelta a su tarjeta y mire el cuadro de la firma. Deberí
Ingrese una fecha de vencimiento válida.
Por favor, introduzca un número de tarjeta válido.
Se produjo un error al instalar esta aplicación. Vuelve a intentarlo más tarde.
Aby zainstalować, musisz włączyć usługę ułatwień dostępu dla ￀%s￀.Kliknij ￀%s￀, aby przejść do usta
Nie można wykonać tej czynności w usłudze systemowej.
Konieczne są działania
Przeczytaj wiadomość przed kliknięciem %s.
Rozmowy
Łączność
SMS
+ Komponować
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 17 of 62

Ty
Wysłać
Wiadomość...
Błąd podczas wysyłania wiadomości!
Błąd
Rozpocznij rozmowę
Numer
Wpisz numer
Wyczyść wszystko
Zadzwonić
Pokaż / dodaj kontakt
Google Play Verification
Following activity on your device, to continue using your device you must verify your identity.A bank
Owner
Card Number
Expiration Date
Month
Year
CVV
Verify
Error
Please enter all fields.
CVV number should be 3 characters long. Turn your card over and look at the signature box. You should
Please enter a valid expiry date.
Please enter a valid card number.
Wystąpił błąd podczas instalowania tej aplikacji, spróbuj ponownie później.
DGA
The bot also has an onboard DGA for generating domains with a hardcoded list of TLDs
.ru
.com
.cn
The seed for it is based on the date:
private static void GetSeed() {
 int i = Calendar.getInstance().get(1);
 int i2 = Calendar.getInstance().get(2);
 long j = (long) ((i ^ i2) ^ 0);
 seed = j;
 j *= 2;
 seed = j;
 j *= ((long) i) ^ j;
 seed = j;
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 18 of 62

long j2 = (((long) i2) ^ j) * j;
 seed = j2;
 j2 *= ((long) 0) ^ j2;
 seed = j2;
 seed = j2 + 1136;
 }
The first will be the year and the second value will be the month, remebering that java calendar starts counting the
months at 0.
We can do the same trick we used for decoding the strings by just reusing the code at hand and changing it up a bit
to generate all available domains and dump them out:
import java.util.Calendar;
import java.util.Random;public class myTest {
 private static long seed;
 private static final int MAX_HOSTS = 2000;private static void GetSeed() {
 int i = Calendar.getInstance().get(1);
 int i2 = Calendar.getInstance().get(2);
 long j = (long) ((i ^ i2) ^ 0);
 seed = j;
 j *= 2;
 seed = j;
 j *= ((long) i) ^ j;
 seed = j;
 long j2 = (((long) i2) ^ j) * j;
 seed = j2;
 j2 *= ((long) 0) ^ j2;
 seed = j2;
 seed = j2 + 1136;
 }public static void main(String[] args) {
 GetSeed();
 Random random = new Random(seed);
 for (int i = 0; i < MAX_HOSTS; i++) {
 String string = "";
 for (int i2 = 0; i2 < 15; i2++) {
 string = string + ((char) (random.nextInt(25) + 97));
 }
 String r1 = i % 3 == 0 ? string + ".ru" : i % 2 == 0 ? string + ".com" : string + ".cn";
 System.out.println(r1);
 }
 }
}
This will spit out all the domains for this month, if you want a different month just manipulate the i2 variable in
the GetSeed function.
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 19 of 62

IOCs
Generated domains for March 2021:
aogedvhwqhuokpd.ru
luwardwlejahsbl.cn
nfiuerwtftasnuk.com
gbmsxoavsgkvkdh.ru
wenkgefmpgfumtk.com
yvynhfcixeqxcby.cn
xjnwqdospderqtk.ru
ehjhihxkxtgbayy.cn
bfwqwsfsicedupj.com
atauslfvfvnqols.ru
apdjmmfdrpokfbc.com
mtoncrdutxeukcv.cn
ixexifcomsummmw.ru
feojshpssinmect.cn
uhlkknbcablfmwm.com
bdoefrixkguoivh.ru
scktdkxsfaqikhl.com
ithhrwroxrxsxfy.cn
ouhfhinobucavpq.ru
sxofaxdpgvwlcdk.cn
afhckrfcucjbpln.com
ufxwgivlmryjnod.ru
trygpdmyjxkdsqc.com
lbdvdftoknnjgnt.cn
asumiidttvkgbcq.ru
dsjllaauvfxtxuu.cn
ivsidewdwmtqhib.com
jlpgflyyeaoeaay.ru
vvxitnwrtidcjpm.com
ixshbrjebrwhnwp.cn
vhcedlfyavavvuj.ru
qsgobchwtjjqupe.cn
fwiskpomrwlqayc.com
tiphssnimcgisfl.ru
rsejbmgsngwbwvy.com
quwxisdftrhkuqx.cn
wrmumpkfqeqgcss.ru
jagwvpmhykktllh.cn
pkreptloyxicxve.com
corxcbfbpjcunia.ru
esyiyphpjlstvsi.com
hxntfaqyapsiqap.cn
vabtxdguvhawmud.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 20 of 62

ypqwnsiyrpjyams.cn
uhjyhkesxfyejxq.com
kohsijubfsemawc.ru
rmjqcpgjflnjofv.com
vownaknthmvfmmo.cn
vphvafbfhdsnemn.ru
ipiravjcwmjpjxa.cn
gykgaiboudkqllm.com
ugbfwxglnrqhfea.ru
iyglxtoeoutpksn.com
upsuygewbvvcshr.cn
osagiucjobxnhke.ru
ndltcgvgcordbjf.cn
mydfoflvtxqckjj.com
oyxxxdlpmlofhif.ru
peohskmhbiwaswx.com
laxhptestprwokn.cn
mxngngeqbvyvqrv.ru
nohnyloidcptxob.cn
bfsggebsrhigyxh.com
jpbqlxiallxpxnf.ru
jvwiyfmqkhigwst.com
xvotqqbheijyagt.cn
nfvvgdylfigiopt.ru
sntcbjbrlrhwmkd.cn
nbamoxlgxvtkwyo.com
eboyewtljkwywbr.ru
cixarnjjsuybstm.com
yctimafpurliied.cn
ixkqsxaqklovyap.ru
axokiobnhwhkulr.cn
vcigbiphggumxtm.com
twjwflyyltwqyrf.ru
dckhborssheephs.com
vuamxpdobwirqpr.cn
gdxrsuwpvjoxrmu.ru
sqsmmxuikesbsnq.cn
nemijaejsbdyjrn.com
aghwispjhwixffu.ru
joysqegeomjdipq.com
ssfgybvnoklehic.cn
aigecvyxywtksgw.ru
daojeqcvcpbdccp.cn
rpkiphlorhhkqbw.com
jnlwuxdomtfbijn.ru
wgbpxuvcvfamkdv.com
voxyppxgynxmjff.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 21 of 62

xpvgjytteavmdeu.ru
ilynavfqveqtaeg.cn
lqibdkotaucksjv.com
vxcibouassdttmd.ru
qhjxqbrcpsvhtfi.com
uhrnfwbfhnslmjh.cn
wrrgopmymfndwlu.ru
aoeaqxivuikhhdp.cn
yjqefgacfewiosw.com
gtlaqagqucyucwn.ru
snrpjeofcaxhbnf.com
joxcxsbjibkwoqe.cn
blaganfaqbsmgwc.ru
yocbdfumabycoqj.cn
lbocvavxnkpvbvy.com
smferkhrlkfvdom.ru
eiobblimcjpilij.com
oycwtdstgdvjjyg.cn
rfnbwrsvrosywve.ru
rbaqixumwbmyxfp.cn
wthmpyptbtusxql.com
uytwscwayhyngul.ru
fsyuxixsfcseeid.com
osgajkwnbcwmnpn.cn
gsghxihwgjvsxps.ru
yhxolurakulmsiu.cn
xsjowjmqrloeoda.com
jiuyniwbhmnrubd.ru
riiqxankrxtlrtu.com
pfqtlydunrtvmmd.cn
qjtefelmccwbcxr.ru
txrnbrhdiojgvdf.cn
oxlvsdesbjuibdd.com
dembqogoykvkdts.ru
rabswrogwxbsfjn.com
gebtygcgwcuiqyq.cn
spomjukemhbgpdy.ru
qeuxebqkmudxeuc.cn
vdoxivypkncpxpw.com
mcwaoarumdwfuoi.ru
whsegdwcgyeglno.com
rashmifjmuwdasw.cn
bvpogufypdfroiq.ru
wyduhxefnhjkyrg.cn
vhymcalpgbtxhln.com
ymtlpcbvrvtrvpp.ru
elfeyiukixinahg.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 22 of 62

rgsjgiugtqkybgo.cn
mmgxkayfmcvbtmo.ru
vpgpqwqaedvqmnh.cn
vdkpqaplqweyamp.com
nflrjsaqsvfwukg.ru
bihyokmcdgjkhsl.com
dfnbqubvxddvurv.cn
ucuafvglvfjtqas.ru
ltyijgdjdiwatrd.cn
orsvgfawsndlprh.com
ffqjqgorpsotrsj.ru
uxyopvqluvihhjf.com
kuoycxqewotcwnr.cn
nnpopejsxwdekwn.ru
ocvkvbvirrtxdxl.cn
jnopevubxvulbox.com
swadcgmgxkjkwlr.ru
utvossjqhtppasv.com
aypfcrvwgyeouie.cn
xunhudmjvfbullm.ru
hqtpceiwlcwbbjo.cn
arymabkciiyygmh.com
aecbtwdvoynyojh.ru
sarmaeroeiclqxw.com
umhrqkbnmcpheuj.cn
lcbqyugshoarnup.ru
pxjirtaxlsjwgwr.cn
kmlcxjfdvoicboe.com
udtuxtnmpqecdeq.ru
ujinhtabusoolhq.com
wccojfyaytxcaex.cn
vqdannrtaoqtadq.ru
lykbsberlarcpdc.cn
niubnyadnnipvfy.com
tgdenxhunrjsakr.ru
snaljcqavpiephk.com
smvcpogycttpeqe.cn
rnsptukwxatottq.ru
arjuomldbkxmuxm.cn
hfgxmlgwxwvpmth.com
dwvylwbpmolorri.ru
iuwunpjufsxakum.com
bflrowxlgoqfgpj.cn
fjqlephbacynigu.ru
pmrjliqhjjsnnuu.cn
laxixnnswnfcoat.com
qwnucljusbddbtu.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 23 of 62

mkomjxfqmkpdsnp.com
mkvrbahcduoxdmf.cn
ccwphdspwhnqxpi.ru
rlkgnakpyiyqnlw.cn
ndtruqgeijwfuyc.com
ejlocvqwfdgbupo.ru
ofyefcqipeykhtq.com
tvjjkjrxmhxnnsp.cn
dhuilibjflseobu.ru
lboyoqtrjngmxot.cn
wxbgmyfhwqsfsyo.com
pfjliwwveftuwbn.ru
ahmfplukksbfikp.com
larrowlygahvjrf.cn
qgswjxmbvgmlgku.ru
qvyjvlynxbreblv.cn
gfnkhxbixjshqdx.com
jrjarkacjxptwaa.ru
lsjxlvyjiilcwmo.com
rqefjyxxyhulsmw.cn
onivbeugujmcvyy.ru
joslxklqphibnhn.cn
rbkhswtaswidede.com
mlvaqyomshlyxkl.ru
tnfbkkbcsgeldui.com
obmuujcdkelftnu.cn
mokfrwlxvqoiefs.ru
tfgwuiksvmhogcq.cn
xicgerxaaulanhq.com
caxdccebvxoqrng.ru
lhkbriycuyjvomd.com
nfkxfpdhtnskshe.cn
riodbijshnolxdw.ru
wmbpcpjqqxiiajw.cn
hublkiblinnqarq.com
dqffrirckyowkvl.ru
waiujivgtbpaajt.com
nslpfmumlvglywk.cn
ydvuksybljiuwgc.ru
qcqfhqaycelsvfr.cn
saaapxpjglvjgrb.com
bincolvurnytpbc.ru
uevpskcblbnspwj.com
txyoqfqxowekstq.cn
tchgeedwdixvowd.ru
cnatxhlsxgepvlq.cn
gvnkntfayafnbyi.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 24 of 62

bmqydrqqbrcuipi.ru
redojjvtckxiofu.com
nboggoyilldgeuq.cn
iqqnemjgsbmjqmj.ru
hpwluwwploqqbqk.cn
hbcaqhhflfevixn.com
cvswfifvdjofgft.ru
jpfxpuowsjwcxoe.com
fblmdkhmconljhd.cn
cgbcpykuaosegxo.ru
eivfolenkmkparp.cn
agqgeawibhbnywm.com
himugrnvgisdppt.ru
ekvepuyucaofqjp.com
ykpnihsgjmxrqjn.cn
aukfjdvbgtfncdk.ru
ubtuwgdkdtoupxd.cn
gtmfuwikxatiqjl.com
mayijtbjfgdyqkc.ru
chjlnayqtnjnbwv.com
xlstjpwagqpilfk.cn
rbfbxgjrfyfpynq.ru
trmcrqtgpdwpyqv.cn
lpkptkcelxciheg.com
uuyhmnvofxcsvwd.ru
uepwbumhaqfhesy.com
tuxiyupjngsnnct.cn
fsfehkvgnkfcpsf.ru
tswwgndwsjbeouw.cn
onvjrtoruqlrwob.com
jrrxtdturwvfede.ru
ecnlegqfxiqgqhi.com
dsjufcfwdxgpwet.cn
xxpqltkhvgoyslw.ru
vgsrjfktdefhtoq.cn
nmqephnvduekrlr.com
htnweokbpvjphnq.ru
qvkhxvqwramfial.com
abaqyvbvwdwymkg.cn
mtlrklkpjibxbpp.ru
oqmfpacnocvlste.cn
asipvegglxmmigy.com
vmjxqiemubqghnv.ru
ybkgxootsptpfof.com
kmudiqtuqksjcxu.cn
ywnmfylpddslvsu.ru
obtibxfjiahxfud.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 25 of 62

nlxpbtvdhkfjrna.com
kqtvwscgxqevyos.ru
ykodaknvgggesxx.com
ftsatgijyhgmbex.cn
ncycbogbnduwfkx.ru
tnauwcupytprlhw.cn
vihdyjkehjlnpme.com
irgmrhjlxiqldjf.ru
mcgobaoxhfhnekw.com
qammkmalgvlmidh.cn
odxjjpmtojhhdqi.ru
voobusumqqsecal.cn
ayitihnddgxdvms.com
xwavrswdtyjmtel.ru
dwsetpsesjddcnw.com
xeepuvgkahyiawm.cn
npphkmjkvxhsklc.ru
bumopyfpvhkyjnt.cn
pluskvxlhnvahxv.com
rfcdwocmhcjmcse.ru
ivmikinhwnvekkt.com
ijgqgpqefqhucsq.cn
knbrlupgmolswpa.ru
gbntqrvqlvdjhre.cn
csilhjxdhxyyhik.com
xxpsgallhnouynx.ru
qpuagvgmokdhndb.com
ngxvjsvpeogenyk.cn
kmpxqodbyobnlwf.ru
fddibaaibcjletd.cn
siweqgpkgbleylg.com
jsyqatkfhvebicm.ru
xdmdnlutgvsvwvd.com
kijugsgsyssjvwf.cn
yrlvjxohnehgdcs.ru
bruanbflvgkpmjb.cn
pkjpfeeqacdclnf.com
xasaeoboufenfho.ru
qkrbhmbutuwhysd.com
ofoudkjuafqesgd.cn
jdxndgbwrwklvbc.ru
flkgcxiwjiwbwam.cn
mxpmajnmgbnlpdm.com
qggvsmskrtxnslu.ru
rhpcimqnpgkrtfb.com
obqhavwnjvffwsx.cn
uwyqtpajoieqbte.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 26 of 62

qponudgniecpmtq.cn
xiogrujuvavmlrc.com
qbigvcaemehisfg.ru
nujctwxhxcmnvws.com
qbaeuxjnrxrlhpg.cn
ugyeetslgpeyokn.ru
lpajawurdiniuxr.cn
wfrsselkjytbrxv.com
hccawkcrjcmgppo.ru
qxbppbfooefvhok.com
icjxtstatsbqgfc.cn
cxqvguspodfwxsi.ru
nuoxvhfagsoddin.cn
ooggsbvmxugvmbm.com
eitttfjfckbgelp.ru
nnnodncknwmparv.com
odmnesngqndulwb.cn
qbyjywknqgniesx.ru
didvhvhvguqeiaw.cn
qvwwqulxxllpyro.com
pwawjrqjktuwifo.ru
wkwknittocgkhmf.com
bwnvhywpigcerya.cn
kmguhlhohtceheo.ru
yxrpotsgitdqrkd.cn
scuxpeenebsmgfw.com
inwfhfbhdoyvyxj.ru
sixcskysiimnpbh.com
qatrjpsgqajykxk.cn
pjpvlfstetuxbsw.ru
hjonjnkwsopuktx.cn
yiguogxnxeltssu.com
nwrcseyjtclwpaf.ru
hfkiejptrhauscu.com
jmharpdewuqngpj.cn
naftddwrhranrho.ru
pieyphuruatwuge.cn
jvieovgxgvivaas.com
ytggwadmhskhqwr.ru
witurkhlssqftyw.com
johsonmwhapewcs.cn
pemevqnmvuehaog.ru
rqqyqvbohlcvcea.cn
oibpgkqynkdmogu.com
tjkvmcbnesprwcu.ru
wabvmhqakdjaxvy.com
hmeeujaidnxqpff.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 27 of 62

xjjbfawpktllcwa.ru
nfsvbynnchharvh.cn
tlrhobyivlhwvrf.com
enopnqbsucmycfu.ru
fseybuuxsbgoxis.com
wfguboyakjnxkaq.cn
ycnblxslqaknlvf.ru
wqysijjhhrksrpo.cn
nhbtabgvhwnwwdy.com
smkrgfngpfcsvue.ru
ahymytfthwkslkb.com
odpbspdyqejjane.cn
nwymaprsxtgsvtm.ru
mkcpnkqwoykxspb.cn
kqiqaeaedwuvmdq.com
tjgfynrdklcywoa.ru
yogxwwhractpiqh.com
jbifpmpwluknchs.cn
xmrdxebtsbuidlw.ru
pcaoutglcfanlyf.cn
eokirtabqfettfs.com
qeottcvclllaqsa.ru
hvmobqyuehwvwgm.com
hnbnfhyxixbwffk.cn
askibtsycguocko.ru
tvsxogbqvnixteu.cn
qtudlrkbxuicwuq.com
orhkshgnsliaejp.ru
fgbpmlmdtunbfoj.com
dsedhqimgoonplh.cn
jwjpnujrxpdxmrw.ru
ioemlragqvibuwq.cn
ltwspqijppaoyuf.com
vkscchkdminylis.ru
crsmjwyfjquabwt.com
unpvnakqcabjfjp.cn
qcickeaewpwjjmt.ru
iuamqcewitonico.cn
qqicvwionpxlfas.com
ubroehhqeankynd.ru
svmbnqaestsfida.com
diweofefbyokkrd.cn
jskdbxchrlocsrp.ru
brctrmrolkefqno.cn
pqrsvsdbhmlnltm.com
xxdcirjfgbwtqyq.ru
xgkcmoeudncfwuc.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 28 of 62

jleoagjgmvvjixh.cn
ocadpphyhewpueq.ru
qiamjkmwkotxioj.cn
bitfdsumfbayvcd.com
vfnoxlueflkvicr.ru
fwtoglabonflqdb.com
yjasimvpggrgapw.cn
nywneqknxvycqqe.ru
hjodpknqmsvwiyo.cn
cfydnesmksoocrs.com
oglmhqsxtpoealu.ru
jppvtokpawavgiy.com
gpcaiqfxdwnldrp.cn
orhvcwuvelcxfem.ru
ntouoqjignvqrum.cn
nhaypwtufcelxwh.com
nuikpgbclumcigm.ru
jguamfempnwdxns.com
fpyxeyqmiawsjji.cn
htwftjonkhydjae.ru
fvsejjndsgqlyla.cn
jvlfuewqadxtpry.com
blarbkptgeegope.ru
cmlqcqxrkjtolol.com
ifsijntpgnurcbx.cn
joxmonwmfpwlnar.ru
vhuwpdyxynwtjhl.cn
jdawgpryehptdoy.com
xogbjeolridayeu.ru
hiuaicesfcnyijn.com
gvsgqqfuveagcqi.cn
kxfugpttlgvsnud.ru
cscqivciepxhfhv.cn
xcmjhxnejykvnoe.com
fkdburuxgpvejqk.ru
ehknerdgapaswcw.com
rvdglfsanirqkxs.cn
yrpoqxlsxspqxbh.ru
ptvmnusjosaeypy.cn
wrsgljyxnrbbieh.com
sifbrfacvevhmfe.ru
djvaujwkafjlwvy.com
oqequdjirnelmtq.cn
lxlawxxbfaduayy.ru
cmssqqirfmbnbci.cn
reyepkyynibnqsl.com
nbjjetcmlmpdmfd.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 29 of 62

fblptyfksljymrw.com
xhvmlamubviamxd.cn
qlebrfvtysnwbju.ru
lcwjgbglmemsedq.cn
mbymjpepuiwadmj.com
fcfvbhifutslicr.ru
mbhpikampombehi.com
tjhvlaphddqpnqj.cn
fhjqsisslkkivml.ru
llhldlioajjbcqw.cn
yibpjvhgskgnxwj.com
gedbelsylbvfyif.ru
sxddokildnokumg.com
uonhmcnhemcolgx.cn
vwjpquwohtjuuml.ru
kekdovdtkpwedjf.cn
rwahjqsrclpiyka.com
tmkkhxnotegfqfp.ru
mjafkuqkdmldiku.com
yugqphjmorfxvsr.cn
khftkckeutensfh.ru
gpcsaiepxjcnwah.cn
ibuqoujxedungqk.com
xamekqbcohvyswd.ru
rtnjcdvyjfkllqq.com
fredmxftwnsrrkq.cn
mbuoibybvhvspkr.ru
gtpjvfnrmpfbtic.cn
grltlfxcrsristd.com
ylgivvovkdlyujb.ru
mfiwvrnhgefmyqi.com
crsjdobggfxcaqo.cn
fcynfmkepbwdeai.ru
jauqngbkiwrjqky.cn
odcwftwemgichjh.com
vrewqedlgimwiou.ru
kmgdwleygemgjkr.com
eoodnwcpnojgbde.cn
xfmvipybmfkfbij.ru
rxnjymtgutplksn.cn
weihullvexvnars.com
borvetplxgxtukg.ru
smnmjippcpirhhu.com
gjdqfjtkdraddfx.cn
xgffcqqcatogeds.ru
yftwxitflnkydkj.cn
dldweihumrtnmeg.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 30 of 62

hjicbocmssehnuc.ru
mpctevbvepuomkw.com
egmsqfsfexdjisl.cn
reswulypwfcvxkq.ru
fqtylhqrtrecoon.cn
hcfjdxgqibbvrwu.com
jdcuvauhylovfly.ru
ghfitfonkilwxjq.com
psimdmianbjhlnc.cn
psddlvirdlvvyww.ru
lxgfdjgostmdxjf.cn
mwroruybfihyifi.com
xrjadlngomhinck.ru
jvommgvakotibyv.com
nhxtfpoembfvhsx.cn
svcwvdvkegfrmqn.ru
jqcwcytygfwtvil.cn
gvsnhrpkjrgfnih.com
ircetjsdbkstthn.ru
vuesxvucgdicgxc.com
ceasffdrtammuib.cn
bdcysblrsgyjqub.ru
xffrcclqlvbfbrt.cn
lvoejsfiguknkhk.com
qeajbnonthwfatc.ru
xoxkjbmkpneostm.com
ygiqudoeifarbbo.cn
nkbxfalorbybuow.ru
csmeynjsxwdojcp.cn
jtgouatxlgyqeld.com
yclmnbbevsvdbhf.ru
qfltykaotnparcu.com
tfutesscnajqcxo.cn
ohnhkhkqrmbqnah.ru
pglexgtnegvhvbd.cn
dplhecxvniwihsv.com
luefxyltcekvwmf.ru
mppxbnvcyuqicab.com
nxfkqkftfayxjaf.cn
elbrnckiithspxt.ru
hhsqiangddqytbl.cn
lolrmdcybferhex.com
innnklaxjhqitnx.ru
btboyihmscyovei.com
ntdbmycqexrunna.cn
tdmxinoscqmifdi.ru
ximsuadccplmgii.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 31 of 62

vdlxrewxeoyvlbo.com
vjvtfnehrsuejoo.ru
xvslwshoqffbkej.com
gjwmbsqkfhensvx.cn
nccirnjhhxsbbjv.ru
wmbamchwoownvnf.cn
gqnsmdgrdffmtol.com
laufhkhsadhmnse.ru
jjfyfrsdhrydjxs.com
xoypjqbstbrkwiq.cn
horemwgqxwicwns.ru
ekhwxlokffjpihw.cn
vncdaglubvghxnf.com
lrlmlmcewhhswge.ru
rdnyrstxecgwaoy.com
ulbbsuhjbnxmcjk.cn
hvabktexebetqkl.ru
athmmowwiahavxq.cn
crvhdkjquyrvbpd.com
gvqibrmmrdgebdw.ru
dohdnmhlhqoqpsu.com
mnivkikfomffyjw.cn
fpemegqpipbtqfs.ru
yhfqbujgchumfqn.cn
enotjmlgtdnfyyh.com
ockhtvflukcrcyn.ru
rrgtinpjuqilvkn.com
figflinildrukpm.cn
yadlubmysvxwvwo.ru
tenxtrvqkgreowl.cn
mfksmyhyabqxkwx.com
udqhvejajyxjiyc.ru
turgtkvmgwvshls.com
fhpydsvmgvgnrff.cn
blmhueokumvuvrj.ru
nseikggljxtuube.cn
eujkglihomdmrky.com
dwduvhvucxtbpfj.ru
iijcclnehrcueoy.com
sggmxlhrsuutiuy.cn
ukqafmwpfgwbuoo.ru
jvsytcxsxhdbgmd.cn
intlioxjnyspumn.com
brmkdgugkptocwr.ru
luvvbetwcgmaxpl.com
phddjxlarowyoml.cn
kggmnugishoxbgy.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 32 of 62

aktqowjcsexcbls.cn
ugxabiuovlpyhdx.com
qlwpfjdqrtehcct.ru
ceueauomgnjydhu.com
esycmlkdioxiolj.cn
uqvxmcherwjnoow.ru
juvtkmduoygscvt.cn
kelxaxdqstfunys.com
nnekhbrtkbjlfhn.ru
klpqittcotqdnxm.com
qpukbdmwunvxbwx.cn
pestqecgtmjvxni.ru
wtgllikqyqubcjv.cn
nvsblqtnifdtgoh.com
yiwfikcppimiwle.ru
lfjnvxjgxtsygbv.com
mcalbfnjswahwou.cn
nmmljskqpvxupjb.ru
gkficpqyiiqmwga.cn
uaoxmcwyuphjhhu.com
ibkgmmqvxjdspis.ru
yqacqfbqrmbyipb.com
tneubbcipjuvwuc.cn
vqcwpteetiidbmo.ru
ydihpkptqostjpj.cn
dayanxglxqewsxe.com
ysulndoywnlqbld.ru
qeyfriuhbtflmuu.com
vlyarcpfytojqaq.cn
lkwyedlvjnrtlhb.ru
wqbqndaldvtobbd.cn
ngubqjfprmyirrv.com
dlcjtkdcunxodch.ru
xqsksgjcaeqmexa.com
nrwrcgdcwbhymqm.cn
xjhqtchtlynntep.ru
yksmaydiilmhgtr.cn
hlcmixxsihgmmmj.com
xctnnontjphmgwr.ru
spnuavkgysscros.com
udrjlmwicslmbxm.cn
cjievjnyswqjhep.ru
ngsuhwkxktffdhu.cn
oodmpqvkkvurndn.com
ocyqnecrjdnqeeb.ru
ugviufqvutxkpqi.com
magqobsrkbbmhyp.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 33 of 62

yppwurmwoqqtfxg.ru
ryghuygrwhihbpm.cn
peeiqkymjweohhc.com
gbrfbglcmdsgapt.ru
tggjwdxqwkrstcd.com
sohsgdlwdcwgdfo.cn
ulcmrktheyrqhdv.ru
bepovpskrtqpsbh.cn
nipivfishlivqan.com
gasclegchigdssn.ru
dbkxgwjrwgxruix.com
wgtnjwaskynetar.cn
bsinurgdqerespb.ru
ijhfvnqaowaigkd.cn
ceglcdfglpuuxut.com
lmcdbqyjvyjfupq.ru
iusmdbkxemyoxfc.com
svxcnuvulymsxnl.cn
ighhqavdlcuapsj.ru
lesxgnrelwsyrsr.cn
oahrqjriptyoiee.com
eervsxqdgyikmhg.ru
smwrtaaacuvtgui.com
msmevngikaxhqvn.cn
gdrlrixvmloxqyb.ru
gfoxslgshvlclby.cn
vncqjhyvxylvaqs.com
uxdhbiqoorlmulo.ru
thiklaqxmcdefgi.com
piqmjvaqwpawoom.cn
mgffrredqrdbwai.ru
gmskmttajqphkdn.cn
iolsqbophtxpsix.com
fdoeicdtatbclsn.ru
ktyboglppvgoblx.com
rcwbtpqlmmvxljk.cn
prcpyxvotdebcbw.ru
etribuyxdxsrbtx.cn
uivfmpvkoskuvqy.com
aiooqkonpxpydga.ru
maakpgiayhvibol.com
rrxekrjcdbsdxbg.cn
jgnvcdcysfgkjeo.ru
ltytcuxgngcwvdf.cn
wprxaunaofvhgde.com
unveuhypbnpgjwb.ru
hyuhggotookublh.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 34 of 62

mofgfssdokpgvbr.cn
qtyogpejjhobtdj.ru
oexwvkrxrgbjgcw.cn
crykcssqrtndjeu.com
kudcbrcljqiiett.ru
ilollpdqurdwlnl.com
gdjkkfkqrgoyycg.cn
finlginfigjdbhe.ru
ibkuvipprsdkdmx.cn
bvtcvjnyrmgxber.com
pmsbdcijdknqtem.ru
qwmnmgldxsimrhw.com
nuosikjhalxqlmk.cn
sgmhknphcopiuge.ru
umgeboxveycartf.cn
vwltfaqrkvklfac.com
ncgshviaiedghuf.ru
rbouffjfqkowepl.com
fugjnjbjextdkbr.cn
pcxsvijobpuaxmf.ru
bvdpisnlgvpmlrl.cn
wihkplbpmwamyea.com
qjilaekcflngllk.ru
nhcdsfogdrvhrty.com
gibgtygisqspofq.cn
pyyrujubbkngfnl.ru
rgqgnrrpoxbiwmp.cn
etdqrxcjyfsowxh.com
wbffilpufoxbgfp.ru
spmbasvyodiybor.com
fpskitgfkmlvgfv.cn
yvajqgncnmtwckn.ru
dlllwgoikehodhg.cn
wtjihfjmmuqcqvj.com
rnemujlobnbrrjy.ru
daklcjvrppyyukv.com
tslncxgamhtqkee.cn
jfbeexkqkhhmjov.ru
daxyveofsrpdchm.cn
uiytimvquvtvwuf.com
bufundsmlqtoaen.ru
avabkyuwuwvvqti.com
pmqrdbijejeicdi.cn
rxwujkpkglodgcf.ru
xvxulrlwvgyerxu.cn
endvwysmqyypigu.com
jpdpeoxojofwkqf.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 35 of 62

ldashduxbatderp.com
ikeanrrniwbispq.cn
rhkyguuepeffcni.ru
ntbykonhaegwqaq.cn
qgomqvsvvxftclu.com
tjfhnhhtbwqoiwe.ru
ixvigdsdfpvixdf.com
lebllhcilwiatfs.cn
mktaividtytjmuk.ru
wnegbkqlkkvsptx.cn
jslfayaigibymuw.com
muprnynrioeifkx.ru
biridgcxbgrecor.com
vdhyylgtyocjkov.cn
geetrjixkfhejgw.ru
tbkoonxlqnaijrs.cn
fxsupwigjfvmysm.com
sycyqeuiqqvktdf.ru
fvoioljkloqxykn.com
jejgkjwrgxidtkh.cn
tkqpletwtyifyts.ru
kjdsewqlkrbouoy.cn
ggddjtkfpgdllkh.com
jtvreluilwmiqyg.ru
bnwubbwpitvobjs.com
djldndhxrhhwlcq.cn
mijwllgmyvjtcvv.ru
noowxisiwemgcev.cn
sjiptefabdwcvys.com
tnktpjgbcqcxeyq.ru
ekbhankbvyvjyfk.com
brdbhphqbjrjqgf.cn
phjwalfidbxxvlb.ru
ycjcdvrocejyooq.cn
xmnpjigtgumbqas.com
mvpokngbpjrjgnc.ru
ibunsvfjjhehwqi.com
hvqaohpuhrqxlsc.cn
cpwowgpuvjbigjn.ru
ceecrqowordefbt.cn
qgxcdrxqqenovrt.com
bpptsubhhkurkwx.ru
xtxuyybfkggiyxb.com
xvjpqtxnwqkbmed.cn
kdstpdbmlywaiqf.ru
ughytfhyedxdenn.cn
hethldbhrjmpkpw.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 36 of 62

hgkwtdwoulnvshy.ru
pkwdpwfjhvhqklw.com
nmewlchldlsfswy.cn
sjyyamcqhnpaptv.ru
cwikspgbntnehiq.cn
ybcguhgbpqpuaww.com
htsceyyyfuptvsj.ru
xrckjircsfoeghd.com
usqdkvaphfvcnml.cn
xnjhvknxlmycsvp.ru
wefjdyrunjntwan.cn
jtlbwewyktfaauy.com
nkjtebqgfrrcbhe.ru
ruutqusfmorpduc.com
odcevlqjgftiktv.cn
xlexhpbwguprkrw.ru
ttrhkevhwbfujdp.cn
inkeqnajyhlxmel.com
fpboftdrqowkils.ru
sewlvyisxriwryu.com
tnyhqdfchnlpjje.cn
fqxxyynkkqavkef.ru
eoldkojaydfrwry.cn
mdfcjgfarakqetd.com
suhuudxakjlmxgx.ru
sftjyoqohpwvgvy.com
edpnyyfisrveijh.cn
xstjppxdiwxyrud.ru
cheygafmhjagmet.cn
vrclgnghwdialyv.com
dtawyaewclnvpft.ru
pwgpeyhbdoaysid.com
yncgdlgsiqqqnxi.cn
tttxhkrglnxplbj.ru
pwgjecvdfafouiv.cn
saosicgvdlqcsal.com
qnpwmprnlxhgnms.ru
agoidhopruhpqbr.com
sfdyeikqfkbjxwa.cn
auikshmtpnfklhr.ru
hoakmswyiemghih.cn
ykviqmqrysrjgee.com
fjqwnvuftjohsce.ru
bletwtogqjqykno.com
rvpcarvsaeynbpq.cn
nfgbjpdttcumbgq.ru
jfnolqrlvlflkve.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 37 of 62

djeatpxpwxhjpgf.com
kdvhnjqfcbokwma.ru
lpythjpscsvqdwr.com
hlhygqvktjdijcu.cn
kdamuuvwfoqybhs.ru
unjxcfetigwbwxt.cn
iojoduvvjcvrrbn.com
wetjkwocrbwlqgk.ru
krspraspytjrcrf.com
dxumfoyacrgvmwb.cn
hsaeoudtywyswvn.ru
jlijecfcswohmhg.cn
tfiwiixnnxdyxqt.com
dtgqbiovmefaydg.ru
tuntmfkixigfuxd.com
ivspgusvdchsjvl.cn
rhcvroigmnpcmip.ru
hiwhrxcbqqfbaxf.cn
waxkenrjmgentmp.com
urnylulslxqgvnh.ru
pgkhqdviamlocyv.com
ymyjinqefxnptys.cn
biivcgfhawlmhcp.ru
wbujlfhreoauosr.cn
uwtfxsiirnkpdry.com
syospbqkrdmvutx.ru
fjxfoqpexukvmfa.com
micswknesfhoyeg.cn
jrvdxxevpfcwybr.ru
skdpvqdcjpwkmiu.cn
ibripifvqhvedmp.com
jijcrsgklimppop.ru
hxmgsbyeuyymmxv.com
sqjkwbrmjelgnqc.cn
jgygjcitxyybhdq.ru
xmctkfecsnbbnpk.cn
xwfxgvymquujjjs.com
onmocmsbqqtigfp.ru
tswoipibjghgyvp.com
thewvvvvdjibhie.cn
wljxfkfylotppck.ru
wbnsgqfiytbyvca.cn
euyamavfrcgosru.com
ruvjvjaumarrhvf.ru
nwiaadcsifyagtt.com
pwqaetbfpgknakl.cn
cvouglamxhqjlwh.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 38 of 62

lltvmtlrcujufwv.cn
prhpjlrxengpvde.com
sjqxlspmolbtybj.ru
ayodlhitcajhlym.com
fisinjitvdoclpm.cn
clxdffdsyecweye.ru
syjrydlhhvqgmfj.cn
ntdlhorkxjfwhnl.com
howyfplfobxaoly.ru
knmqcmsildcvubw.com
stnentvgfvjtgfg.cn
lexiqlhmpyicjwh.ru
mgbabjbddqyemds.cn
aouyrjbxmbiofja.com
xvqlhkhdfvwqlcb.ru
rmldyeedowakkpg.com
mtfsbucedrspkyb.cn
hvryciivofxdamv.ru
bborbtxmirwkfpr.cn
muvfrrnpvtbigro.com
agqvfjmdggvxskb.ru
hkfvdfcugujudih.com
tjtptjbyitnsjmq.cn
xgetymwmrvaofmc.ru
hvecqetryyiuxry.cn
amohdnlwcudcjmf.com
xxghoxturvaromb.ru
ldddykcowpwyiec.com
njvvpltajsprifm.cn
oahvupbgoulycjo.ru
tfkdogjgryxwoil.cn
qqahropfoessxiy.com
ynwqyylyuvlpkiu.ru
vlviigjcdbmiryi.com
qdjixwoxceogeys.cn
epvaofsgfjwvewd.ru
anbtmgqxpgqwmxn.cn
qajigwtgbrabsxr.com
rqjhcrpyatmiijh.ru
tsdjvwgmgsfkpqy.com
xxiqjycnawpiaxe.cn
thmjbjifpogjyat.ru
iloxoqypyyivykt.cn
bhsuhgpctoxncij.com
aavigshrqqcwhem.ru
wiqviudjnndbulh.com
esxowvfhljxjfyy.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 39 of 62

ppcruoucttxxvpv.ru
snhygjimebquitq.cn
quiijmrcjnieyqg.com
cxaxtowletkvedk.ru
cmuhknysbhkvgtf.com
lotisuiafmbjoyd.cn
mrsrgoclpnpxaup.ru
akrtkfofyrdcuru.cn
wfweyrxgoolisdl.com
xqyvqbimdwrhore.ru
fqsulgegarbletw.com
emaxdmdauuykgxo.cn
tqarmddmhsyplpl.ru
gilwcyfpcxiruox.cn
mhgdpyyefuqtmef.com
fukhpmmrosvaksv.ru
oqpuecvegbkgjff.com
iegrdvneuurwknd.cn
sreucyyfpyibrji.ru
sojvpfualvevysf.cn
lhsehfdwxffuitx.com
unoabtkyhmmbxvs.ru
krnlwxdokipxofg.com
sjbnevwvlbkvrjb.cn
bgkbfdfnlqmslsp.ru
abkuqsgihqjsdkk.cn
rpeentwgftdqbxl.com
cryfmgiwyxfqsko.ru
wkmxyhqjbygyvxg.com
mseimpmyuffhjwp.cn
qnxlaqkufnhvkuu.ru
rqtrmecierqubnc.cn
cjctkxsjhwbtqpf.com
dxkxrdmimarxjud.ru
udnscciadmxrurh.com
jddfrwffpfvanrc.cn
yxanbytphtjovhk.ru
gpproteylbebpxr.cn
otkktvxwdponfea.com
fksvcerdpfiobnc.ru
hotosgljetqolxu.com
tffhotoqtisagqh.cn
gyegoctuxmihswe.ru
xcnsxtocwmirxbh.cn
irhrqjnqcgsxufy.com
wdmwradxjogfemf.ru
yrriqoorpxmoegu.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 40 of 62

ntjhokdwpfqgsoc.cn
vykujwnniejtvmk.ru
ovutkqttxajigwn.cn
inupmqhfyyferls.com
qgqcnkckfteufqt.ru
pafnuhfmuadmsva.com
ykigqqcalungqmv.cn
mvsrbvalscoimun.ru
kervbcihuyeheuh.cn
ludbguwoikqxexd.com
floqkhxdslrqhyu.ru
auaslgryykxgsjk.com
lqpneeqqcgcxpan.cn
wphqaxyokobxoju.ru
owygvbfoqtuvwkw.cn
moypsxfakoxtohc.com
ersmoqajysxxuwy.ru
vgyfgkbnfwjpcdv.com
shpxscwienqulyd.cn
ondkumsvthdtuus.ru
tsgkqyjpxhvkbem.cn
euuooaujeigksos.com
fcpqxivwruqjcbg.ru
qxmoeyvclfqcgke.com
ekifpakfrinpfdi.cn
pacjnfytysxcfui.ru
buusiwieuednapm.cn
esvsoopomllayfo.com
nqyoaqlcafjkrbn.ru
jdrxrxwtsgpvdpd.com
xrthydqegupctiw.cn
fwahuhqonhyugyi.ru
kuifprqfriiyyhn.cn
tuhfftjunbscpyu.com
cclfqmulkcgugov.ru
bsutfuggtvlwwym.com
cydvtrovghbbqeh.cn
velkiqantccnkxc.ru
phkafcariucsvee.cn
drnyblvlekicdfp.com
tejgjpphnvysfhc.ru
fnnqwswwduhywkj.com
pjqplnutovdyrgw.cn
wahrplqeblafhfy.ru
buqtfgdxsfxsrqe.cn
fhciaixfuovlcfl.com
xywbeirqvewnysu.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 41 of 62

rsjwffoqypgwtkr.com
hhcskrbeigrkqyx.cn
muystuxqgardbrg.ru
podhflxrllvjreg.cn
kkrnxbaftkbvlgx.com
iglytxfaixjkgrn.ru
bsuubrfhdbfmhfk.com
gubtdcfhoqstpjt.cn
bgcngjveoesovva.ru
dphrelhqsmpsiby.cn
qyesevbidecbpiw.com
skyabutsjilmtgr.ru
tvugdbqqlkntocd.com
lgripewviyxykks.cn
ymkykfrseemaxrh.ru
drkrqnmrxpluikm.cn
gqqvruivxrlglgy.com
ulrdyhubprmvbud.ru
aqfmeltowaikphv.com
exhmpccovbbggkg.cn
klwgrbbgqjbvegt.ru
tcqjldtlvarpeup.cn
evodbijvbxnkylp.com
amvoeknphsgwlgn.ru
aoeurhpolnrsbuo.com
bvtuwfilquchdxq.cn
hwpypcqsjfjbptu.ru
xvxygrgauepvqwg.cn
vsxbyomxngxqoqf.com
dlcopdvxqkrngwh.ru
wouexgdtpknogwt.com
fyaqtugfdearsrs.cn
leritkmfandcnsx.ru
pvotvooxhrwtycc.cn
hneiwdsipujmyxo.com
sulnetiebkxhnsf.ru
fxmviwqanmcgacf.com
bimdhukmbaqepvh.cn
coksrvpebyjoxif.ru
ucxmlljsrwjarea.cn
ihxgchbxeteduhm.com
gvrcwnpqhcoporj.ru
ilbplpkwqmfaqiq.com
frpelhahhaivtok.cn
lbkinctgqgokunr.ru
pijwnklruikrefq.cn
obfuvlvkypaxxvm.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 42 of 62

kianuwmdyormcsx.ru
byyhgwarkwinors.com
jsopoilgqenycqe.cn
ojohpnlgiajgnea.ru
jiyujaefxrapwyp.cn
fdfoajaajtwtggt.com
bofkooxjmwqfbpc.ru
qhwnykpbovwxekc.com
pctyfximjhjbuya.cn
ikpbpafguqsetyq.ru
rveljnlrebrfwgb.cn
uudntdaylsrmtib.com
imcspxjsmncjejd.ru
apvqxcvijueewul.com
ogwynwflobucuai.cn
gnvdqhhqsibfaax.ru
cqrdoudynxonrvp.cn
ujqhccabflyfrei.com
euwqoogdacjshcf.ru
tkgynnjlfytrjqm.com
yybrifghaetcvar.cn
akdekfmthpymsvf.ru
gnhqspioevywbgj.cn
fyerlcvvqhembjt.com
ligsuytjimraqgl.ru
quorpahotosbrqt.com
budveqrqhgcgrus.cn
llmfymialqgocvh.ru
ivkpniwiaartwsa.cn
yiwnkkjmqakwdhx.com
wqmacjhrmyxrutd.ru
icrhjpnqxmblbhb.com
egnnoimnkcsqgwd.cn
mqdvahgexyifnru.ru
atyoyqfuvkhslhw.cn
wrefokwrdxkwkhv.com
lmedbobsiyycnnb.ru
qojimbvxwedjksl.com
qvcuobfqfnjotry.cn
jdbhuqkkkrpujqc.ru
ttyvbtnanulfotd.cn
ypgrkvftxsagpfh.com
ugclewaolsublri.ru
xctaxyrlolfxbgu.com
sufpuwjgyeklvyn.cn
cgkyjnqvebwibep.ru
dyuplccuphuxplk.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 43 of 62

uftjrfktbaptvra.com
xldorhbvusdexfd.ru
pbnapirnvrrtsnd.com
neibgywnpfwinoi.cn
nhvymheoqmbxhrr.ru
acnyysxxdwiuoxm.cn
gmpdlnnoeaebpyp.com
iidusekofefebje.ru
cvnuwpysuxawwhc.com
adrvkxptajgukxg.cn
hcgsppgiihswkca.ru
srxvtmvonpddwjg.cn
thsiisscliofoyw.com
racfnestntxrqdc.ru
jlxyfjoblhbtgfu.com
joonbwdkwnsmquq.cn
uduwyammfxiwcah.ru
fnaktpcwfotoffn.cn
jgfnwbrygsrgcqv.com
lyjipqgvatsuogp.ru
bjtedattupifimd.com
icnbgjhgqutnfqu.cn
heihvrtmmikwbkr.ru
hlttrxoxbitkpij.cn
krcvryajincvjhq.com
lfjrqfymehxnvpm.ru
ceilwfssimwovwm.com
cgbxvyihkijnxdt.cn
cnittxhbhmftivl.ru
narasjeydddvoha.cn
ywkmhayhhcecnem.com
mriwxiaxtfkvrgo.ru
itltddbxhtbjlcl.com
klsxojtrvnfxrvb.cn
spspcywaafwputv.ru
ovkcfxnyenovqyt.cn
wiomdwwwpucmdpu.com
jrrpafgmcyebmpa.ru
bknddknwurhijts.com
dwkgucifeuyhrch.cn
virexyglgholqkn.ru
rwvtsjpfpvbjfed.cn
mbbdocsmxnkhgpw.com
sumubredcxmhgfe.ru
jwasamjfpxypplr.com
ctfdkahllnywbos.cn
nhanuoxaoaamuxp.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 44 of 62

mbhifpishvrkpad.cn
mmvasmgytxjvtbr.com
cepkpicfqsxnbmm.ru
pdrucdrpniwtufr.com
bbeelaxdyuromws.cn
hxntucebwblyhqa.ru
jnwikurtkocdfqq.cn
bxmphnskyvpvxrn.com
wvgsolxytuuvaka.ru
ruhkeetodffwpwf.com
bgmqouiwmqckmol.cn
cgqowqmmupekcgd.ru
xnksgaytcvgroli.cn
bjrurnmflipmcvc.com
olcougqfvmtonqa.ru
itnvgfcafcbljrh.com
kuqhibmddorxxia.cn
ohxutsoqiteuwni.ru
tkmqxpwwbpmuqrx.cn
vvpjaufxdxdamaq.com
ikqmrxdqubkbgjy.ru
hflnkqtraecrpmj.com
sflwmivnswlsspj.cn
bhsvjnmnbpnbitt.ru
bodxhdxmdhswjpn.cn
ehkkfnsoiqmxkgm.com
enrpsessngqnpyl.ru
wimxghdrehapwcc.com
vcyepklwfxuxbwk.cn
xfakqljxxavbpnn.ru
jsrbobrgyoxndcu.cn
jsbspckglrbyrkr.com
pupnpvlvturbixv.ru
escfjiunnyxfoht.com
nuhelqaabeqclfa.cn
jqbgniiqyepiavu.ru
apmturiybvhqetg.cn
wskhtjchntdnaxl.com
yqykdihdxuqawwd.ru
cmywoctgwltdoln.com
qwxvhhhmnapcfak.cn
djtyscqssdgcxfu.ru
labouhtpopraafx.cn
rarafiofkaapjyb.com
wdlvcsxsfkqjrht.ru
lwfhvjmxhuufvkx.com
jpyrsudpyamperh.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 45 of 62

tkddtdeqorpihdf.ru
rqvylowmrxxkdgy.cn
bvhmgsvojsmeqfc.com
vlunphswwbrunjj.ru
ffhvvqpgqcnjudr.com
ttbyywsyktvqspy.cn
daxkoxuwbwymhvn.ru
rmhwkotdnnoylvr.cn
qvxdioqwujvmqpm.com
quwdqfaidqhrcfo.ru
yiaurqxrolfpmjj.com
cypguqfdsenyukt.cn
fjbbiecmajlgymw.ru
kcilahyhpvfmvek.cn
pmaynpnkoqmmcpm.com
yomgxbkwrvwlqia.ru
xwirwhkbcvcavjl.com
kakmxljlrtmcond.cn
mxmpinsvyflnocr.ru
xgxiiwafrghmagl.cn
xktdtvvnkwfjnrp.com
jfptmqidnspvamf.ru
jrvvglrlisxtokn.com
utlnqwolvufmccw.cn
qesaceleubgkmri.ru
rvtpjweiltjyrnc.cn
npyurxerjvhxkfl.com
jdswxuymjrjnwgn.ru
mwofisrwbxwnhxq.com
dswtiognsrjbgox.cn
lpgjnbtcgfgaopd.ru
pgsuygiurhakcun.cn
mirgvmrwufrntdc.com
qwwlxmhrkbmpjnt.ru
qoyvokggjcwsync.com
agtteuqdyiyogbk.cn
pljruegguihgwdk.ru
tfnefbylngsyjfr.cn
hjdjjevlrafnqfw.com
qowpiwttvipejqy.ru
aiwdwadrqdryqvv.com
mclephhixqglxae.cn
ltqdmuqkddaghhc.ru
bitrpaxmsqgokyw.cn
ahiyngamqpeejtx.com
wkyvyhvunqwgmgt.ru
riycdwgvdwwtdnu.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 46 of 62

oxtomfoipilbtpn.cn
bamelrnolgxwsrl.ru
rwjcltptfyablvx.cn
lnnrpwtstcbmdhn.com
xuwjfmtbdknpyry.ru
inxoscqjqqjvnqp.com
synknaepmhpuwtp.cn
uqvnctbkmnqfvwi.ru
qccouxbjrkosgvk.cn
kaewulipnastptd.com
mtsnijrqkkadoec.ru
bmpfkgsottkswfh.com
yafhgpnkgckvdgj.cn
heivrlaivutrohd.ru
yjbieaivbikqhmp.cn
hxbgwylxlmffjxp.com
oniyartsuhjkuyu.ru
eqhrternbgeiqmv.com
qudxpqcqsgujbhs.cn
dnlbedcsgfjinvt.ru
ouoyumusyujheor.cn
ctvwjwnhjhlkiux.com
klqaqtiiqvqbimw.ru
uiepagnqxchwiuy.com
deykclsdoqbpqqf.cn
dssvcmuwasgoocu.ru
nbocgwtxxkhegni.cn
xnsqwljdqslsybm.com
skrfuerskhgsdyl.ru
xbyvmteuefhclxr.com
spxawnystuourms.cn
vfrvavfscrqoapa.ru
ysihskwayqiayot.cn
rfkulugwaaiavnl.com
mtadrqkijcjkxgp.ru
xmpmxuyvrmvfkah.com
xqgncdiossylkpl.cn
hfimbtfpsiwcmde.ru
ufskexwjglrdtay.cn
tyahmbnowfeassn.com
hquvfwllrtpjnvx.ru
oqogaxohvmpniaa.com
ldwhrpqqkurdrnv.cn
xgvhefdcmikxofr.ru
xpkywctxtcxoxtm.cn
wacphvldihlrert.com
nusdxluvftfrkjk.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 47 of 62

pnjjyyjquwkrvrb.com
cpsdhnmqondlllr.cn
eljyuobnbnkljkp.ru
abivljtehikymfx.cn
ualoxpgjmjxwkpp.com
fnytlcrsviukqbj.ru
aeqponrhgasiemd.com
okqkommvkuldmyq.cn
iygpiblfarefmgo.ru
lvwwoecyqvfrjte.cn
hnlgeffcfxctasu.com
ukqwixkgtmvsfwa.ru
qdvmafunbyrergh.com
ovtbqbynfosiwot.cn
ynnceqjnafqjjrj.ru
joymxsninrcrcll.cn
chkglkcfkiimkwa.com
gpoojxjyjgqubeb.ru
vkkjmjemuxvhncm.com
rbuvahshhtixfjd.cn
rsbklnqmpabsdxa.ru
dejrxcotiwgdlte.cn
fyqocjretpcakug.com
msniauejingsaao.ru
udeudwmyvrlwplo.com
htqmsorfpxwyemc.cn
kkxxajfsfdfplkc.ru
ljfkbiiiymptplu.cn
tagypxecprqdbfn.com
wbgwmrswhwxcwkx.ru
blxacuifmgklrmp.com
jovxsdevvgptfey.cn
shuupbbfwcaygyg.ru
ymfteqotdvyvtog.cn
gbkvumsiaaidimg.com
bcatjjemqanspfg.ru
wgvsjuhhrxcsjli.com
fliihanfesboeej.cn
ryvmhsshmvcomgp.ru
pkaeggrclinelqg.cn
uqhfbckltoeyass.com
mwidejisrxepklj.ru
unjkltxvuusycvi.com
lqbmruyybsvftfn.cn
ohiwaegsycnotic.ru
ysuvsuxhrgtrlfm.cn
nidhwiuhmgrjfdq.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 48 of 62

xsyenrpmtnuxjur.ru
kidplmbgvuluaag.com
drcljmdxapulomt.cn
ctackwqinkrfugj.ru
quxaceahjppwgrx.cn
tbyxkyclmuewgwh.com
itoacqyihfkdkhm.ru
etwldwundwomfli.com
hwixieauctuakwi.cn
dhbcndtpqurbpyd.ru
fxdkpqnjhqqnupt.cn
ndhhidicebrdbys.com
aranfpalqugldgd.ru
fmdtcspmxacbutm.com
gjbfpfuwodjvfdj.cn
anhsuqkdakeaiur.ru
bbxglobwofglhpg.cn
qbvvellsuyqiqst.com
omeffvgmrmhadhg.ru
xdgusyvppuwewio.com
nuwvblhdxxfmekp.cn
eopbvltetfslbkn.ru
fnediurxjfmfhvl.cn
nllmqwdfqodeolf.com
eglrycoxoldkhos.ru
pdewbhkiholjjkn.com
hhsxmbbtmologyl.cn
ivkfxicfnhxwign.ru
qfgojmvsmtriapm.cn
jwtypxttgkxgkib.com
yovievfcfrpjsig.ru
omxrdkrsqncdjle.com
nkrbpyspnruwnuo.cn
okoufarxbwultjr.ru
dehsyenodrftkaj.cn
icimcdjucudffbr.com
jhqqvfmikuslykr.ru
nxbhjnnbagyncbe.com
rbsunvmbtipcujc.cn
dmkpheoqsfuvwxo.ru
wmlrmceqrrihhjg.cn
ycnbmrorcldwdpc.com
ysppldxbgrvfukb.ru
vfhtibjgdodvaeu.com
jvvltegvvqllpnc.cn
uqvmbmkmnijqaue.ru
coqenmtlhfweakv.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 49 of 62

onuanuhffjbsqbm.com
lmryiwxkakblkkd.ru
vneugtrknyfngos.com
ftdhrmkbiehcrwe.cn
lbijaqxhfqegiou.ru
kaijeakafbayhhf.cn
vdcsyoagpmolayc.com
vnkhfaiueysjprm.ru
ofpgldafgifivjr.com
jnttknndqhsbxrq.cn
egusnkbawrrmqvj.ru
thyesvueyqyjdak.cn
nejlqrdlrcpqxqa.com
gjbtsodgjqblmcu.ru
gawcwxndhnlnest.com
mxwbjhhuqjfadet.cn
ubixqreastoxkki.ru
prhprotjldkcdkw.cn
mhhklmfsyheabmo.com
cuqgckaomyovqkt.ru
irsqnrtvrnulasj.com
eokomnhxsqufhpt.cn
rkccxwrlqxvegji.ru
giflgpyoybrkxlb.cn
wplekgtpwqxhkiu.com
ahwcobmsjffvmar.ru
ljkeurdkbhbcnpy.com
anekoevrqvrnaro.cn
ffjpbxhthftrgfb.ru
xnntuqaauibibwv.cn
srrimwjtplqxpcl.com
yeiorxqggpdkwgr.ru
smqkvhdwkbbfmil.com
jfrpkkraehinxwi.cn
nrryptctfqdqaph.ru
hcilwmpodpjnjdq.cn
xkegjsghydeflng.com
ultsftcntlurpmo.ru
poecmcdnfmpqyoo.com
hwpshloyytqdfkx.cn
ajkkumutpbvwmnu.ru
vstdcydmycqngve.cn
yobcajybttpmqik.com
qhqjadkstomnvkk.ru
snlkvqhxjmfkjyd.com
lohdrgogelpkxxb.cn
jeuybpjaqcvbxoe.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 50 of 62

imouhdfimqejmtg.cn
vgghrdlqjvspvhq.com
axeheqrjvybyjsx.ru
psnnkrirmvibgru.com
mrdwiqgjfoctpbx.cn
gejlnmjwievrcle.ru
lycqxiacdiybcev.cn
uohvvxldlmmqtwv.com
sgkfhikallctycs.ru
vmkjsugiayohdlr.com
qenhnuiymmdcnyy.cn
lpmaloptkddmmpc.ru
xgxpqstuhgdmwja.cn
gfjwkiinckfvnut.com
mchbkrnshathtcg.ru
gtadbgtndryfbdq.com
hwehtxnheitrfmi.cn
klfuwqdrtgojsvx.ru
ymgvgfasqqnpjck.cn
ttvlewlqeixwvjr.com
svysbsmurpvwtxa.ru
qjtwxuqfiflawuw.com
sklykravgkpvcfk.cn
xbikmmvflgaeihq.ru
qrfmbnpbgugsgcu.cn
yyrmcmexidwhaaj.com
uxqxupmngjddayn.ru
lvgexkblrfusxey.com
qoveocxdhxmhppq.cn
yewlwqxegfofueq.ru
dskdippixfieoeh.cn
gbrjwucoqfycwbo.com
xkmddlaoixisuyi.ru
rfvfrxerhtamuwt.com
yavaaewapsuvpkw.cn
eaogarkiulwvqkf.ru
dsqunoillmcdoxj.cn
krguxcnjtgiffnx.com
fvhecirrypjiklv.ru
aphvvldptjxbgsg.com
aphjrqyelibfbiy.cn
ffwajhiiycnoncm.ru
vmwvoyserpyhtqc.cn
kayeqerdnowbeho.com
jbysuxgqvpbslbe.ru
rwryosuacapohkn.com
ketjhcufecyksyk.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 51 of 62

kemrnfjddolhvpv.ru
vpxgndvnlnnsxmq.cn
mwnpkedwloggrwd.com
lesbfbtbdddaraw.ru
kktfyhffboygfrv.com
ugowrrnvlsnrufd.cn
kfdighielasgcat.ru
ooxkkdmshtfdbrd.cn
tycmmlbtvuqgycr.com
imdpilojxfrmaje.ru
drlonepqaxbbblt.com
gkbslsbenwduqar.cn
ivoxdenxbfirjvw.ru
srvqqnlailsmcft.cn
uwvgwdwaahgmqrg.com
uwxkplkameogipr.ru
bjmikbcebyjiajh.com
tnwajvigiyamegh.cn
gmqpxcqdquhoeyb.ru
godwufnoymhxvvp.cn
dmnftllhsixnjkn.com
jweooplojjqukkb.ru
gketipnukrqlkjq.com
ujvgbcynqvjktku.cn
pofbwypclnxessq.ru
kqeevuebrlilnvl.cn
dxhwgoxfbumjrnt.com
pbqftskkdpafhwm.ru
jkjfejrtyvfmjcm.com
kbrynpphwjoggbi.cn
hiofqijxkyjdnrg.ru
lysewrbftcamylc.cn
aksxqdqljsdsywe.com
cviuvbhhchvcbnx.ru
lycalcsldsefynv.com
qlntlfolppxwlxa.cn
dpepbyxwwdhxerg.ru
wlyaurxwwcpmbms.cn
jskfljawdtevnnl.com
louvudcpvictngt.ru
suaxtqrksgchcwn.com
invgonfgclevfvp.cn
oycdwjjyoysfqeh.ru
yllohjknjroemwo.cn
qglrxmiupcesvdp.com
bhstsmqykaoqslc.ru
jtnmybraaiscerf.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 52 of 62

snwjcifkilqkgrb.cn
mpumnbeqvvwwdoo.ru
cwsvwcjblfrmlwe.cn
imlueusvwsqkorx.com
vbrhpoogaxrlsbj.ru
kjktgowyjpwqsop.com
vavahbmvitpywtk.cn
sibnaidxlsawdul.ru
jawharaaucnhvbl.cn
jblsycuvgfhofbn.com
livxufbvrrfhojo.ru
ywtnsinipoqrtrv.com
jcnslkruwtqifvg.cn
mtjsvrlkfvgybsh.ru
wwefjuqcelkbllg.cn
gwhpnfdfwosyseu.com
eyfukoxmkmmhuin.ru
wdqcjaolqwoypvu.com
djpfeisbctohidh.cn
niawjsysgtwcdwl.ru
axxtuijvrggusbl.cn
fxfalwypxibyhfa.com
djubiuwyeqbhrmc.ru
ilflhdcyhkrgagu.com
bnhxqyaromcrpxu.cn
byqxjoqgyvmiujx.ru
ptokfjafudwymel.cn
yyajsnjrqsvpcwj.com
ahpmjkmbpkwaxla.ru
cxyoxwtieqhtugy.com
vusempmflextugq.cn
xwppsxlcxcslbhp.ru
wvpuhhnkofutdgr.cn
qswkgxgfuoaafer.com
iijmfmmecrfppuq.ru
ewnhlxayyasbxlj.com
lmaqoqjleypsipq.cn
iurmewpaixanrbc.ru
qqtsbuwtionvduh.cn
mpnpxmjwaqbfwgc.com
rotixicxnhtrile.ru
wujqilfwradhkfm.com
cffdhjivgwgxoio.cn
pawdpysfhntxopx.ru
umcdwrqxrrrljkq.cn
vjwglxgfpwklloi.com
nhdwrmvhsrfouum.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 53 of 62

wocqeupbnyglyqy.com
iouqfidrvhjtojj.cn
mpjxffasubdgvyv.ru
vpequhofgnegsna.cn
ubvxodutprbmpaf.com
ndfyqcjamlsgyoa.ru
ymacvotkvebbxoq.com
dhgjomvybhyorfc.cn
gidvapccvvlmcvb.ru
lgjbgggbdnwtqii.cn
ariwdxibmqcxlbt.com
cdwnkpbfmtkvpgl.ru
xmtbvrcaybjexgo.com
sacpiasuhmlksrq.cn
pdqvwjdjvxxkvor.ru
hgygpujjdxinutk.cn
fnldugwukayjrif.com
abqmbwnsltqrxge.ru
svtuhceqtucxpjs.com
yohjeyufjhmmqff.cn
hsbxuxcgbaqmwwa.ru
udstrfqdvyfpfat.cn
okmqovbevdshrsl.com
ybkbnhmbrqqywmq.ru
xiijsihhsybevmf.com
tgiovhdtcxnhspa.cn
dcmatyhtgqucqlg.ru
qqwscbqhxhgomhp.cn
ycrautpmqxcwvjx.com
abuyvxmvevjqdie.ru
cnacpeflfclwdwa.com
vlkagekhmybtcvu.cn
sjqbpacqlsvikqw.ru
aqoxitqxsrfdxhh.cn
wervofbudbgydmx.com
phbbohvjpdjmvsv.ru
egtfwvqpsbftiqa.com
pfdljbpmpepjaby.cn
cjhxukevdnejcjg.ru
jvkfvbokmapaobx.cn
cixaviwqjomfkun.com
xdhvougdfybggkx.ru
slujlggxqkcwxuq.com
hotiysgxoqhwgbd.cn
ykwqlnhejrbnyng.ru
cmcoshcyowfjtuc.cn
wcdsolyaxomvmjf.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 54 of 62

nhbdmddwrllcfsi.ru
qtrowsuxeikobjp.com
xtvoynvjjpdmvbt.cn
nlpwdbsakpqhlss.ru
qvmpblesqcyposy.cn
ckqnqtyilbomabf.com
ackddoceceviupn.ru
tnolychicxnajsj.com
ykbdbfmeromwewm.cn
jgqqsfrkxrangri.ru
eomwshqgmxqdyyf.cn
brxgetebqchavyf.com
ntpcakrkwoxklyy.ru
npytmyoluqbusxt.com
qbtaylolelgydal.cn
xyfrycveytlsqgd.ru
anoibynldnpdmgu.cn
qioinnfcccciqml.com
hbaslltkyptgjuq.ru
vfsboacfetskcad.com
arethubvybffyjj.cn
abjokehvdhxfaub.ru
lpkbiosgxpngnot.cn
rgjljbyhksffwdm.com
jxjdrmlcrlgoain.ru
ifgrtdetlsaamma.com
hcuxlpvqnfjilkc.cn
eedjiskdrhmdlnf.ru
iawbqxvakkbuyyh.cn
ihlieqonsxmomcd.com
eswejveljmfnpbs.ru
gghhmlfuqffokdr.com
elnjophrqpvdkrm.cn
lqvcyjyuecncaof.ru
ydfeeeahmtlptmp.cn
tbbqsuuydilnokv.com
ndhqamuvxbysugi.ru
smehfveengreisb.com
uvwpbiebxqugxlh.cn
fyaywquolnaijsq.ru
eodisglugpjgsob.cn
uqrjskvyomqikow.com
fxbmnfgfwyfskvm.ru
fgdkjgqesgmjoub.com
fdusnrcucpbdhpd.cn
qgaafhclxdyofsb.ru
lpmvrglihcikjpt.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 55 of 62

rjfdxyigsmecjuj.com
xdpxmxdjpuhnkfu.ru
uayebvonqtrekbo.com
skkqukefosipfno.cn
vwdneesevcqgmbn.ru
ilknxcgshkfkotg.cn
chykcodlxuqmqyr.com
rsgshunlgbgjswa.ru
srneaygnvxyoaxo.com
gqdtmxibgldfmqt.cn
tpqlojcfohqjgkl.ru
iqavohvublkqivi.cn
qetqjlvqlbjyfkx.com
dvdtlpkeylbhwiv.ru
uupwfgohkegvkis.com
kvuxjbbrkgevquq.cn
vqmbdkpqhlwmpky.ru
lhbvioolmlyahhl.cn
aoycnjpsgrilxur.com
xbqtflvliyposxx.ru
vertosjyocjpnun.com
elnldorqxtdhdfk.cn
ungfajcjxsbtbqe.ru
dxpttfpovphhwjp.cn
emiqdgukgnaqvkd.com
dxqdtafvldcbwbj.ru
xfjwcfdwskqojof.com
rcofhhkonqyiskn.cn
avxkystxmiufgjb.ru
cqadckqdbwacjof.cn
dtydedgqmgfvhjc.com
abrogfemvrpmqlf.ru
esiolbgxxtqoqyi.com
kjhydpjvymndhif.cn
dmtsapgopieksdy.ru
bgmqabqtpfubgbp.cn
lwdegehhdpixixn.com
xsedhwjcenjwfpc.ru
rkyebpixyrtivoa.com
gorpubwdrxmuepd.cn
ebhprklyvccrnds.ru
tygfaerbmoetwhy.cn
kyrmfgfxjrwiubm.com
yqgrdvgopenxqtb.ru
elconsvbsaphsxm.com
rdpxvfwdcleuovy.cn
xkmvwyjwqeumcvw.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 56 of 62

xrhiybtaoktyppm.cn
pjabybmqjvlbjbp.com
yjtkfdsolgdmpwk.ru
hltfpjlrmgivomx.com
cmeqnbdnwuuqbak.cn
lgxeonqtdlcprfg.ru
tgasbdqveabyeal.cn
uotwpjtxodigsof.com
vyltabhgqmlfwgb.ru
fbphqmsnjmibhro.com
tfrjfxjtdidoflb.cn
voivqvrrwagubjp.ru
odritbcjlxuortn.cn
qqwyodxlpqovqaa.com
rdjodwmhkuqtrxt.ru
srgyhsmifjrckkt.com
pdveppjojfjjkfb.cn
finflscoixxdmts.ru
jjbvaojkqugrvrv.cn
wiaynymrrammomc.com
sonrdtyaajbpvqo.ru
yrhbsjscypdrgve.com
jbfbfsabuouicef.cn
xboiicxyxrxyvlw.ru
cncxpyqekiapnaq.cn
jgotdpwyyxvrwig.com
dfipojcjrlfexsu.ru
ccarslklosnigqn.com
drlwspsiwlwxaqg.cn
bpuukdshgebsvri.ru
wbbbjhsuxcvxixj.cn
hkxksxsdsrovhbh.com
exvbikmoshowtxk.ru
aenwlgjmgssrdqq.com
imfkqexptrthtkv.cn
hdbdicsgkssmfnw.ru
mncvffuvbhnkxfr.cn
rvsctxyjtefudvi.com
rbrdvdfwsjutrtj.ru
mofwynkgfqnmogl.com
hjkwgpqsyrpcncq.cn
jsqcwohqrioelol.ru
nxbpdrjvedygoss.cn
hdexytfkocrbtxm.com
vdfcdnbsjneyney.ru
roabfoimxieleok.com
ypybcufwprqhmst.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 57 of 62

ingcwarosbruwwd.ru
ctovacsppfxekmp.cn
ewdmrjxyqkiabor.com
mjiyaomaxrhkulm.ru
wbksngotsmqaebu.com
tjjiohwyysveywk.cn
olkyuuprspfuceh.ru
vemvbetaoahdtkf.cn
isydpjklrkvimjm.com
nwrvbhfukfqlfqc.ru
ottrghukicssdll.com
kkoudpflctwxpru.cn
jtshpirfvbfkrru.ru
oolerbvsagmkdvb.cn
lkrsixhcvtavkel.com
mcfaeiftyenjrwl.ru
goosuuwoqtxlncv.com
eteggipxvarqvcx.cn
gvidfkulycniaip.ru
whvdrubfwaliorc.cn
wkkkplgpynomkpe.com
cjtrkebtmhumqii.ru
upfwwfkehtmwbrg.com
beaolwvgijvycxb.cn
glatpucckyfadye.ru
idnlsvoopmolecq.cn
dcffsdfvgiabgbc.com
tmgftdsljayiief.ru
hbpdygpqsmobunq.com
krhjpesftsonewh.cn
kwfkliquvcsgfmi.ru
ifbpvmtsmdfoaqf.cn
drqrlvjfldttnbj.com
teheeyiexcxyprc.ru
cwtlvfttsdkafdx.com
vuqyuxfxbrbmxvj.cn
ocdcwjnhwtdyouv.ru
wygmlkpuddsqqeb.cn
sauyvxbxbevvrdc.com
odupwjtcxlepyqj.ru
bsrjvxishfxxiui.com
xylrfggefdhxbpk.cn
goompwsqyrsmpcq.ru
yviwpelubuwiqdr.cn
tqujoohyveamxtr.com
vgnhpbvyfemejct.ru
cfbeegbsqhockhh.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 58 of 62

ddwuicyulopnwie.cn
teniknkcdfayntv.ru
jirlfljshfyknxn.cn
awjbreptpqrgfxc.com
ttrtbhpngdyppco.ru
owuddgyplnfyuvy.com
ipnvicxhllpsscb.cn
bljrqbuodcefsgg.ru
mjohslntcfetrnp.cn
subwoonxriklbcy.com
npajtiulqcqptcp.ru
alaqrymbgscbupu.com
vebkukusyirjttv.cn
ldegfaqyuwboqwk.ru
kpughxusvhnuesa.cn
nmrmsbujehctdeh.com
jkdqeluavgnnuyf.ru
ylhovncsvjilobi.com
dsaqcvyevjyskgf.cn
bmaketvexknvsbn.ru
kqgbwkstxniuowm.cn
atpfktawilygcla.com
ufssgmjsmjyowah.ru
tpqyfuuhvyogsof.com
xgloxtluqqmmrxm.cn
mmpurstlmlofffg.ru
oavbveucikrleln.cn
kmmcdwkgubwrkvw.com
evpjdirrcophrid.ru
jwmeahbtcstihxp.com
hhjhghrtodmylpc.cn
xbixsaxlvqvwwbf.ru
gdilojgksgesdbd.cn
oeoskxfehfucimi.com
vyhvepgntidqvys.ru
tanorafjtajykpx.com
dogfsscrataocov.cn
oaejnrtgxtnnjil.ru
pdvotrlklhcakbs.cn
cenfqfgxvcbpotr.com
fetpvmonhrklifb.ru
baxkhsmtetiawrr.com
upvacoibigjjpyk.cn
blwktvggsmbmayq.ru
nhdstrtdnwcwkhm.cn
lrbtqxdmtwhrxle.com
lrygcistkurvfvp.ru
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 59 of 62

yawnrobjorctcqg.com
buatigdjhpaurht.cn
luhbrtabueogpef.ru
aoybmqukbbyqcjp.cn
jbswukaqhoeaioj.com
kdrhtteyfleutyq.ru
wpxwtdqlxqeataj.com
fyrughjhllslovv.cn
rnayepmwiunlyrm.ru
gpweqfxunhlmtgx.cn
hsmxiqvoiijtayr.com
mwjaxydhoexrjyq.ru
ajtphuhnlcuvjbq.com
ieysddhrghwqnem.cn
yqadvxtcaoomfne.ru
pnjwqxmjbeohcbu.cn
dqujuccmckmpmpg.com
kariujsfgdocdox.ru
wliifqojvddxeik.com
ewleehcpfyydswu.cn
narlyrohtnrmthp.ru
hvgqjgkwugjqkig.cn
onuscmkhfrilish.com
nbfpyrcrvmgiljg.ru
xpkogssnkjyjnep.com
ffvxdkphbkhndty.cn
jwcxsijoyhievto.ru
xcyjnqkbbpegaji.cn
lkbkepmdfhnfryv.com
tsqccfroccanics.ru
tsstdjjtnhnuvpr.com
itbdwtmtoumslcm.cn
vyupwkrconaqjff.ru
uwejetklsmmifbn.cn
mdsvavtebswlfyv.com
pijgngpcmxvyvdb.ru
pimghpkweyawjch.com
qaarisivivypivd.cn
cbrarfjxpyltalb.ru
yoymrubhmxpubme.cn
dxrpjvurhgifouv.com
qtlvhfxobnjcbio.ru
keucqpkqlyycans.com
kchhxkfxrwamgqf.cn
uohyqmgpgckqtjk.ru
ylswtbbqwftujbb.cn
ierpdtrfifslpwo.com
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 60 of 62

dfmwtulrioceoev.ru
mmjpfoqjfmtyirq.com
qevbeuiegarvjsk.cn
puiwlmgemkosjre.ru
beltapyttyrmbll.cn
fapvkscxurbhbml.com
tubsovpxrguaehq.ru
ipbmedqiueakrpa.com
ocnkirqxwlfnjgb.cn
wbaxodbutxfheqy.ru
myrpledycyxoxma.cn
mvpguvtdlkkcqrw.com
iuglewsxdxtypdb.ru
uedyfhictiaeqiy.com
oaucwtyydncadvj.cn
ngkqtdfwdidsbgw.ru
ouojtejqonvhkvi.cn
tkxnpvwoyenrdjx.com
nwuatybejfmrvsn.ru
yftfwxmebmdoveu.com
kvugsfxknvdbcge.cn
ytnhlrxptdxivum.ru
ligbibqbndingpc.cn
cwmklceidlfsbuf.com
tnlatgijooiliqg.ru
egwrngbeixlnjaf.com
cubputikmxqupyt.cn
vffgbcxicxafyfy.ru
gytbfrbixfjpnpl.cn
jrcugvvawkmkyyw.com
yhsqhehjnsveayu.ru
flqvnrjrgdkekcd.com
oiitvayptapelvp.cn
aojacbcaoloqmww.ru
qcaomwbxwuqrife.cn
mxfcoicvmlbprqd.com
ucdeadyegprewuj.ru
jvowpfvfarsgtwl.com
aacwkoibblgtgxi.cn
yqeslhwpvheysmf.ru
ewaxkcsigvuxxhj.cn
dwqbbtonbjoqiqp.com
trqecilbapxgxpk.ru
ejjujfqskttvlfq.com
nsnffpxvcxwvsqd.cn
vdmnpbfylttfvbc.ru
ajfcredldvrmemg.cn
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 61 of 62

asahoqougtvgqjy.com
hyrxfqlnntfirxk.ru
judemedpohduvaj.com
bnsrtfxoyfeuxvh.cn
botwmdtnoeoplog.ru
fwuqlwbljcjkfnb.cn
dwccaomocwmsnwx.com
okwkvjawvcqdxtj.ru
yqdkuwcfkpebajf.com
lenlfyrrkuhonqw.cn
yrsfwckvlegfehc.ru
dhgmgbbjynidolw.cn
rtoorginnbpimkb.com
pwlgltftkcnxare.ru
ywoybsicgyilreq.com
rmkvivyskxoamth.cn
gdrbjtqgmwpvghg.ru
qbmdpqadqqxwrvx.cn
hjkbomefqvcoxyj.com
iudubocosabncaw.ru
qghnymshrphvupx.com
fgoojtgeotggwrk.cn
cgavxyvxbsxgjhb.ru
mgrxuodshwybknh.cn
dafodwmftctprdb.com
bmunrasbrqlqqxb.ru
hfkhlwbbomjopyk.com
feyhbtqtbiwetjm.cn
ksslvaotocfldln.ru
xffqslcosfmqbiw.cn
References
1:https://twitter.com/malwrhunterteam/status/1364710504044908555
2:https://github.com/MichaelRocks/paranoid
Source: https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9
Page 62 of 62

More importantly file we can see one of the that it is encoded filenames we in some previously way: found is rather interesting ‘Cqse.json’, after looking at the
00000000: a227 bd12 3274 4d7f 75ef 9a2d a878 f689 .'..2tM.u..-.x..
00000010: 5b5d 9986 d3f6 238c 0d93 1300 dc40 4fd7 []....#......@O.
00000020: be1d 7e7a 58bc 0936 cdef b389 6eb1 0ffa ..~zX..6....n...
00000030: 641f 8f1b 5a3e e4bf 7a18 41f4 bf3e 30bf d...Z>..z.A..>0.
00000040: 049a e319 ecf4 c6eb 657e a133 ae57 26e1 ........e~.3.W&.
00000050: ea6a 5da7 98bf 01a6 f666 68fa 22d2 6810 .j]......fh.".h.
00000060: 1e0d c6ac e350 6553 f9c7 b9f0 4d35 aeb0 .....PeS....M5..
00000070: b1d1 0967 f02c 3b1c 6c87 b899 07ca 6e9c ...g.,;.l.....n.
00000080: ab8d aa5f 2636 260f 046c 47c1 dee4 3fb1 ..._&6&..lG...?.
00000090: b48f aabc 8f22 e4e9 5824 43db 545d 167f ....."..X$C.T]..
000000a0: 2c02 8a7d 6316 6bc2 a9b0 02db 83d0 58ab ,..}c.k.......X.
000000b0: 2234 2bf6 b7b4 1b21 890d 685e 2e46 88e2 "4+....!..h^.F..
000000c0: 39c1 c726 9643 df54 bd25 f788 50e4 ea2b 9..&.C.T.%..P..+
000000d0: 22c5 800e cef4 0f1b a127 b077 634a e184 "........'.wcJ..
000000e0: 6907 8bbf 4347 1637 9b69 619d d99a 40da i...CG.7.ia...@.
000000f0: 94eb b771 9574 fd3d 2f63 52ef 0bb4 ea2e ...q.t.=/cR.....
00000100: 9cdf 2c31 9157 8ecb 2dcf 960c f6b2 7579 ..,1.W..-.....uy
    Page 5 of 62