Android.Banker.7580

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Banker.1216.origin

Threat detection based on machine learning.

Network activity:

Connects to:

TCP(???) ifco####.io:443
UDP(???) sto####.google####.com:443
TCP(???) 1####.1.1.1:443
UDP(DNS) <Google DNS>
TCP(TLS/1.0) shared-####.byt####.ak####.net:443
TCP(TLS/1.0) ifco####.io:443
TCP(TLS/1.0) sto####.google####.com:443
TCP(TLS/1.0) 1####.1.1.1:443
TCP(TLS/1.0) librawe####.ti####.com.####.net:443
TCP(TLS/1.0) mc####.tik####.com.####.net:443
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) v19-web####.ti####.com:443
TCP(TLS/1.0) content####.google####.com:443
TCP(TLS/1.0) mon.tik####.com.####.net:443
TCP(TLS/1.0) acco####.go####.com:443
TCP(TLS/1.0) sf16-we####.neu####.ttwst####.####.net:443
TCP(TLS/1.0) mssd####.ti####.com.####.net:443
TCP(TLS/1.0) starlin####.tik####.com.####.net:443
TCP(TLS/1.0) clients####.google####.com:443
TCP(TLS/1.0) v16-web####.ti####.com.####.net:443
TCP(TLS/1.0) p16-com####.tikto####.com.####.net:443
TCP(TLS/1.0) ed####.me.g####.com:443
TCP(TLS/1.0) mo####.tik####.com.####.net:443

DNS requests:

acco####.go####.com
clients####.google####.com
content####.google####.com
ed####.me.g####.com
ifco####.io
jyhgr####.com
librawe####.ti####.com.####.net
mc####.tik####.com.####.net
mo####.tik####.com.####.net
mon.tik####.com.####.net
mssd####.ti####.com.####.net
p16-com####.tikto####.com.####.net
sf16-we####.neu####.ttwst####.####.net
shared-####.byt####.ak####.net
starlin####.tik####.com.####.net
sto####.google####.com
up####.google####.com
v16-web####.ti####.com.####.net
v19-web####.ti####.com

File system changes:

Creates the following files:

/app_webview/Default/####/000003.log
/app_webview/Default/####/Databases.db
/app_webview/Default/####/Databases.db-journal
/app_webview/Default/####/LOCK
/app_webview/Default/####/LOG
/app_webview/Default/####/MANIFEST-000001
/app_webview/Default/Cookies
/app_webview/Default/QuotaManager
/app_webview/Default/QuotaManager-journal
/app_webview/Default/Web Data
/app_webview/Default/Web Data-journal
/app_webview/webview_data.lock
/cache/WebView/####/49a52bd1c195655c_0
/cache/WebView/####/aaa942fc6ad175be_0
/cache/doh_cache/journal
/data/data/####/.org.chromium.Chromium.1FqqSl
/data/data/####/.org.chromium.Chromium.YyBjLD
/data/data/####/.org.chromium.Chromium.k50QO8 (deleted)
/data/data/####/000001.dbtmp
/data/data/####/000003.log
/data/data/####/001330f02a8a7c3b_0
/data/data/####/013888a1cda32b90_0
/data/data/####/048f50deabd15c6a_0
/data/data/####/05733a87f4196ff6_0
/data/data/####/0706449fba81c678_0
/data/data/####/0724651f2e14a684_0
/data/data/####/0895da9b3dd19e73_0
/data/data/####/08b99d499107ba17_0
/data/data/####/08b99d499107ba17_1
/data/data/####/0ae47a0c346e895d_0
/data/data/####/0bc95bc2f388f07b_0
/data/data/####/0df3d4b7a926a2d3_0
/data/data/####/0f75b8da9af8e8ab_0
/data/data/####/0f9368c849abced2_0
/data/data/####/105a8dd484f2ccd5_0
/data/data/####/153d717a0620a20a_0
/data/data/####/16d8414733425368_0
/data/data/####/1a4107ca56fa06f9_0
/data/data/####/1a7d790698814fb5_0
/data/data/####/1a7d790698814fb5_1
/data/data/####/1aa84c42c50aa384_0
/data/data/####/1b4b8db909f29cd0_0
/data/data/####/1b83d5cd676b57e1_0
/data/data/####/1e548c5c5901ffa5_0
/data/data/####/1f71ff70ff7fe0f3_0
/data/data/####/2109d2a8c792d2cf_0
/data/data/####/237e0b1354ed935d_0
/data/data/####/2408d75d8f4e0f60_0
/data/data/####/24292df0b3965430_0
/data/data/####/24292df0b3965430_1
/data/data/####/242ba1dc19e74073_0
/data/data/####/25a247a95dc76dbf_0
/data/data/####/283ec68b970ff3b8_0
/data/data/####/2975dad78b6a7f8e_0
/data/data/####/297ecea5cebb5dfe_0
/data/data/####/297ecea5cebb5dfe_1
/data/data/####/2a1a28d7c94cab7c_0
/data/data/####/2cc80dabc69f58b6_0
/data/data/####/2cc80dabc69f58b6_1
/data/data/####/2ec00a61ecaed57d_0
/data/data/####/342bd0a959792326_0
/data/data/####/3565af35c5eddc22_0
/data/data/####/36072f8e249ae6e0_0
/data/data/####/36072f8e249ae6e0_1
/data/data/####/375c7d5fe54bfd7a_0
/data/data/####/37900c243c29ef80_0
/data/data/####/37fb176e37366d5b_0
/data/data/####/37fb176e37366d5b_1
/data/data/####/383c736c02e5d6b6_0
/data/data/####/39bbce3e47681356_0
/data/data/####/3b519bcd04a19b47_0
/data/data/####/3de8135a0d238b0f_0
/data/data/####/3f0204d59142b992_0
/data/data/####/3f888d8c807aa051_0
/data/data/####/416cd5f71ba5a559_0
/data/data/####/4225b6ca27bb7677_0
/data/data/####/470d9cfc100e7d81_0
/data/data/####/47fbab9c5a2ccb8b_0
/data/data/####/49f4d2e0b5862055_0
/data/data/####/4c7697b1a917de1c_0
/data/data/####/4cb013792b196a35_0
/data/data/####/4cb013792b196a35_1
/data/data/####/4ee70afa041521f8_0
/data/data/####/4f96d3546362bb21_0
/data/data/####/5116755be447041e_0
/data/data/####/538ef10df371a581_0
/data/data/####/53e6eccfe2651454_0
/data/data/####/55c294cb24e5d6f5_0
/data/data/####/5629f0019ff388f6_0
/data/data/####/5629f0019ff388f6_1
/data/data/####/59425e552e9f5745_0
/data/data/####/5c041795ada9ea26_0
/data/data/####/5c8c811f2f42ab75_0
/data/data/####/5cdf26398e4955d3_0
/data/data/####/601d533b79e154e4_0
/data/data/####/6025427230291aea_0
/data/data/####/651881cd0c2917e4_0
/data/data/####/65d8ac0b796203bc_0
/data/data/####/67117ecdad3907d5_0
/data/data/####/67a473248953641b_0
/data/data/####/67a473248953641b_1
/data/data/####/68030aed652865ad_0
/data/data/####/6833f48775e45098_0
/data/data/####/6a21236e524c6c1f_0
/data/data/####/6ac171a79b19ecc4_0
/data/data/####/6bcde0cc5ebe2e29_0
/data/data/####/6c010e61cb9e3e73_0
/data/data/####/6c7d78c0eb30766c_0
/data/data/####/6cb96b10f6af3c30_0
/data/data/####/6f05c2f870b82ef5_0
/data/data/####/6f05c2f870b82ef5_1
/data/data/####/7018128b6e4d834b_0
/data/data/####/7094ae25baa9176a_0
/data/data/####/70c406787fe1d603_0
/data/data/####/70c406787fe1d603_1
/data/data/####/71c2aace4dad89aa_0
/data/data/####/72b54e0a72c11774_0
/data/data/####/7a5ec2de930f41fe_0
/data/data/####/7b4fd8111178d5b1_0
/data/data/####/7bce41d601eb339e_0
/data/data/####/7d6d86322fc4a1dc_0
/data/data/####/80c8b32b67590df1_0
/data/data/####/823f65f0fdad8eca_0
/data/data/####/8329875d64723cfc_0
/data/data/####/846d0b4f06cfda5b_0
/data/data/####/86d0029abf29e9df_0
/data/data/####/86d398fc0a5c1a4b_0
/data/data/####/873b7812ad7cd486_0
/data/data/####/87491bb0cabe2750_0
/data/data/####/88fdacb7a3d5315b_0
/data/data/####/892a91cb8e2f6e20_0
/data/data/####/8932995e08bab2e7_0
/data/data/####/89f51712504fa41e_0
/data/data/####/89f51712504fa41e_1
/data/data/####/8ab88562f545b7bc_0
/data/data/####/8b4004511220f6ea_0
/data/data/####/8f36ecdf17933d49_0
/data/data/####/90533573ae3865e9_0
/data/data/####/90da0d7568cfa423_0
/data/data/####/9410c43937b182e9_0
/data/data/####/944350c6a1a0073d_0
/data/data/####/955a78f2b376f105_0
/data/data/####/9580b28a322b8740_0
/data/data/####/95ba5ea776070829_0
/data/data/####/9805f26d954dd1ae_0
/data/data/####/99491ef6beea96d9_0
/data/data/####/9b3baa169bba843e_0
/data/data/####/9b9b7ade9027cab8_0
/data/data/####/9cc91817e75441ad_0
/data/data/####/9eee1bb3bc6a03e8_0
/data/data/####/9eee1bb3bc6a03e8_1
/data/data/####/BrowserMetrics-spare.pma.tmp
/data/data/####/CURRENT
/data/data/####/Cookies-journal
/data/data/####/LOCK
/data/data/####/LOG
/data/data/####/MANIFEST-000001
/data/data/####/MDx.ico
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a012bcc11013260f_0
/data/data/####/a0e18967ccbad0f3_0
/data/data/####/a10bf05680f581d3_0
/data/data/####/a13d13add760a08a_0
/data/data/####/a15c01c149f77a3e_0
/data/data/####/a19f0502b5a232f6_0
/data/data/####/a404958a01c8cb96_0
/data/data/####/a5ee5af3698bb5f3_0
/data/data/####/a6e325538ed89b86_0
/data/data/####/a8c1c2ea63cc7e8f_0
/data/data/####/ab6aabdafd3f5774_0
/data/data/####/abb9f8638024b52c_0
/data/data/####/abd8c25e12cf40f1_0
/data/data/####/ac7f43266bc29b72_0
/data/data/####/ad5ab5d8ef473ed6_0
/data/data/####/ad5ab5d8ef473ed6_1
/data/data/####/ae3e0496d7404f05_0
/data/data/####/androidx.work.workdb-journal
/data/data/####/androidx.work.workdb-wal
/data/data/####/androidx.work.workdb.lck
/data/data/####/b2b4a4e4b48d26ae_0
/data/data/####/b338aa7ef630e608_0
/data/data/####/b44f2e9c169d2764_0
/data/data/####/b5a5b6e89e84b31a_0
/data/data/####/b5aa70646e2f168c_0
/data/data/####/b6871cdea2b451fa_0
/data/data/####/b6c28cea6ed9dfc1_0
/data/data/####/b6c28cea6ed9dfc1_1
/data/data/####/b82aaf592933a8c9_0
/data/data/####/b9ae0123ecebfe3f_0
/data/data/####/ba23d8ecda68de77_0
/data/data/####/ba23d8ecda68de77_1
/data/data/####/bb62d8746b8e86c3_0
/data/data/####/bc6be28e5469c1c8_0
/data/data/####/bc6be28e5469c1c8_1
/data/data/####/be10eede4211c8ac_0
/data/data/####/be10eede4211c8ac_1
/data/data/####/be30caaacd6b5522_0
/data/data/####/c0cf172e255ee588_0
/data/data/####/c164f6072b1e3a5b_0
/data/data/####/c164f6072b1e3a5b_1
/data/data/####/c28993961de90f04_0
/data/data/####/c40aa6b4aceba3af_0
/data/data/####/c4cbc7f82c259eba_0
/data/data/####/c5c423068ad54838_0
/data/data/####/c6986fa6c2a5514b_0
/data/data/####/c7c54f38bf951635_0
/data/data/####/c7cab51d8748b3c5_0
/data/data/####/c96122f5dc3ff694_0
/data/data/####/c9d19d9c1624193d_0
/data/data/####/ca1260b684cd7778_0
/data/data/####/ca25d975e6c8f59a_0
/data/data/####/cae143729959a00b_0
/data/data/####/ccc7e831b247677b_0
/data/data/####/cd75861f76e7e48f_0
/data/data/####/d0757ff92c7cde0a_0
/data/data/####/d0757ff92c7cde0a_1
/data/data/####/d089edfe887aa618_0
/data/data/####/d17cde75a6cf079c_0
/data/data/####/d269db8586afdf55_0
/data/data/####/d329ea8220b1ff88_0
/data/data/####/d6abe2f3139900a4_0
/data/data/####/d733e7b34575947b_0
/data/data/####/d9e2af6fc9679d8a_0
/data/data/####/dcf7fd71df08b198_0
/data/data/####/de1bcd837a0d6fa0_0
/data/data/####/de9d1ac18578951b_0
/data/data/####/e0836cda78318f8e_0
/data/data/####/e0a04594f6e9ed6e_0
/data/data/####/e2306c62fab0b9d6_0
/data/data/####/e44b038a1f950c63_0
/data/data/####/e4ef987ef66ae579_0
/data/data/####/e50b6193b0f908b6_0
/data/data/####/e5e48a7ae34707e0_0
/data/data/####/e5eab1e52fead000_0
/data/data/####/e637c2e6f8602818_0
/data/data/####/e79d2235a31fd277_0
/data/data/####/e8357b23b513b203_0
/data/data/####/e8a725cbd3b41e8f_0
/data/data/####/e8a725cbd3b41e8f_1
/data/data/####/e8baaa2e1c88f7c4d5b5bb7b6ea22b8e.0.tmp
/data/data/####/e8baaa2e1c88f7c4d5b5bb7b6ea22b8e.1.tmp
/data/data/####/e94f1ad518bde638_0
/data/data/####/e96a56c364372920_0
/data/data/####/ecd2331644853914_0
/data/data/####/ed90d498858568c0_0
/data/data/####/ee0bc135d27cc620_0
/data/data/####/eef1a289ee96e066_0
/data/data/####/efbc4fa269a9d4e0_0
/data/data/####/f1cdccba37924bda_0
/data/data/####/f1cdccba37924bda_1
/data/data/####/f2acbb7fdfe1aa26_0
/data/data/####/f3797297496d898e_0
/data/data/####/f3bfdb182bb704a0_0
/data/data/####/f4203e5f44cfa666_0
/data/data/####/f593824ddbcc4317_0
/data/data/####/fa590bf699323a4b_0
/data/data/####/fa813c9ad67834ac_0
/data/data/####/fa813c9ad67834ac_1
/data/data/####/faca8e154ad6985e_0
/data/data/####/fc1f445d4f04c21f_0
/data/data/####/fe412a61e1261273_0
/data/data/####/ff3a1103add70ae9_0
/data/data/####/font_unique_name_table.pb
/data/data/####/index
/data/data/####/index.txt
/data/data/####/index.txt.tmp
/data/data/####/journal.bkp (deleted)
/data/data/####/journal.tmp
/data/data/####/notification_persistence.xml
/data/data/####/org.gudavim.plusyoy2c.xml
/data/data/####/profileInstalled
/data/data/####/settings.dat
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/todelete_05a4fc197b0c65a4_0_1 (deleted)
/data/data/####/todelete_09a1ea456cf431bc_0_1 (deleted)
/data/data/####/todelete_14f60013ed8fbc53_0_1 (deleted)
/data/data/####/todelete_251750a2f0a2a8f1_0_1 (deleted)
/data/data/####/todelete_31d19cc5ba9ec6ab_0_1 (deleted)
/data/data/####/todelete_391435b104164a31_0_1 (deleted)
/data/data/####/todelete_42dd6932a94c10fc_0_1 (deleted)
/data/data/####/todelete_45ed2fd6f6d8c12a_0_1 (deleted)
/data/data/####/todelete_49b6e5517b5414fb_0_1 (deleted)
/data/data/####/todelete_5d65c137e8ef3b8d_0_1 (deleted)
/data/data/####/todelete_6ca36057c3c16917_0_1 (deleted)
/data/data/####/todelete_8deb309817a63ec5_0_1 (deleted)
/data/data/####/todelete_8f8ec0e2346efbbe_0_1 (deleted)
/data/data/####/todelete_af80041292377c4d_0_1 (deleted)
/data/data/####/todelete_b06eac46ebe42e92_0_1 (deleted)
/data/data/####/todelete_b2bd3d38b36c697b_0_1 (deleted)
/data/data/####/todelete_ce6208c772a10674_0_1 (deleted)
/data/data/####/todelete_e2824dd4701ed614_0_1 (deleted)
/data/data/####/todelete_ee09cad6072730ad_0_1 (deleted)
/data/data/####/todelete_ee45a20d66fd647b_0_1 (deleted)
/data/data/####/todelete_efd4cf8ecab33b0b_0_1 (deleted)
/data/data/####/uninstall_protection.xml
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/data/misc/####/primary.prof
/no_backup/androidx.work.workdb
/no_backup/androidx.work.workdb-shm
/no_backup/androidx.work.workdb-wal

Miscellaneous:

Uses administrator priveleges.

Accesses camera interface.

Gets information about active device administrators.

Displays its own windows over windows of other apps.

Gets information about sent/received SMS.

Intercepts notifications.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней