Android.Banker.6219

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Banker.6208

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) connect####.gst####.com:80
UDP(NTP) t####.and####.com:123
TCP(TLS/1.0) sexydix####.com:443
TCP(TLS/1.0) a####.go####.com:443
TCP(TLS/1.0) th####.only####.com:443
TCP(TLS/1.0) s####.dual####.s-part-####.####.net:443
TCP(TLS/1.0) vz-5b86####.b####.net:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) sdads####.b####.net:443
TCP(TLS/1.0) sexy####.com:443
TCP(TLS/1.0) c.m####.com:443
TCP(TLS/1.0) rgreso####.b####.net:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) f.cla####.ms:443
TCP(TLS/1.0) r-u####.barta####.wor####.dev:443
TCP(TLS/1.0) c-bing####.ax-####.ax-ms####.net:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) cl####.sleek####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) st####.cloudfl####.com:443
TCP(TLS/1.0) sexydix####.firebas####.com:443
TCP(TLS/1.0) externa####.r####.it:443
TCP(TLS/1.0) sexydix####.b####.net:443
TCP(TLS/1.0) api-cl####.sleek####.com:443
UDP firebas####.google####.com:443
UDP sexydix####.firebas####.com:443
UDP sexydix####.b####.net:443
UDP sexy####.com:443
UDP a####.go####.com:443
UDP www.google-####.com:443
UDP 2####.255.255.255:67

DNS requests:

a####.go####.com
api-cl####.sleek####.com
c.b####.com
c.cla####.ms
cl####.sleek####.com
connect####.gst####.com
externa####.r####.it
f####.gst####.com
f.cla####.ms
fire####.google####.com
firebas####.google####.com
firebas####.google####.com
pre####.r####.it
r-u####.barta####.wor####.dev
rgreso####.b####.net
sdads####.b####.net
sexy####.com
sexydix####.b####.net
sexydix####.b####.net
sexydix####.com
sexydix####.firebas####.com
st####.cloudfl####.com
t####.and####.com
th####.only####.com
vz-5b86####.b####.net
www.cla####.ms
www.go####.com
www.google####.com
www.google-####.com
www.googlet####.com

File system changes:

Creates the following files:

/app_webview/Default/####/000003.log
/app_webview/Default/####/000004.log
/app_webview/Default/####/Databases.db
/app_webview/Default/####/Databases.db-journal
/app_webview/Default/####/LOCK
/app_webview/Default/####/LOG
/app_webview/Default/####/MANIFEST-000001
/app_webview/Default/Cookies
/app_webview/Default/QuotaManager
/app_webview/Default/QuotaManager-journal
/app_webview/Default/Web Data
/app_webview/Default/Web Data-journal
/app_webview/variations_seed_new
/app_webview/webview_data.lock
/data/data/####/.org.chromium.Chromium.q21Ebx
/data/data/####/000001.dbtmp
/data/data/####/000003.log
/data/data/####/000005.ldb
/data/data/####/0039341ca4589c64_0
/data/data/####/01dcc8bc83eb097b_0
/data/data/####/054b573991fe2495_0
/data/data/####/0f1646b828baec6a_0
/data/data/####/12090c3d0d0439ee_0
/data/data/####/12d6efc559879aac_0
/data/data/####/13c96a05ed149485_0
/data/data/####/14dd3de3e271bd69_0
/data/data/####/15aed986206f1e92_0
/data/data/####/17dd086454f39b91_0
/data/data/####/18aeb03d3ffae6c0_0
/data/data/####/1c2812de0d3c2440_0
/data/data/####/1cf9a94a70f9acf9_0
/data/data/####/1d5ea88abac4d20c_0
/data/data/####/1eae4ba90be940a4_0
/data/data/####/21446f5ec9377837_0
/data/data/####/23e11bd67c045d9b_0
/data/data/####/2450816f445ccd02_0
/data/data/####/266e65417409c200_0
/data/data/####/29b789d40549c23d_0
/data/data/####/2c3f33262b095870_0
/data/data/####/2cb8a1c6ebc719cd_0
/data/data/####/308de4766555bb60_0
/data/data/####/30eed4b56c09a600_0
/data/data/####/3441d671268bf2ae_0
/data/data/####/3829cf1cd319389a_0
/data/data/####/3a548e0098c71057_0
/data/data/####/3bb264a08ab3de16_0
/data/data/####/3deced2c3d4c8e47_0
/data/data/####/40ec3116c87a7372_0
/data/data/####/45117d21d1538fdc_0
/data/data/####/45415153c3d3c176_0
/data/data/####/495c120e3d467b37_0
/data/data/####/49f3da5166def7c2_0
/data/data/####/4e3f3f798d83d0ff_0
/data/data/####/58d55122b6325820_0
/data/data/####/5b8c195f0d5d8979_0
/data/data/####/5d24e8fa574e25c7_0
/data/data/####/5d5027922292328c_0
/data/data/####/5e0643805e2b94dc_0
/data/data/####/5ec6ee04a1eddcb6_0
/data/data/####/5faa9f9972bfa95f_0
/data/data/####/66ee4456e9f89865_0
/data/data/####/698ca400203bdb20_0
/data/data/####/6c096a72302d229e_0
/data/data/####/6dea1fb585bb31bd_0
/data/data/####/715da10b35aa72ab_0
/data/data/####/71e8e41690bd5368_0
/data/data/####/77fd3dda4140b207_0
/data/data/####/7855814d0cb611c2_0
/data/data/####/7a73f58f436d23af_0
/data/data/####/7e2e2c6b38acc49d_0
/data/data/####/80637af37715863f_0
/data/data/####/816fa193a549e48e_0
/data/data/####/81f4b52db8868958_0
/data/data/####/838d235b626ff499_0
/data/data/####/83cdfbd70c8c2fee_0
/data/data/####/85a2aa4bf7ed8ab2_0
/data/data/####/867204b6119c9952_0
/data/data/####/86c7429fc0c3ec12_0
/data/data/####/8e95b0afcd89546d_0
/data/data/####/900f154f1073f123_0
/data/data/####/9016f639e610f385_0
/data/data/####/909918718449d29c_0
/data/data/####/971b809cb24e0ab1_0
/data/data/####/98b6caef51d76dae_0
/data/data/####/992203ed539e3f74_0
/data/data/####/9ac61abc6bdf6ac9_0
/data/data/####/9d7d6e2ff48a2ac9_0
/data/data/####/9f923053facc0dc1_0
/data/data/####/BrowserMetrics-spare.pma
/data/data/####/Cookies-journal
/data/data/####/MANIFEST-000001
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a1c765f45492740d_0
/data/data/####/a7212ab6dccfcaf1_0
/data/data/####/a73ccbbf92fbff63_0
/data/data/####/a812872ecf8382f3_0
/data/data/####/a8c55d5e73bb2430_0
/data/data/####/a9167f29502ec30a_0
/data/data/####/ab3a99af906651c2_0
/data/data/####/ac5775f959057c27_0
/data/data/####/ac602733c4e7fe02_0
/data/data/####/ad6f5cca810cc4e4_0
/data/data/####/ae27bdb4c0e8dbc6_0
/data/data/####/androidx.work.workdb-journal
/data/data/####/androidx.work.workdb-wal
/data/data/####/androidx.work.workdb.lck
/data/data/####/b02745a2e99a646d_0
/data/data/####/b0f63211f6f2ff4c_0
/data/data/####/b0f6920f9609c091_0
/data/data/####/b23a07b6f9eed09a_0
/data/data/####/b5e2fa9010d17180_0
/data/data/####/b72d4faf23f162ac_0
/data/data/####/b9a0b2c012f2dcbb_0
/data/data/####/b9e6a3e9b273d66c_0
/data/data/####/ba700cd5314dbe5d_0
/data/data/####/bb1d702f866ce8a5_0
/data/data/####/bbeb7df946b4cc46_0
/data/data/####/be29068a7e5e25d7_0
/data/data/####/bfbc99735df34679_0
/data/data/####/c10baaf6250b59ce_0
/data/data/####/c38d383358d936ca_0
/data/data/####/c48b6b631c55660a_0
/data/data/####/c54ca9c88973891b_0
/data/data/####/c67b0e7794dff11e_0
/data/data/####/c70cb87c4a9c1e98_0
/data/data/####/c7251b54b6cc10a5_0
/data/data/####/c8a9382c41286915_0
/data/data/####/ca1e1876a20623af_0
/data/data/####/ce16e6623a6b3f39_0
/data/data/####/ce9e482f2d4af157_0
/data/data/####/d64d016d2ac6362d_0
/data/data/####/db7a9ae842b9a5f0_0
/data/data/####/dba3af2000976017_0
/data/data/####/dc722431d0bd4730_0
/data/data/####/dd619e46842a8885_0
/data/data/####/e0a0968775915c6d_0
/data/data/####/e0c7716abde88b2a_0
/data/data/####/e197ce029b9f8a13_0
/data/data/####/e1e1cd7903a5ed30_0
/data/data/####/e1f16e166c6edd7c_0
/data/data/####/ee6b6464163ad51b_0
/data/data/####/f47ee97c2b1ee8b2_0
/data/data/####/f68a9b45ada42e54_0
/data/data/####/f81423ba32dd5b35_0
/data/data/####/f93288bb3cb3b603_0
/data/data/####/fd22ece32caa427a_0
/data/data/####/fdae55a675df03e3_0
/data/data/####/ff23dd32e2828d80_0
/data/data/####/font_unique_name_table.pb
/data/data/####/gnsXcqVAMSfbeU.xml
/data/data/####/index
/data/data/####/pref_store
/data/data/####/profileInstalled
/data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
/data/data/####/settings.dat
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/todelete_463424c341fdff62_0_1 (deleted)
/data/data/####/todelete_6dea79afcadd6427_0_1 (deleted)
/data/data/####/todelete_71661c1fae284552_0_1 (deleted)
/data/data/####/todelete_71c54076868ecb6f_0_1 (deleted)
/data/data/####/todelete_d8abee336fdb2a74_0_1 (deleted)
/data/data/####/todelete_da8a762cb61cf743_0_1 (deleted)
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/data/data/####/ybxg.json
/data/data/####/ybxg.json.cur.prof
/data/data/####/ybxg.vdex
/data/misc/####/primary.prof
/no_backup/androidx.work.workdb
/no_backup/androidx.work.workdb-shm
/no_backup/androidx.work.workdb-wal

Miscellaneous:

Executes the following shell scripts:

/system/bin/su

Uses elevated priveleges.

Displays its own windows over windows of other apps.

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial