Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.Ermac.6.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) matov####.top:80
- TCP(TLS/1.0) dl.go####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) acco####.go####.com:443
- TCP(TLS/1.0) clients####.google####.com:443
- UDP acco####.go####.com:443
DNS requests:
- acco####.go####.com
- clients####.google####.com
- dl.go####.com
- ed####.me.g####.com
- matov####.top
- up####.google####.com
HTTP GET requests:
- matov####.top/socket.io/?EIO=####&transport=####
- matov####.top/socket.io/?EIO=####&transport=####&sid=####
HTTP POST requests:
- matov####.top/php/0168bx4gmpfmsamcg.php/
- matov####.top/php/09qw0zjg1.php/
- matov####.top/php/0cbulpkegz4.php/
- matov####.top/php/0mljzzoqmsjn3tdu91ne.php/
- matov####.top/php/0oe4xsfpc0.php/
- matov####.top/php/0u6meyt44vs85n7d.php/
- matov####.top/php/16tr2e3v12bin9gv8.php/
- matov####.top/php/1dpn8zmscin2oear5.php/
- matov####.top/php/1itcymzs.php/
- matov####.top/php/1rxqgq3ag30obcsy35.php/
- matov####.top/php/21u02y18a.php/
- matov####.top/php/263.php/
- matov####.top/php/26x0uz53mhdoef113e.php/
- matov####.top/php/2d147yo9i1i6trsn.php/
- matov####.top/php/2l3gmccbqwrg6x9iem.php/
- matov####.top/php/2ohcppgatb.php/
- matov####.top/php/2oj3559rwua7.php/
- matov####.top/php/2q8.php/
- matov####.top/php/2rwrhgii.php/
- matov####.top/php/2suhj2emmtrxsafj6bp.php/
- matov####.top/php/2vvvli33lrx.php/
- matov####.top/php/32tgf9pwilv9sqg.php/
- matov####.top/php/34pj.php/
- matov####.top/php/36mm0vzr8vr0fp.php/
- matov####.top/php/3b9kze8gpfptm2v7t3y0.php/
- matov####.top/php/3kq4e.php/
- matov####.top/php/3l67bz0aauyzetd2mke.php/
- matov####.top/php/3lqhg8xd4swzj0uktq5k.php/
- matov####.top/php/3m0ukwm9e.php/
- matov####.top/php/3tqcbu1bf08ht8gzd9th.php/
- matov####.top/php/3vckiul8f3bshfbz.php/
- matov####.top/php/3y9cg7avusy7j8nc9l.php/
- matov####.top/php/4qudu5y7t.php/
- matov####.top/php/4wee80p12hj3mb84h4g4.php/
- matov####.top/php/5a29n112nkvrnr.php/
- matov####.top/php/5eu6sp6d5y.php/
- matov####.top/php/5pzhkjgh16fvu3.php/
- matov####.top/php/5zossbtq7uqifbujwxj.php/
- matov####.top/php/6abgf9hz9sqr.php/
- matov####.top/php/6bxfst11s.php/
- matov####.top/php/6o4na37ymk4l16.php/
- matov####.top/php/6r.php/
- matov####.top/php/6vfr4x2mzq5jequ7w2a.php/
- matov####.top/php/6xesn40o.php/
- matov####.top/php/7j1gp.php/
- matov####.top/php/7y4nx6g4hsazhb4epjxn.php/
- matov####.top/php/7ze4t0n37oa2c12gt.php/
- matov####.top/php/81oylp2v1cooy5rkvnd.php/
- matov####.top/php/81y85qvp5z.php/
- matov####.top/php/84.php/
- matov####.top/php/84t31bfiy.php/
- matov####.top/php/89xz1vcwm29n1uyir1l.php/
- matov####.top/php/8j0odgm45xno06.php/
- matov####.top/php/8ktf5wezbw78.php/
- matov####.top/php/8r6g9.php/
- matov####.top/php/8v1d0ksu8yk297w8f62b.php/
- matov####.top/php/8whwsa57ebm0o76h6yb.php/
- matov####.top/php/8xqv3a6uin88oe4v0i.php/
- matov####.top/php/8y0l65tf.php/
- matov####.top/php/9etkxhdbpn.php/
- matov####.top/php/9niuvh0.php/
- matov####.top/php/9nv4jk8jp.php/
- matov####.top/php/9sca6035zsoe8vj8hc5.php/
- matov####.top/php/9u0km17wb61pztk.php/
- matov####.top/php/9v.php/
- matov####.top/php/9v5545293.php/
- matov####.top/php/a4b.php/
- matov####.top/php/ad7c.php/
- matov####.top/php/agomlit2y.php/
- matov####.top/php/ak85qbwzqasg0idze.php/
- matov####.top/php/amandg.php/
- matov####.top/php/aqpxy0ty95u.php/
- matov####.top/php/b5ihfe5c1uknrja.php/
- matov####.top/php/b716wh.php/
- matov####.top/php/bl4xwwryp.php/
- matov####.top/php/btnrd8reyersqilbb3.php/
- matov####.top/php/bxtqzq51.php/
- matov####.top/php/c.php/
- matov####.top/php/ckicel80i3q25.php/
- matov####.top/php/ckosusx34tcvz3d360.php/
- matov####.top/php/cl6jyunl4.php/
- matov####.top/php/cp3c.php/
- matov####.top/php/cqb0rdgzf4c20lz.php/
- matov####.top/php/csirukhkalxw905.php/
- matov####.top/php/cuqrkkcfdwpyg.php/
- matov####.top/php/cx5p26.php/
- matov####.top/php/dnxllletok.php/
- matov####.top/php/do0a.php/
- matov####.top/php/dqksrgvxyvau1eee2j9.php/
- matov####.top/php/dyc0m8cu8vshh.php/
- matov####.top/php/e.php/
- matov####.top/php/e2ia7mjyo.php/
- matov####.top/php/efi9gmlntl5z6.php/
- matov####.top/php/eq9ouor9bbwhi.php/
- matov####.top/php/esdjy2e9jp04wvj.php/
- matov####.top/php/f2tmj.php/
- matov####.top/php/fah79v23asvvo2.php/
- matov####.top/php/flwwbyyczg3621uaqop2.php/
- matov####.top/php/fmt0m0uqdy9.php/
- matov####.top/php/fqkp7a.php/
- matov####.top/php/fwawv6jxy5iqvqvdn.php/
- matov####.top/php/fx.php/
- matov####.top/php/g1g40mr43.php/
- matov####.top/php/g4icvt390vm.php/
- matov####.top/php/ges0wgakjg8h669.php/
- matov####.top/php/gs3r5f6yui.php/
- matov####.top/php/hby1w.php/
- matov####.top/php/hgxwoij8odkw.php/
- matov####.top/php/hjxyxz.php/
- matov####.top/php/hkn86xacm0p.php/
- matov####.top/php/hs8118luyjst5q5cobx.php/
- matov####.top/php/hvp2nxs5igjzfcv5z9.php/
- matov####.top/php/i00r.php/
- matov####.top/php/i1sgyrnd712m3vm484t.php/
- matov####.top/php/i7dfra2.php/
- matov####.top/php/i8cakhcgx5kxu5vhnw.php/
- matov####.top/php/igchet8lhnvqmyk3.php/
- matov####.top/php/iom.php/
- matov####.top/php/iw7di6967mu.php/
- matov####.top/php/j02amcs8xbqu1j.php/
- matov####.top/php/j0pvg1ecoeiiu6r.php/
- matov####.top/php/j2sn47omhgm.php/
- matov####.top/php/j7mpp2otlly0m2na.php/
- matov####.top/php/jby4xyix8.php/
- matov####.top/php/jdh4bc6qzhl1uiifr.php/
- matov####.top/php/jhs5zpkhtr.php/
- matov####.top/php/jrfohzbn.php/
- matov####.top/php/k.php/
- matov####.top/php/k009k.php/
- matov####.top/php/k31lqulcbpx.php/
- matov####.top/php/kfn.php/
- matov####.top/php/kyo9os6wjbszad8q1k.php/
- matov####.top/php/l.php/
- matov####.top/php/l7fulfbpmlr23dqh6n2.php/
- matov####.top/php/l8zp7wj1s54isv.php/
- matov####.top/php/la4t0d8.php/
- matov####.top/php/li8rtz8md0vf77.php/
- matov####.top/php/lvw5zmwz.php/
- matov####.top/php/lzqouggdg7aj78zt.php/
- matov####.top/php/m.php/
- matov####.top/php/m6oqnvck47.php/
- matov####.top/php/m9e549tiga.php/
- matov####.top/php/mfuz74x3ba.php/
- matov####.top/php/mh45k4uezusc.php/
- matov####.top/php/miui2mcslrnlmn1.php/
- matov####.top/php/mpd58vl4.php/
- matov####.top/php/mx518yunu7sy7.php/
- matov####.top/php/nhse0.php/
- matov####.top/php/nr.php/
- matov####.top/php/nvg4ag.php/
- matov####.top/php/nwdimfpaq1n3n8n3rm.php/
- matov####.top/php/nxgqszhg28gnziccpmqg.php/
- matov####.top/php/nyqysw8caj63r4z.php/
- matov####.top/php/o.php/
- matov####.top/php/o6w6omcgbjfjxom2y5sd.php/
- matov####.top/php/o7yyyrnakxbfr36c.php/
- matov####.top/php/o9h.php/
- matov####.top/php/objebrws40fh.php/
- matov####.top/php/orglnuesvdtg01uj.php/
- matov####.top/php/otnw1olh7o1qee2yt.php/
- matov####.top/php/ox5uai9.php/
- matov####.top/php/p0ille669.php/
- matov####.top/php/p5rpylduq9q.php/
- matov####.top/php/p5xfkdrxo987fp5rxw1w.php/
- matov####.top/php/pezt5n.php/
- matov####.top/php/pqlvb33ikmiuek5cvq.php/
- matov####.top/php/q8jg9fb2zje5yckm.php/
- matov####.top/php/qgeuh3.php/
- matov####.top/php/qp5k84iql223bbkz45.php/
- matov####.top/php/qr0jlrvaqtr.php/
- matov####.top/php/qsu4w.php/
- matov####.top/php/qzmoz6mxve2yzrv.php/
- matov####.top/php/r0b7r.php/
- matov####.top/php/rcqpb1wjtnz.php/
- matov####.top/php/rjnr4g8bpazblt9vb7.php/
- matov####.top/php/rmvnee2.php/
- matov####.top/php/rzqi0om5iid43esg1.php/
- matov####.top/php/s6t6vvgcex6eqsb76cn.php/
- matov####.top/php/s9lep.php/
- matov####.top/php/se.php/
- matov####.top/php/snyn2zk4qg20t.php/
- matov####.top/php/stwupxtpw.php/
- matov####.top/php/swjoa3tigxxhqsio72v.php/
- matov####.top/php/tbgf0xqk6dfdtvnt.php/
- matov####.top/php/tbvbioznf5v0ql9o.php/
- matov####.top/php/tew222t6a3ql1.php/
- matov####.top/php/tgi8qjbwwo.php/
- matov####.top/php/tksj8khwdpqpf.php/
- matov####.top/php/to39rxcidwzcu2wd32ep.php/
- matov####.top/php/toqfq38ikssimv6p7.php/
- matov####.top/php/tpn.php/
- matov####.top/php/tskkf2sw.php/
- matov####.top/php/tt556jr6e73akbybjee.php/
- matov####.top/php/u2ho.php/
- matov####.top/php/ud749tga1k0r6excq.php/
- matov####.top/php/ufsrrzn5sbtwe5rd.php/
- matov####.top/php/uj5fito.php/
- matov####.top/php/uk9zo9y3m9nek.php/
- matov####.top/php/un46mr1ir6z64i.php/
- matov####.top/php/uom2b.php/
- matov####.top/php/uty.php/
- matov####.top/php/v660c112m.php/
- matov####.top/php/vk4bpvqvy9rcurba.php/
- matov####.top/php/vn38x6643lnx9e2w1e.php/
- matov####.top/php/vr5blvw.php/
- matov####.top/php/w1nkg0umrdpb0gqtr17x.php/
- matov####.top/php/w40978orcklj6f.php/
- matov####.top/php/wdt8opzt.php/
- matov####.top/php/wqeokhgyx2egf2vbwyd.php/
- matov####.top/php/wy7vdcp5pymfpb3ve16.php/
- matov####.top/php/x68segcnzu5gvkkzq.php/
- matov####.top/php/xec6vo7cqvyh2k.php/
- matov####.top/php/xeue4q.php/
- matov####.top/php/xhms6y8qzgw9q.php/
- matov####.top/php/xjg5jxlwjnxnw51xy2vc.php/
- matov####.top/php/xkktn.php/
- matov####.top/php/xugy65xh8p3jzzyfgh97.php/
- matov####.top/php/y.php/
- matov####.top/php/y2s3p40e.php/
- matov####.top/php/y41j.php/
- matov####.top/php/yd4pyfg.php/
- matov####.top/php/yip7hc3dx31ou.php/
- matov####.top/php/yspn650fmpzxnhpllpwf.php/
- matov####.top/php/z3e02uei.php/
- matov####.top/php/z43y1sfdox.php/
- matov####.top/php/z7kbb82hhl5o8f.php/
- matov####.top/php/zdvz.php/
- matov####.top/php/zolcdb74oy.php/
- matov####.top/php/zraj3p7rp.php/
- matov####.top/php/zu8aklfaz2s7e.php/
- matov####.top/php/zzr36e4ikbfhlp8gqucj.php/
- matov####.top/socket.io/?EIO=####&transport=####&sid=####
File system changes:
Creates the following files:
- /com.jevodubutufi.murugo/app_webview/####/000003.log
- /com.jevodubutufi.murugo/app_webview/####/Cookies
- /com.jevodubutufi.murugo/app_webview/####/LOCK
- /com.jevodubutufi.murugo/app_webview/####/LOG
- /com.jevodubutufi.murugo/app_webview/####/MANIFEST-000001
- /com.jevodubutufi.murugo/app_webview/####/QuotaManager
- /com.jevodubutufi.murugo/app_webview/####/QuotaManager-journal
- /com.jevodubutufi.murugo/app_webview/####/Web Data
- /com.jevodubutufi.murugo/app_webview/####/Web Data-journal
- /com.jevodubutufi.murugo/app_webview/webview_data.lock
- /com.jevodubutufi.murugo/no_backup/androidx.work.workdb
- /com.jevodubutufi.murugo/no_backup/androidx.work.workdb-shm
- /com.jevodubutufi.murugo/no_backup/androidx.work.workdb-wal
- /data/misc/####/primary.prof
- /data/user/####/.org.chromium.Chromium.LRrQ6d
- /data/user/####/.org.chromium.Chromium.umyagv
- /data/user/####/000001.dbtmp
- /data/user/####/000003.log
- /data/user/####/BrowserMetrics-spare.pma.tmp
- /data/user/####/Cookies-journal
- /data/user/####/LOCK
- /data/user/####/LOG
- /data/user/####/MANIFEST-000001
- /data/user/####/WebViewChromiumPrefs.xml
- /data/user/####/androidx.work.workdb-journal
- /data/user/####/androidx.work.workdb-wal
- /data/user/####/font_unique_name_table.pb
- /data/user/####/index
- /data/user/####/mQJQnx.json
- /data/user/####/mQJQnx.json.cur.prof
- /data/user/####/mQJQnx.vdex
- /data/user/####/settings.dat
- /data/user/####/settings.xml
- /data/user/####/settings.xml.bak
- /data/user/####/temp-index
- /data/user/####/todelete_7e5271d65b027836_0_1 (deleted)
- /data/user/####/todelete_83b1a9e36c49e047_0_1 (deleted)
- /data/user/####/todelete_9dfdd837cc9bd57c_0_1 (deleted)
- /data/user/####/todelete_ead9e48e1d6c6a56_0_1 (deleted)
- /data/user/####/variations_seed_new
- /data/user/####/variations_stamp
Miscellaneous:
Executes the following shell scripts:
- /system/bin/su
Uses elevated priveleges.
Displays its own windows over windows of other apps.
Intercepts notifications.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
