Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.Ermac.4.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cnjw####.cyou:80
DNS requests:
- cnjw####.cyou
- mnqwx####.mom
HTTP POST requests:
- cnjw####.cyou/php/0ad6glhly6agk4.php/
- cnjw####.cyou/php/0uf8wxz5z7c.php/
- cnjw####.cyou/php/1emo6do.php/
- cnjw####.cyou/php/1lr8ba.php/
- cnjw####.cyou/php/1qp5daf76st4urgz5.php/
- cnjw####.cyou/php/1rnct.php/
- cnjw####.cyou/php/1rqs4nnhinoc0helaqih.php/
- cnjw####.cyou/php/1wxe5mslfc.php/
- cnjw####.cyou/php/2csg37.php/
- cnjw####.cyou/php/2dpwf5o3030rng0vhu.php/
- cnjw####.cyou/php/2jnetmcf6y0rg.php/
- cnjw####.cyou/php/2qjphc6jtekcdv.php/
- cnjw####.cyou/php/2rig4vcuvz1kpejq.php/
- cnjw####.cyou/php/2sbzjsdw5y3jw.php/
- cnjw####.cyou/php/3.php/
- cnjw####.cyou/php/34s021nrxsos6f4k.php/
- cnjw####.cyou/php/371mse3nls28d.php/
- cnjw####.cyou/php/3blj0ya862w0otw.php/
- cnjw####.cyou/php/3woilv.php/
- cnjw####.cyou/php/446aecu926u.php/
- cnjw####.cyou/php/496zwx82k6z58yim.php/
- cnjw####.cyou/php/4dermm9iy2aoj0.php/
- cnjw####.cyou/php/4hpk1qw6m6pui.php/
- cnjw####.cyou/php/4imlbtczhagx3s0pz.php/
- cnjw####.cyou/php/4wikan169.php/
- cnjw####.cyou/php/55ijzmv1eoyte5sw1q.php/
- cnjw####.cyou/php/56je0.php/
- cnjw####.cyou/php/59z1jjwsb67mlnro.php/
- cnjw####.cyou/php/5fkwjqc9ob.php/
- cnjw####.cyou/php/5jei6zydxbcq3fr107az.php/
- cnjw####.cyou/php/5lep4.php/
- cnjw####.cyou/php/6ibp9hrac.php/
- cnjw####.cyou/php/6nj1qwcnwow.php/
- cnjw####.cyou/php/7496.php/
- cnjw####.cyou/php/7asrovvba9bf9z.php/
- cnjw####.cyou/php/7bhcese.php/
- cnjw####.cyou/php/7gn7olmlphb9u.php/
- cnjw####.cyou/php/7oa3vakqk.php/
- cnjw####.cyou/php/7pro9v.php/
- cnjw####.cyou/php/7r2.php/
- cnjw####.cyou/php/7x4e0x.php/
- cnjw####.cyou/php/7xychl69q2v7s.php/
- cnjw####.cyou/php/8.php/
- cnjw####.cyou/php/8cob7.php/
- cnjw####.cyou/php/8ysdonw.php/
- cnjw####.cyou/php/8z53m.php/
- cnjw####.cyou/php/93ggb1ucbnt1lda7t5.php/
- cnjw####.cyou/php/9t099h2j12qigjn.php/
- cnjw####.cyou/php/9u4gj9.php/
- cnjw####.cyou/php/9z0ktnw1a5zhl.php/
- cnjw####.cyou/php/a3ql596xd1ezh.php/
- cnjw####.cyou/php/a7fliaa.php/
- cnjw####.cyou/php/a8d3dxvtgvsbvs.php/
- cnjw####.cyou/php/a8uzpjlh24c1rxb9mm.php/
- cnjw####.cyou/php/aeltsr49e4uwd6c0cram.php/
- cnjw####.cyou/php/aezl9.php/
- cnjw####.cyou/php/apcvl7jm23smb32s1f2.php/
- cnjw####.cyou/php/avq8n747psh2rhnod.php/
- cnjw####.cyou/php/b33clzdx8.php/
- cnjw####.cyou/php/bc7g6.php/
- cnjw####.cyou/php/bm22f1cwtt6630827.php/
- cnjw####.cyou/php/bvipk12m3gmae7.php/
- cnjw####.cyou/php/bypkt0euj5akogd0y.php/
- cnjw####.cyou/php/c12.php/
- cnjw####.cyou/php/c5091dpgjbllr9rn98lg.php/
- cnjw####.cyou/php/c5yswx0kkpq1d1qy0i.php/
- cnjw####.cyou/php/c97kpy6m2ljlbuu.php/
- cnjw####.cyou/php/caqt5v1eay.php/
- cnjw####.cyou/php/ceynnxqpkr4paz.php/
- cnjw####.cyou/php/coaieivy7g8v4m.php/
- cnjw####.cyou/php/cspemjc5z7ghm.php/
- cnjw####.cyou/php/de2yagn52m46.php/
- cnjw####.cyou/php/dsj8011hpgfvadk9h4.php/
- cnjw####.cyou/php/dv.php/
- cnjw####.cyou/php/ebid2jb.php/
- cnjw####.cyou/php/eelygn5ihtxy3c5651g.php/
- cnjw####.cyou/php/epsk5yf.php/
- cnjw####.cyou/php/er7ihm.php/
- cnjw####.cyou/php/eu8zda.php/
- cnjw####.cyou/php/f4f5jh5gnxqnooo5nh.php/
- cnjw####.cyou/php/f60nljtgzg5y.php/
- cnjw####.cyou/php/fhss19a8q19d.php/
- cnjw####.cyou/php/ftr06ipu068yslezj.php/
- cnjw####.cyou/php/ftwjia.php/
- cnjw####.cyou/php/fxc.php/
- cnjw####.cyou/php/fxlz9vovnd13lk.php/
- cnjw####.cyou/php/g5k4k.php/
- cnjw####.cyou/php/gf.php/
- cnjw####.cyou/php/gkn2l.php/
- cnjw####.cyou/php/h4nwfqp71mudips.php/
- cnjw####.cyou/php/hbkerw.php/
- cnjw####.cyou/php/hh72j90jogz71dkcyr5j.php/
- cnjw####.cyou/php/hk0e9c9.php/
- cnjw####.cyou/php/hpkr5uqohi.php/
- cnjw####.cyou/php/hvo3upk4xe52aly6.php/
- cnjw####.cyou/php/hykdsb.php/
- cnjw####.cyou/php/i4nvnsg.php/
- cnjw####.cyou/php/ian8fcfyuj.php/
- cnjw####.cyou/php/ijevmln8u4y5vfib1h53.php/
- cnjw####.cyou/php/iji.php/
- cnjw####.cyou/php/iov8u6.php/
- cnjw####.cyou/php/itgvw.php/
- cnjw####.cyou/php/ivol2g.php/
- cnjw####.cyou/php/j8t.php/
- cnjw####.cyou/php/ja20b3cjcvc.php/
- cnjw####.cyou/php/jkxrpqayk6s36ss0g.php/
- cnjw####.cyou/php/jq5qc.php/
- cnjw####.cyou/php/jrszheqeutvi7n.php/
- cnjw####.cyou/php/k.php/
- cnjw####.cyou/php/kl6e6r34g35xlmat.php/
- cnjw####.cyou/php/ko0y.php/
- cnjw####.cyou/php/kypp8xw3c2zh.php/
- cnjw####.cyou/php/l8pefplr237mwwlfyf1y.php/
- cnjw####.cyou/php/lm5bpfs9u87ski.php/
- cnjw####.cyou/php/lo.php/
- cnjw####.cyou/php/lo0540x05ktc29b6asf.php/
- cnjw####.cyou/php/mngjoy5qo.php/
- cnjw####.cyou/php/mt8ay.php/
- cnjw####.cyou/php/mya9d73z404kha.php/
- cnjw####.cyou/php/njqbhz8t532f70spw.php/
- cnjw####.cyou/php/npb6egr.php/
- cnjw####.cyou/php/ns58r9m.php/
- cnjw####.cyou/php/nyo7h8ilhrnpe.php/
- cnjw####.cyou/php/o17ustev2pf52qw3qgjh.php/
- cnjw####.cyou/php/o9wfse6k.php/
- cnjw####.cyou/php/oap9iyp6kyv0.php/
- cnjw####.cyou/php/ps.php/
- cnjw####.cyou/php/pwqxh0ovp4.php/
- cnjw####.cyou/php/q7niao9pvay0s27l.php/
- cnjw####.cyou/php/quduv9v33x5wlb.php/
- cnjw####.cyou/php/qun.php/
- cnjw####.cyou/php/qwlq87yelfvt.php/
- cnjw####.cyou/php/qxt0.php/
- cnjw####.cyou/php/qy.php/
- cnjw####.cyou/php/rabg06fm7fk7x59zy.php/
- cnjw####.cyou/php/rhiq.php/
- cnjw####.cyou/php/rvt2nb67xokhqcd.php/
- cnjw####.cyou/php/swtc.php/
- cnjw####.cyou/php/t2xh.php/
- cnjw####.cyou/php/t6obyha21.php/
- cnjw####.cyou/php/tl4aanbly2ex4.php/
- cnjw####.cyou/php/tvgov43h6byyxj.php/
- cnjw####.cyou/php/u3b2vgfcaqshzaisxw.php/
- cnjw####.cyou/php/uep0jo.php/
- cnjw####.cyou/php/uhswc88b34tiwglq.php/
- cnjw####.cyou/php/uzlwep.php/
- cnjw####.cyou/php/vbvp3ilqgfgr.php/
- cnjw####.cyou/php/vjh5zo5l56ubi.php/
- cnjw####.cyou/php/vkhy88ahzjq4id26q.php/
- cnjw####.cyou/php/vnfb5557.php/
- cnjw####.cyou/php/vv.php/
- cnjw####.cyou/php/vxlpkw2yei.php/
- cnjw####.cyou/php/vz8.php/
- cnjw####.cyou/php/w53hc2c03.php/
- cnjw####.cyou/php/w65vc.php/
- cnjw####.cyou/php/wdlch5h9s2tlkmv.php/
- cnjw####.cyou/php/wyjvjpuwgi6.php/
- cnjw####.cyou/php/x1f6ghponbx.php/
- cnjw####.cyou/php/xh.php/
- cnjw####.cyou/php/xmlg45ci7kf.php/
- cnjw####.cyou/php/xshk7xe57y.php/
- cnjw####.cyou/php/y.php/
- cnjw####.cyou/php/y0436nc4h9q8cg6ubm.php/
- cnjw####.cyou/php/y3ao61gtpu.php/
- cnjw####.cyou/php/y9uew9ylzusaf.php/
- cnjw####.cyou/php/yggsu0unfbxlpwohbt9.php/
- cnjw####.cyou/php/yy9gof2x.php/
- cnjw####.cyou/php/z.php/
- cnjw####.cyou/php/z7b0fdc7jw3ky534t1.php/
- cnjw####.cyou/php/zgb3zqyupchi60gbh.php/
- cnjw####.cyou/php/zh6.php/
- cnjw####.cyou/php/zm9cblhvzotcvozdfgyv.php/
- cnjw####.cyou/php/zw8l0ohtxb6fht6s.php/
File system changes:
Creates the following files:
- /com.jonubayizibolami.gaje/no_backup/androidx.work.workdb
- /com.jonubayizibolami.gaje/no_backup/androidx.work.workdb-shm
- /com.jonubayizibolami.gaje/no_backup/androidx.work.workdb-wal
- /data/misc/####/primary.prof
- /data/user/####/androidx.work.workdb-journal
- /data/user/####/androidx.work.workdb-wal
- /data/user/####/settings.xml
- /data/user/####/sox.json
- /data/user/####/sox.json.cur.prof
- /data/user/####/sox.vdex
Miscellaneous:
Accesses the ITelephony private interface.
Accesses camera interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Gets information about installed apps.
Displays its own windows over windows of other apps.
Intercepts notifications.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.