Android.BankBot.15307

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.BankBot.748.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com:80
TCP(TLS/1.0) ipv6dow####.c####.q####.####.net:443
TCP(TLS/1.0) c####.a####.cn:443
TCP(TLS/1.0) h5hosti####.dban####.ru.####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) d####.qupe####.cn:443
TCP(TLS/1.0) grs-dba####.ap####.dbank####.cn:443
TCP(TLS/1.0) gtc.g####.net:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) g####.vo####.com.####.com:443
TCP(TLS/1.0) store####.his####.dbankc####.####.net:443
TCP(TLS/1.0) d####.g####.com.####.com:443
TCP(TLS/1.0) alog-de####.u####.com:443
TCP(TLS/1.0) errne####.u####.com.####.com:443
TCP(TLS/1.0) pri####.qupe####.com:443
TCP(TLS/1.0) ch####.qupe####.com:443
TCP(TLS/1.0) sdk-####.g####.com.####.cn:443
TCP(TLS/1.0) gmscomp####.google####.com:443
TCP(TLS/1.0) rr6---s####.g####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) s####.cl####.com:443
TCP(TLS/1.0) 2####.239.38.223:443
TCP(TLS/1.0) sy.c####.cn:443
TCP(TLS/1.0) g####.face####.com:443
TCP(TLS/1.0) 2####.239.36.223:443
TCP(TLS/1.0) 2####.239.32.223:443
TCP(TLS/1.0) sdk-ope####.g####.com:443
TCP(TLS/1.2) 1####.250.74.68:443
TCP(TLS/1.2) and####.a####.go####.com:443
TCP(TLS/1.2) f####.gst####.com:443
TCP(TLS/1.2) gmscomp####.google####.com:443
TCP cm-10####.g####.com:5226
TCP sdk.o####.t####.####.com:5224
UDP 2####.239.32.223:443
TCP ipv6dow####.c####.q####.####.net:443

DNS requests:

and####.a####.go####.com
and####.google####.com
b####.ge####.com
c####.a####.cn
c####.g####.net
c-h####.g####.com
cdn-sdk####.g####.com
cdn.qupe####.cn
ch####.qupe####.com
cm-10####.g####.com
d####.g####.com
d####.qupe####.cn
errne####.u####.com
f####.gst####.com
g####.face####.com
g####.vo####.com
gmscomp####.google####.com
grs.dbankc####.com
gtc.g####.net
h5hosti####.dban####.ru
i####.me
peiyi####.qupe####.cn
pri####.qupe####.com
rr6---s####.g####.com
rr9---s####.g####.com
s####.cl####.com
sdk-####.g####.com
sdk-ope####.g####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
store####.his####.dbankc####.com
sy.c####.cn
u####.u####.com
ucc.u####.com
ut####.u####.com

HTTP GET requests:

c####.a####.cn:443/api/addr.ht
cdn-sdk####.g####.com/tdata_Ucv167
cdn-sdk####.g####.com/tdata_gtU529
ch####.qupe####.com:443/advert/batchLists?timestamp=####&uid=####&sign=#...
ch####.qupe####.com:443/basic/abTest?uid=####&timestamp=####&sign=####&a...
ch####.qupe####.com:443/basic/getConfig?uid=####&timestamp=####&sign=###...
ch####.qupe####.com:443/basic/getHotPatch?timestamp=####&uid=####&sign=#...
ch####.qupe####.com:443/basic/getVersion?timestamp=####&uid=####&sign=##...
ch####.qupe####.com:443/home/index?dif_level=####&sign=####&cache_sdk_re...
d####.g####.com.####.com:443/file/2c58adf4-1c3b-4b04-8493-dd949943f5ed
d####.qupe####.cn:443/config/Android.conf
g####.vo####.com.####.com:443/service/2/app_alert_check/?aid=####&tt_inf...
h5hosti####.dban####.ru.####.com:443/cch5/HMS/core/sdk/install.json?coun...
ipv6dow####.c####.q####.####.net:443/2024-10-17/6710862d9e605.png
ipv6dow####.c####.q####.####.net:443/2024-10-17/67108656dacd5.png
ipv6dow####.c####.q####.####.net:443/2024-10-17/671086834f68c.png
ipv6dow####.c####.q####.####.net:443/2024-10-17/671086bcc291d.png
ipv6dow####.c####.q####.####.net:443/2024-10-17/671086d7539b2.png
sdk-ope####.g####.com/api/addr.htm

HTTP POST requests:

alog-de####.u####.com:443/unify_logs
alog-de####.u####.com:443/zcfg
c####.a####.cn:443/api.php?format=####&t=####
ch####.qupe####.com:443/basic/androidVersionInstall
ch####.qupe####.com:443/user/guestLogin
ch####.qupe####.com:443/user/isAllowGuestLogin
ch####.qupe####.com:443/user/userPushinfo
d####.qupe####.cn:443/sa?project=####
errne####.u####.com.####.com:443/apm_cc
g####.vo####.com.####.com:443/service/2/device_register/?aid=####&tt_inf...
g####.vo####.com.####.com:443/service/2/log_settings/?device_platform=####
grs-dba####.ap####.dbank####.cn:443/grs/2.0/router?issue_country=####&pa...
gtc.g####.net:443/cidserver/getcid
na61-####.wagbr####.ali####.####.com:443/v2/inn/fetch
new-####.u####.com:443/anti/postZdata
s####.cl####.com:443//log/fdr/v3
sdk-ope####.g####.com:443/api.php?format=####&t=####
store####.his####.dbankc####.####.net:443/hwmarket/api/clientApi
sy.c####.cn:443/flash/thin/accountInit/v3

File system changes:

Creates the following files:

/data/data/####/.dmpvedpogjhejs.cfg
/data/data/####/.imprint
/data/data/####/036c5ac41b1b2fbc53a162d4ea161a2d
/data/data/####/0b73c1da6404c7d926b772809eb3374b
/data/data/####/1742371719
/data/data/####/20002427@bd_tea_agent.db-journal
/data/data/####/34e2bc49ca6b
/data/data/####/48071b34c2a2d2c1_0
/data/data/####/4a3acb86384d5417d760c15f825fd660
/data/data/####/62ab294900370243c40a2ed916f6f545
/data/data/####/711eb15a4a70b5222585ab0af7a060ad
/data/data/####/7633ea4ba689f5ee_0
/data/data/####/7886e5ea27332fd1f472efbc46bfd14e728c5c5a3910b41...e743.0
/data/data/####/793762c0
/data/data/####/8473a626
/data/data/####/9289bad798521741e1cf458c0ab9f676
/data/data/####/938b547ecb726b091fb36bb1933317a1d5f9c540550bf49...a847.0
/data/data/####/99c6841a9c3cfe71ece4e44663f74632
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/AppEventsLogger.persistedevents (deleted)
/data/data/####/Cookies-journal
/data/data/####/KLATIA0UDEWOHSI0MOC.ss
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/SP_AROUTER_CACHE.xml.bak
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzY1MGU4NGU4YjJmNmZhMDBiYTU4MzhiNA.sp
/data/data/####/Y29uZmlnXzY1MGU4NGU4YjJmNmZhMDBiYTU4MzhiNA.sp.bak
/data/data/####/ZzxCache.xml
/data/data/####/_global_cache.xml
/data/data/####/a0d719ecfdbb785fc7a4b8e4fc8b7aba6466bd9c02ae339....0.tmp
/data/data/####/a0eee88da811f3232dc9ab259df9777fdd07d926e2d338d....0.tmp
/data/data/####/ab17c6b4993dd87668bc46d2f42b208dbb25dc4cd99ff1b....0.tmp
/data/data/####/acf5fe1bf40a3192403fb1b9389176b5f7fb17f49e7244f...bf11.0
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/applog_stats_20002427.xml
/data/data/####/bdtracker_dr_migrate_detector.xml
/data/data/####/be81c33673f703e49c98804a8ce7086b
/data/data/####/ca167a2763ffb11f237e77e9a462cc01c770e4118fb8cb1...f907.0
/data/data/####/ccg_sp_config_file.xml
/data/data/####/cf5676b63715be48a8b2fa130a85f83db81db0d99258f53...6776.0
/data/data/####/cg.db-journal
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.ishowedu.aitalk-guard.properties
/data/data/####/com.ishowedu.aitalk_preferences.xml
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/ct_account_api_sdk.xml
/data/data/####/dcbdc532e7528185662706a4dc15a6c7
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/dim.db-journal
/data/data/####/edf5660ae94a0e0db6ffb04ac49bca16112f9a6bad6af91....0.tmp
/data/data/####/edf5660ae94a0e0db6ffb04ac49bca16112f9a6bad6af91...0225.0
/data/data/####/efs_launch.xml
/data/data/####/efsid
/data/data/####/efsid4325
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f70aa3b828563ca20b2286373c885d9a22aa9b6b82f5e03...5076.0
/data/data/####/file_home_data.xml
/data/data/####/file_setting.xml
/data/data/####/gc_plugin.xml
/data/data/####/getui_sp.xml
/data/data/####/grp.prop
/data/data/####/gtc3.db-journal
/data/data/####/header_custom_20002427.xml
/data/data/####/header_custom_20002427.xml.bak
/data/data/####/hihonor_gcjointsdk_20005301.apk_temp
/data/data/####/i==1.2.0&&6.3.1_1742371765449_dW5pZnlfbG9ncw==;.log
/data/data/####/image_opt_table.xml
/data/data/####/index
/data/data/####/itconfig.sp
/data/data/####/itconfig.sp.bak
/data/data/####/journal
/data/data/####/last_sp_session_20002427.xml
/data/data/####/last_sp_session_20002427.xml.bak
/data/data/####/logan.mmap2
/data/data/####/login_sdk_235.db
/data/data/####/login_sdk_235.db-journal
/data/data/####/master.db-journal
/data/data/####/metrics_guid
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/proc_auxv
/data/data/####/pushg3.db-journal
/data/data/####/pushsdk.db
/data/data/####/pushsdk.db-journal
/data/data/####/pushwgs.db-journal
/data/data/####/sendlock
/data/data/####/sensorsdata-journal
/data/data/####/sensorsdata.xml
/data/data/####/shanyan_share_data.xml
/data/data/####/shanyan_share_data.xml.bak
/data/data/####/snssdk_openudid.xml
/data/data/####/snssdk_openudid.xml.bak
/data/data/####/sp_name_bd_convert_click_id.xml
/data/data/####/ss_app_config.xml
/data/data/####/ssoconfigs.xml
/data/data/####/stub.dex
/data/data/####/stub.odex
/data/data/####/stub.odex.flock (deleted)
/data/data/####/t==9.6.5&&6.3.1_1742371760297_dW5pZnlfbG9ncw==;.log
/data/data/####/tdata_Ucv167
/data/data/####/tdata_Ucv167.dex
/data/data/####/tdata_Ucv167.dex.flock (deleted)
/data/data/####/tdata_Ucv167.jar
/data/data/####/tdata_gtU529
/data/data/####/tdata_gtU529.dex
/data/data/####/tdata_gtU529.dex.flock (deleted)
/data/data/####/tdata_gtU529.jar
/data/data/####/the-real-index
/data/data/####/ttnet_tnc_config.xml
/data/data/####/ttnet_tnc_config.xml.bak (deleted)
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/ug_install_settings_pref.xml
/data/data/####/um_policy_grant.xml
/data/data/####/um_session_id.xml
/data/data/####/um_umcrash.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/ver
/data/data/####/version
/data/data/####/z==1.2.0&&6.3.1_1742371758193_emNmZw==;.log
/data/media/####/1742331600000
/data/media/####/mmkv.default
/data/media/####/mmkv.default.crc
/data/media/####/uuid.txt
/data/misc/####/primary.prof
/data/user_de/####/DeviceSessionUpdateSDK_V1.xml
/data/user_de/####/aegis.xml
/data/user_de/####/grs_move2DE_records.xml
/data/user_de/####/move_to_de_records.xml
/data/user_de/####/share_pre_grs_conf_com.ishowedu.aitalk.xml
/data/user_de/####/share_pre_grs_services_com.ishowedu.aitalk.xml

Miscellaneous:

Executes the following shell scripts:

app_process /system/bin com.android.commands.pm.Pm list packages
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.letv.release.version
getprop ro.miui.ui.version.code
getprop ro.miui.ui.version.name
getprop ro.product.brand
getprop ro.product.model
getprop ro.smartisan.version
getprop ro.system.build.id
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
ls -l /system/bin/su
ls /
ls /sys/class/thermal
pm list packages
sh -c type su

Loads the following dynamic libraries:

libEncryptorP
libcrashsdk
libflutter
liblogan
libmmkv
libmsaoaidsec
libnesec-x86
libqcloud_asr_realtime
libspeechengine
libsscronet
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
RC4
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7PADDING
AES-CBC-PKCS7Padding
AES-CFB-NOPADDING
AES-CFB-NoPadding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about running apps.

Displays its own windows over windows of other apps.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней