Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.1246.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- TCP(HTTP/1.1) 85.2####.161.17:443
- TCP(TLS/1.0) 85.2####.161.17:443
HTTP GET requests:
- 85.2####.161.17:443/ws/device
File system changes:
Creates the following files:
- /data/data/####/automation_flags.xml
- /data/data/####/jcFXR.vdex
- /data/data/####/jcFXR.vec
- /data/data/####/jcFXR.vec.cur.prof
- /data/data/####/profileInstalled
Miscellaneous:
Gets information about installed apps.
Displays its own windows over windows of other apps.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
