Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.1224.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(???) s####.l.go####.com:19302
- UDP(???) sto####.google####.com:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) librawe####.ti####.com.####.net:443
- TCP(TLS/1.0) mssd####.ti####.com.####.net:443
- TCP(TLS/1.0) p16-com####.tikto####.com.####.net:443
- TCP(TLS/1.0) mon.tik####.com.####.net:443
- TCP(TLS/1.0) shared-####.byt####.ak####.net:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) sf16-we####.neu####.ttwst####.####.net:443
- TCP(TLS/1.0) mo####.tik####.com.####.net:443
- TCP(TLS/1.0) clients####.google####.com:443
- TCP(TLS/1.0) abio####.cfd:443
- TCP(TLS/1.0) v16-web####.ti####.com.####.net:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) sto####.google####.com:443
DNS requests:
- abio####.cfd
- beral####.info
- clients####.google####.com
- ed####.me.g####.com
- librawe####.ti####.com.####.net
- mc####.tik####.com.####.net
- mo####.tik####.com.####.net
- mon.tik####.com.####.net
- more####.cfd
- mssd####.ti####.com.####.net
- p####.go####.com
- p16-com####.tikto####.com.####.net
- s####.l.go####.com
- sf16-we####.neu####.ttwst####.####.net
- shared-####.byt####.ak####.net
- sto####.google####.com
- up####.google####.com
- v16-web####.ti####.com.####.net
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/000004.log
- /app_webview/Default/####/Databases.db
- /app_webview/Default/####/Databases.db-journal
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/QuotaManager
- /app_webview/Default/QuotaManager-journal
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /data/data/####/.org.chromium.Chromium.VzZe0U
- /data/data/####/.org.chromium.Chromium.wbxQ8o
- /data/data/####/000001.dbtmp
- /data/data/####/000003.log
- /data/data/####/000005.ldb
- /data/data/####/008e3c94c6db04e1_0
- /data/data/####/0464774ba056f514_0
- /data/data/####/0494a50c20c24a64_0
- /data/data/####/0895da9b3dd19e73_0
- /data/data/####/0b5ab72876580256_0
- /data/data/####/0d9de2c96ce3c19b_0
- /data/data/####/0df3d4b7a926a2d3_0
- /data/data/####/13bf58bb8899aeaa_0
- /data/data/####/158dd0e48b358c19_0
- /data/data/####/16577c7958d39244_0
- /data/data/####/18d4ad7488188008_0
- /data/data/####/1b26bd7dd6fd61df_0
- /data/data/####/1c3dd7a5fbe02002_0
- /data/data/####/1f60b3f67e5575ee_0
- /data/data/####/1f71ff70ff7fe0f3_0
- /data/data/####/20600c18f47edfcc_0
- /data/data/####/2408d75d8f4e0f60_0
- /data/data/####/269629074cd42745_0
- /data/data/####/2928e9da0562a42d_0
- /data/data/####/2a1a28d7c94cab7c_0
- /data/data/####/2b1b1cb846279f23_0
- /data/data/####/2b940eac1251d79b_0
- /data/data/####/2c28cb7f373f5912_0
- /data/data/####/2cc80dabc69f58b6_0
- /data/data/####/2cc80dabc69f58b6_1
- /data/data/####/31da661e0d78cf98_0
- /data/data/####/32043901e5c2d793_0
- /data/data/####/375c7d5fe54bfd7a_0
- /data/data/####/383c736c02e5d6b6_0
- /data/data/####/3b8cea09c8dc7083_0
- /data/data/####/3f0204d59142b992_0
- /data/data/####/3fe4f90dedf7dddc_0
- /data/data/####/40e35f9614ddf511_0
- /data/data/####/464c3a3e9b44e14d_0
- /data/data/####/4680ce81289b6092_0
- /data/data/####/47a715324c59a089_0
- /data/data/####/4a81f3e7a8f9d267_0
- /data/data/####/4cb013792b196a35_0
- /data/data/####/4cb013792b196a35_1
- /data/data/####/5116755be447041e_0
- /data/data/####/52a109ac756d51cd_0
- /data/data/####/53339a277e02a936_0
- /data/data/####/538ef10df371a581_0
- /data/data/####/54c5a5f65c71b032_0
- /data/data/####/555e0e8625f4fc1d_0
- /data/data/####/5acb0c02229ea1e9_0
- /data/data/####/5db6b595ca2d3234_0
- /data/data/####/6025427230291aea_0
- /data/data/####/656c467e7c15c630_0
- /data/data/####/66409c299bd8c5de_0
- /data/data/####/67117ecdad3907d5_0
- /data/data/####/68030aed652865ad_0
- /data/data/####/69dd16ca111c0703_0
- /data/data/####/6bcde0cc5ebe2e29_0
- /data/data/####/6ccb0d46a2ea7544_0
- /data/data/####/71c2aace4dad89aa_0
- /data/data/####/7245446806168b05_0
- /data/data/####/73e63e797f444a05_0
- /data/data/####/74e1f0285e8ff47f_0
- /data/data/####/75904b15a49375ac_0
- /data/data/####/7bce2d18bc8d7310_0
- /data/data/####/7c075355a4725f8f_0
- /data/data/####/7d62574ba0e8f552_0
- /data/data/####/7d6d86322fc4a1dc_0
- /data/data/####/7ef72da48c56202a_0
- /data/data/####/8062a08eb46fd128_0
- /data/data/####/86bb3394c5e571b1_0
- /data/data/####/892a91cb8e2f6e20_0
- /data/data/####/8b4004511220f6ea_0
- /data/data/####/8db5a2ef7030ea4c_0
- /data/data/####/8fb0ad552efca630_0
- /data/data/####/944350c6a1a0073d_0
- /data/data/####/94f2021d55bb10ed_0
- /data/data/####/95012107af81670f_0
- /data/data/####/9b7a0a848693c0d5_0
- /data/data/####/9bbf924e82a6f52f_0
- /data/data/####/9ef1b1808ab87519_0
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/KDdU.txt
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a03d34db602fc451_0
- /data/data/####/a102d022829fbc33_0
- /data/data/####/a3237a0f551fc40a_0
- /data/data/####/a6c6d0f60076a790_0
- /data/data/####/aa433ca7de573c7f_0
- /data/data/####/aac214ebb1b27edc_0
- /data/data/####/ab6aabdafd3f5774_0
- /data/data/####/abd8c25e12cf40f1_0
- /data/data/####/ac7f43266bc29b72_0
- /data/data/####/ad14c509b0680dd6_0
- /data/data/####/app_prefs.xml
- /data/data/####/b5aa70646e2f168c_0
- /data/data/####/b69f93bfce2d3725_0
- /data/data/####/b82aaf592933a8c9_0
- /data/data/####/ba23d8ecda68de77_0
- /data/data/####/ba23d8ecda68de77_1
- /data/data/####/ba65b0e8f20c2c25_0
- /data/data/####/bad97328df745589_0
- /data/data/####/c2812121e32c82de_0
- /data/data/####/c40aa6b4aceba3af_0
- /data/data/####/c4cbc7f82c259eba_0
- /data/data/####/c5d3e74421acd80c_0
- /data/data/####/c5e006c0ec93503f_0
- /data/data/####/c64fadbc97680f4d_0
- /data/data/####/c6a358d40b23d40e_0
- /data/data/####/c6a475762c4efc34_0
- /data/data/####/c9d19d9c1624193d_0
- /data/data/####/ca1260b684cd7778_0
- /data/data/####/ca8d0886ecdb6e6f_0
- /data/data/####/cached_domain.xml
- /data/data/####/d031a510b680da04_0
- /data/data/####/d17cde75a6cf079c_0
- /data/data/####/d2d49e011eef8551_0
- /data/data/####/d505550adc3ba760_0
- /data/data/####/d8b07aede5ddf01d_0
- /data/data/####/e3257ab1ab5648d6_0
- /data/data/####/e3468fd4a2b5a500_0
- /data/data/####/e5063f268a9955eb_0
- /data/data/####/e9601ef2afdf89a7_0
- /data/data/####/eee4f2436ad16408_0
- /data/data/####/ef6a0644c53d8d10_0
- /data/data/####/efbc4fa269a9d4e0_0
- /data/data/####/efc91272c8d67d0c_0
- /data/data/####/f1cdccba37924bda_0
- /data/data/####/f1cdccba37924bda_1
- /data/data/####/f4189a00b9ee48e5_0
- /data/data/####/f41ec9c596ea11d9_0
- /data/data/####/fa04cf4f33961268_0
- /data/data/####/fa590bf699323a4b_0
- /data/data/####/fbef9d144303ae6a_0
- /data/data/####/fc1f445d4f04c21f_0
- /data/data/####/fd34114148d8b70a_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/guard_prefs.xml
- /data/data/####/index
- /data/data/####/index.txt
- /data/data/####/index.txt.tmp
- /data/data/####/install_flow_prefs.xml
- /data/data/####/monitored_apps.db
- /data/data/####/monitored_apps.db-journal
- /data/data/####/notification_prefs.xml
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/settings.dat
- /data/data/####/smsclient_prefs.xml
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_1790ce844b9937f0_0_1 (deleted)
- /data/data/####/todelete_31d19cc5ba9ec6ab_0_1 (deleted)
- /data/data/####/todelete_391435b104164a31_0_1 (deleted)
- /data/data/####/todelete_45ed2fd6f6d8c12a_0_1 (deleted)
- /data/data/####/todelete_55037dbacc3c86b1_0_1 (deleted)
- /data/data/####/todelete_6ca36057c3c16917_0_1 (deleted)
- /data/data/####/todelete_6eae5c4c2c859d4c_0_1 (deleted)
- /data/data/####/todelete_757efefb031bf3c6_0_1 (deleted)
- /data/data/####/todelete_8f8ec0e2346efbbe_0_1 (deleted)
- /data/data/####/todelete_b06eac46ebe42e92_0_1 (deleted)
- /data/data/####/todelete_b2bd3d38b36c697b_0_1 (deleted)
- /data/data/####/todelete_c0eb770e44a3893d_0_1 (deleted)
- /data/data/####/todelete_c9e678e3a599212b_0_1 (deleted)
- /data/data/####/todelete_ce6208c772a10674_0_1 (deleted)
- /data/data/####/todelete_fc2916374454e3f4_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/misc/####/primary.prof
Miscellaneous:
Gets information about installed apps.
Displays its own windows over windows of other apps.
Intercepts notifications.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
