Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Banker.6208
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) connect####.gst####.com:80
- UDP(NTP) t####.and####.com:123
- TCP(TLS/1.0) st####.cloudfl####.com:443
- TCP(TLS/1.0) f.cla####.ms:443
- TCP(TLS/1.0) sexydix####.b####.net:443
- TCP(TLS/1.0) r-u####.barta####.wor####.dev:443
- TCP(TLS/1.0) s####.dual####.part-####.####.net:443
- TCP(TLS/1.0) fire####.google####.com:443
- TCP(TLS/1.0) sexy####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) tm-clar####.traffic####.net:443
- TCP(TLS/1.0) sexydix####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- UDP fire####.google####.com:443
- UDP sexy####.com:443
- UDP 2####.255.255.255:67
DNS requests:
- connect####.gst####.com
- f####.gst####.com
- f.cla####.ms
- fire####.google####.com
- r-u####.barta####.wor####.dev
- scr####.cla####.ms
- sexy####.com
- sexydix####.b####.net
- sexydix####.com
- st####.cloudfl####.com
- t####.and####.com
- www.cla####.ms
- www.go####.com
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/QuotaManager
- /app_webview/Default/QuotaManager-journal
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/variations_seed_new
- /app_webview/webview_data.lock
- /cache/WebView/####/a812872ecf8382f3_0
- /data/data/####/.org.chromium.Chromium.IXRcz9 (deleted)
- /data/data/####/.org.chromium.Chromium.XN6qsh
- /data/data/####/000001.dbtmp
- /data/data/####/0039341ca4589c64_0
- /data/data/####/01dcc8bc83eb097b_0
- /data/data/####/0b18bee18b158c0f_0
- /data/data/####/0b8cdbbdb03bc938_0
- /data/data/####/0f1646b828baec6a_0
- /data/data/####/0f2ea3e111dd9f46_0
- /data/data/####/15aed986206f1e92_0
- /data/data/####/1748b336f4c40aaf_0
- /data/data/####/1c2812de0d3c2440_0
- /data/data/####/23e11bd67c045d9b_0
- /data/data/####/30eed4b56c09a600_0
- /data/data/####/3305eb831d25629d_0
- /data/data/####/3420e6dcd9223d9e_0
- /data/data/####/39aaf803601d9572_0
- /data/data/####/3b336e781db1b962_0
- /data/data/####/3cd297da9efbcfe3_0
- /data/data/####/3e2389edf9ab9217_0
- /data/data/####/49c88c2606cd748b_0
- /data/data/####/5432729349f5dbb7_0
- /data/data/####/565882a75f7ddb8f_0
- /data/data/####/5c410d2a897b5aef_0
- /data/data/####/5ce6f5616516f50a_0
- /data/data/####/5d5027922292328c_0
- /data/data/####/5f79928cb8d12630_0
- /data/data/####/612257b0ca967b4d_0
- /data/data/####/6217bec6a45e5324_0
- /data/data/####/62dbb1e7a2db0428_0
- /data/data/####/63b1faf276b56861_0
- /data/data/####/67833d4001d8a43d_0
- /data/data/####/6a386201381fa3ce_0
- /data/data/####/7ec8d38d8a514f7b_0
- /data/data/####/80e2225f4b122eda_0
- /data/data/####/85ef5c42fb35ac9a_0
- /data/data/####/87786668da59bc65_0
- /data/data/####/8afdc2335d5282d1_0
- /data/data/####/908cbabca15af631_0
- /data/data/####/9466b113262c1fcd_0
- /data/data/####/9f923053facc0dc1_0
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/RR.json
- /data/data/####/RR.json.cur.prof
- /data/data/####/RR.vdex
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a84e1ae936c6e38a_0
- /data/data/####/ac5775f959057c27_0
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/b1c94974f7ba90a6_0
- /data/data/####/b23a07b6f9eed09a_0
- /data/data/####/b72d4faf23f162ac_0
- /data/data/####/b9617d44be591c2a_0
- /data/data/####/b991adc21765ca9d_0
- /data/data/####/bd816c71d5137a03_0
- /data/data/####/c67b0e7794dff11e_0
- /data/data/####/c7251b54b6cc10a5_0
- /data/data/####/cc3b20bd23288f3b_0
- /data/data/####/cd8453997aa71313_0
- /data/data/####/ce34813945d73fee_0
- /data/data/####/dae698ee7845885e_0
- /data/data/####/e1f16e166c6edd7c_0
- /data/data/####/e273ac967c4ab87e_0
- /data/data/####/e921e9ab41d65c87_0
- /data/data/####/efd8e4f113632962_0
- /data/data/####/f2fc90adaeffabfe_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_71c54076868ecb6f_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/data/####/vvLDskiWhJXI.xml
- /data/misc/####/primary.prof
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Executes the following shell scripts:
- /system/bin/su
Uses elevated priveleges.
Displays its own windows over windows of other apps.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
