Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.Ermac.6.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) as####.pro:80
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) dl.go####.com:443
- TCP(TLS/1.0) content####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) acco####.go####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) clients####.google####.com:443
- UDP acco####.go####.com:443
- UDP clients####.google####.com:443
DNS requests:
- acco####.go####.com
- acco####.you####.com
- as####.pro
- clients####.google####.com
- content####.google####.com
- dl.go####.com
- ed####.me.g####.com
- f####.gst####.com
- it####.live
- nd####.live
- p####.go####.com
- rjv####.pro
- up####.google####.com
- www.gst####.com
HTTP GET requests:
- as####.pro/socket.io/?EIO=####&transport=####
HTTP POST requests:
- as####.pro/php/1agu8.php/
- as####.pro/php/e6oi.php/
- as####.pro/php/k6x9hxhfow5ky27.php/
- as####.pro/php/m970yec1nbaqnq.php/
- as####.pro/php/olzun7fqzbq.php/
- as####.pro/php/pos.php/
- as####.pro/php/ri8eb8wjaczk.php/
- as####.pro/php/sncqjn.php/
- as####.pro/php/uxjdxos56zd.php/
- as####.pro/php/ykzbz.php/
- as####.pro/php/zt9chtbvcabb7jjc.php/
File system changes:
Creates the following files:
- /com.pojasecifufoyugi.budofo/app_webview/####/000003.log
- /com.pojasecifufoyugi.budofo/app_webview/####/Cookies
- /com.pojasecifufoyugi.budofo/app_webview/####/LOCK
- /com.pojasecifufoyugi.budofo/app_webview/####/LOG
- /com.pojasecifufoyugi.budofo/app_webview/####/MANIFEST-000001
- /com.pojasecifufoyugi.budofo/app_webview/####/Web Data
- /com.pojasecifufoyugi.budofo/app_webview/####/Web Data-journal
- /com.pojasecifufoyugi.budofo/app_webview/webview_data.lock
- /com.pojasecifufoyugi.budofo/cache/####/93d72e2c7c2310a3_0
- /com.pojasecifufoyugi.budofo/no_backup/androidx.work.workdb
- /com.pojasecifufoyugi.budofo/no_backup/androidx.work.workdb-shm
- /com.pojasecifufoyugi.budofo/no_backup/androidx.work.workdb-wal
- /data/user/####/.org.chromium.Chromium.9SGGnd
- /data/user/####/.org.chromium.Chromium.yuETms
- /data/user/####/000001.dbtmp
- /data/user/####/0a29e8f51349a1a1_0
- /data/user/####/17bac99320a55d91_0
- /data/user/####/19e11432a0c94d10_0
- /data/user/####/2608e47f7ee88a6f_0
- /data/user/####/2b623b4d4b5d325b_0
- /data/user/####/33166b95042feb2d_0
- /data/user/####/3ed6453e62f96327_0
- /data/user/####/556508fb3d7e0cce_0
- /data/user/####/55c5b7c007378d2c_0
- /data/user/####/5fafec4024c92ce9_0
- /data/user/####/6688f992463e19f6_0
- /data/user/####/6f4b465b19bc526c_0
- /data/user/####/7d745055d68b4541_0
- /data/user/####/8e10f629c9990b58_0
- /data/user/####/92803acaf04a1977_0
- /data/user/####/BrowserMetrics-spare.pma
- /data/user/####/Cookies-journal
- /data/user/####/MANIFEST-000001
- /data/user/####/WebViewChromiumPrefs.xml
- /data/user/####/Xmn.json
- /data/user/####/Xmn.json.cur.prof
- /data/user/####/Xmn.vdex
- /data/user/####/a02c5f7621ef54ed_0
- /data/user/####/androidx.work.workdb-journal
- /data/user/####/androidx.work.workdb-wal
- /data/user/####/b25cb6135270c68b_0
- /data/user/####/b5e3c946abe2ff3a_0
- /data/user/####/b8ee907a8c9d4530_0
- /data/user/####/bccd8c7e13f91eae_0
- /data/user/####/cc24c06a99c45334_0
- /data/user/####/f63f5bb249863d9f_0
- /data/user/####/fd15bc9d4a9225ad_0
- /data/user/####/font_unique_name_table.pb
- /data/user/####/index
- /data/user/####/settings.dat
- /data/user/####/settings.xml
- /data/user/####/settings.xml.bak
- /data/user/####/temp-index
- /data/user/####/the-real-index
- /data/user/####/todelete_1ae156c9742e596d_0_1 (deleted)
- /data/user/####/todelete_3cd3f8beb9e518db_0_1 (deleted)
- /data/user/####/todelete_7e5271d65b027836_0_1 (deleted)
- /data/user/####/todelete_c802dee663c2a7b8_0_1 (deleted)
- /data/user/####/todelete_ead9e48e1d6c6a56_0_1 (deleted)
- /data/user/####/variations_seed_new
- /data/user/####/variations_stamp
Miscellaneous:
Executes the following shell scripts:
- /system/bin/su
Uses elevated priveleges.
Displays its own windows over windows of other apps.
Intercepts notifications.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
