Android.BankBot.16454

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.BankBot.1224.origin

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(???) sto####.google####.com:443
UDP(DNS) <Google DNS>
TCP(TLS/1.0) mc####.tik####.com.####.net:443
TCP(TLS/1.0) mon.tik####.com.####.net:443
TCP(TLS/1.0) abio####.cfd:443
TCP(TLS/1.0) clients####.google####.com:443
TCP(TLS/1.0) sto####.google####.com:443
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) p####.go####.com:443
TCP(TLS/1.0) ed####.me.g####.com:443
TCP(TLS/1.0) mssd####.ti####.com.####.net:443
TCP(TLS/1.0) sf16-we####.neu####.ttwst####.####.net:443
TCP(TLS/1.0) librawe####.ti####.com.####.net:443
TCP(TLS/1.0) shared-####.byt####.ak####.net:443

DNS requests:

abio####.cfd
beral####.info
clients####.google####.com
ed####.me.g####.com
lf16-ti####.ibyte####.com.####.net
librawe####.ti####.com.####.net
mc####.tik####.com.####.net
mon.tik####.com.####.net
more####.cfd
mssd####.ti####.com.####.net
p####.go####.com
sf16-we####.neu####.ttwst####.####.net
shared-####.byt####.ak####.net
sto####.google####.com
up####.google####.com

File system changes:

Creates the following files:

/app_webview/Default/####/000003.log
/app_webview/Default/####/000004.log
/app_webview/Default/####/Databases.db
/app_webview/Default/####/Databases.db-journal
/app_webview/Default/####/LOCK
/app_webview/Default/####/LOG
/app_webview/Default/####/MANIFEST-000001
/app_webview/Default/Cookies
/app_webview/Default/QuotaManager
/app_webview/Default/QuotaManager-journal
/app_webview/Default/Web Data
/app_webview/Default/Web Data-journal
/app_webview/webview_data.lock
/cache/WebView/####/685285670afd3cb6_0
/data/data/####/.org.chromium.Chromium.8FXort
/data/data/####/.org.chromium.Chromium.DGGMTd
/data/data/####/000001.dbtmp
/data/data/####/000003.log
/data/data/####/000005.ldb
/data/data/####/008e3c94c6db04e1_0
/data/data/####/00b79a838cb31d1b_0
/data/data/####/013888a1cda32b90_0
/data/data/####/01a91de4416e4cd5_0
/data/data/####/06bedc7be17efdc6_0
/data/data/####/0895da9b3dd19e73_0
/data/data/####/09b5f65aa4e96218_0
/data/data/####/0ab5da4fc37552cd_0
/data/data/####/0b4d8ce393e346a9_0
/data/data/####/0b6d0066780a370f_0
/data/data/####/0b95287ba5813b81_0
/data/data/####/0c4d3b76c935e75e_0
/data/data/####/0de0e7c2b1de79b7_0
/data/data/####/0df3d4b7a926a2d3_0
/data/data/####/11e040c9957f3e5b_0
/data/data/####/12947ec03ad2d07e_0
/data/data/####/14ecc0ad09af5b6b_0
/data/data/####/1950324d37bc4c23_0
/data/data/####/1aaf632e878f775a_0
/data/data/####/1b26bd7dd6fd61df_0
/data/data/####/1c3dd7a5fbe02002_0
/data/data/####/1c7fdd47754affa4_0
/data/data/####/1e3b6974d83fb736_0
/data/data/####/2408d75d8f4e0f60_0
/data/data/####/255fc4000fc08815_0
/data/data/####/25d41cc7de3430bc_0
/data/data/####/269629074cd42745_0
/data/data/####/288b21cf4d0f6d54_0
/data/data/####/28aa006e63395869_0
/data/data/####/2928e9da0562a42d_0
/data/data/####/297ecea5cebb5dfe_0
/data/data/####/297ecea5cebb5dfe_1
/data/data/####/299565f8703013e5_0
/data/data/####/2a1a28d7c94cab7c_0
/data/data/####/2c28cb7f373f5912_0
/data/data/####/2cc80dabc69f58b6_0
/data/data/####/2cc80dabc69f58b6_1
/data/data/####/2cf863f2283bdd20_0
/data/data/####/2e5b25ba30f13c46_0
/data/data/####/2f2cadbf73ee93c1_0
/data/data/####/3014da3d502c54c3_0
/data/data/####/3159696df5340b9c_0
/data/data/####/32043901e5c2d793_0
/data/data/####/34bf71cc0103927f_0
/data/data/####/351aceccf1317e41_0
/data/data/####/36547979e4db73dd_0
/data/data/####/36e733f4eec8c9f3_0
/data/data/####/375c7d5fe54bfd7a_0
/data/data/####/37c654fd837b74d1_0
/data/data/####/37defcdc04a794cd_0
/data/data/####/383c736c02e5d6b6_0
/data/data/####/3a08597f7fae8082_0
/data/data/####/3ee7920cfa392eb9_0
/data/data/####/3f0204d59142b992_0
/data/data/####/3ff549b7e4ce6224_0
/data/data/####/4295d7c9b7a7df79_0
/data/data/####/4305e42ac852215e_0
/data/data/####/459847c0bae43d6c_0
/data/data/####/46c51efad18f5b4b_0
/data/data/####/47a715324c59a089_0
/data/data/####/4c1c4bc8745acc69_0
/data/data/####/4c90561f9818a6de_0
/data/data/####/4cb013792b196a35_0
/data/data/####/4cb013792b196a35_1
/data/data/####/4f70fdf6f7a7e546_0
/data/data/####/5016f111310d7905_0
/data/data/####/50920be51746e6da_0
/data/data/####/5116755be447041e_0
/data/data/####/511e7f86ec245012_0
/data/data/####/530f8d4df78c5363_0
/data/data/####/53339a277e02a936_0
/data/data/####/54712ba4eaffe6c7_0
/data/data/####/549f49df77cc628e_0
/data/data/####/54c5a5f65c71b032_0
/data/data/####/55c860c888376e2f_0
/data/data/####/59974557b6561c1e_0
/data/data/####/5c5ff1ca44ffe6d7_0
/data/data/####/5db6b595ca2d3234_0
/data/data/####/5dbc18f6fc0d9dde_0
/data/data/####/5e2cc92c085da451_0
/data/data/####/602488595cd1f58f_0
/data/data/####/6025427230291aea_0
/data/data/####/61c0761412c19079_0
/data/data/####/61ca2a0fe5c5ea49_0
/data/data/####/658c521868168481_0
/data/data/####/66409c299bd8c5de_0
/data/data/####/67a473248953641b_0
/data/data/####/67a473248953641b_1
/data/data/####/67efedf2d6f5f61b_0
/data/data/####/68030aed652865ad_0
/data/data/####/69dd16ca111c0703_0
/data/data/####/6bcde0cc5ebe2e29_0
/data/data/####/6c950b82d5204294_0
/data/data/####/6ccb0d46a2ea7544_0
/data/data/####/71c2aace4dad89aa_0
/data/data/####/7245446806168b05_0
/data/data/####/7252ecaddf694f71_0
/data/data/####/728d1395a3d20337_0
/data/data/####/75ef4459761afdf3_0
/data/data/####/75febeaeeaf29cfc_0
/data/data/####/791a5f01741472c5_0
/data/data/####/7b262bc2da567b9f_0
/data/data/####/7d62574ba0e8f552_0
/data/data/####/7d6d86322fc4a1dc_0
/data/data/####/7e3505a43e48f8e2_0
/data/data/####/8329875d64723cfc_0
/data/data/####/881c59528da116ae_0
/data/data/####/892a91cb8e2f6e20_0
/data/data/####/8a41387a6de49ffb_0
/data/data/####/8b4004511220f6ea_0
/data/data/####/8be5a3995aebdadb_0
/data/data/####/8db5a2ef7030ea4c_0
/data/data/####/8f3051e360231eb0_0
/data/data/####/932133c40dd4c8ef_0
/data/data/####/933f7150c8122ccf_0
/data/data/####/944350c6a1a0073d_0
/data/data/####/95012107af81670f_0
/data/data/####/955239f88de208ca_0
/data/data/####/955a80a40f092029_0
/data/data/####/95bab42f8445c8b3_0
/data/data/####/9ac3335c6a86d7b7_0
/data/data/####/9fd45290edb0b148_0
/data/data/####/9fe8b7a1553ca884_0
/data/data/####/BrowserMetrics-spare.pma
/data/data/####/CURRENT
/data/data/####/Cookies-journal
/data/data/####/MANIFEST-000001
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a102d022829fbc33_0
/data/data/####/a2f9b4f137081405_0
/data/data/####/a3237a0f551fc40a_0
/data/data/####/a5a657edb66a2215_0
/data/data/####/aa73690ea03e2615_0
/data/data/####/aac214ebb1b27edc_0
/data/data/####/ab4f6501b51e599f_0
/data/data/####/ab6aabdafd3f5774_0
/data/data/####/abd8c25e12cf40f1_0
/data/data/####/ad14c509b0680dd6_0
/data/data/####/adf85b3ba56ebb49_0
/data/data/####/afdcca1dd54a30c3_0
/data/data/####/app_prefs.xml
/data/data/####/b69f93bfce2d3725_0
/data/data/####/b6c28cea6ed9dfc1_0
/data/data/####/b6c28cea6ed9dfc1_1
/data/data/####/b82aaf592933a8c9_0
/data/data/####/ba23d8ecda68de77_0
/data/data/####/ba23d8ecda68de77_1
/data/data/####/bc785ef2622cbe16_0
/data/data/####/c15ded030bb38a69_0
/data/data/####/c1db8cdfe7922560_0
/data/data/####/c239f4e2b8522ab3_0
/data/data/####/c2812121e32c82de_0
/data/data/####/c2b0687279711f1a_0
/data/data/####/c3df3a6e2a43fb52_0
/data/data/####/c40aa6b4aceba3af_0
/data/data/####/c53b42e0d46b2cb7_0
/data/data/####/c5842671adb3360e_0
/data/data/####/c5b11c36a349a5af_0
/data/data/####/c5e006c0ec93503f_0
/data/data/####/c610125f57f77cce_0
/data/data/####/c6e95c3f2cff134b_0
/data/data/####/c7033c229f044757_0
/data/data/####/ca1260b684cd7778_0
/data/data/####/cached_domain.xml
/data/data/####/cb08f2cac6c59131_0
/data/data/####/d0b6638a0ab59567_0
/data/data/####/d10a27a7e0a124fe_0
/data/data/####/d17cde75a6cf079c_0
/data/data/####/d496b14b744dc908_0
/data/data/####/d4a7ab82d6873e7d_0
/data/data/####/d8b6d2b06cdf60f7_0
/data/data/####/dfc031730157244b_0
/data/data/####/e2c4bcac54eb2da1_0
/data/data/####/e3257ab1ab5648d6_0
/data/data/####/e3468fd4a2b5a500_0
/data/data/####/e5063f268a9955eb_0
/data/data/####/e553dac09ceb4bf7_0
/data/data/####/e75e28977a7f9aaa_0
/data/data/####/e9601ef2afdf89a7_0
/data/data/####/ec773f8d0d32d7f9_0
/data/data/####/ed846fac3a933c02_0
/data/data/####/eee4f2436ad16408_0
/data/data/####/efbc4fa269a9d4e0_0
/data/data/####/f1cdccba37924bda_0
/data/data/####/f1cdccba37924bda_1
/data/data/####/f4189a00b9ee48e5_0
/data/data/####/f45a157973424e85_0
/data/data/####/f4b9b212e73c9de2_0
/data/data/####/f517a770ec982914_0
/data/data/####/f66e7aa7eddeac30_0
/data/data/####/f98d102aed8dc1f1_0
/data/data/####/fa590bf699323a4b_0
/data/data/####/fa813c9ad67834ac_0
/data/data/####/fa813c9ad67834ac_1
/data/data/####/fc141537f5f0328c_0
/data/data/####/fc1f445d4f04c21f_0
/data/data/####/fiYn.ico
/data/data/####/font_unique_name_table.pb
/data/data/####/guard_prefs.xml
/data/data/####/index
/data/data/####/index.txt
/data/data/####/index.txt.tmp
/data/data/####/install_flow_prefs.xml
/data/data/####/monitored_apps.db
/data/data/####/monitored_apps.db-journal
/data/data/####/notification_prefs.xml
/data/data/####/profileInstalled
/data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
/data/data/####/settings.dat
/data/data/####/smsclient_prefs.xml
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/todelete_31d19cc5ba9ec6ab_0_1 (deleted)
/data/data/####/todelete_37453417754bae3f_0_1 (deleted)
/data/data/####/todelete_391435b104164a31_0_1 (deleted)
/data/data/####/todelete_45ed2fd6f6d8c12a_0_1 (deleted)
/data/data/####/todelete_52f9060b3381e72c_0_1 (deleted)
/data/data/####/todelete_604e6ee13b69ca42_0_1 (deleted)
/data/data/####/todelete_6ca36057c3c16917_0_1 (deleted)
/data/data/####/todelete_79fbf14fbc26f8b0_0_1 (deleted)
/data/data/####/todelete_8f8ec0e2346efbbe_0_1 (deleted)
/data/data/####/todelete_959cbafc53a97865_0_1 (deleted)
/data/data/####/todelete_a48740d6c76c67c7_0_1 (deleted)
/data/data/####/todelete_a835734a6a1d8607_0_1 (deleted)
/data/data/####/todelete_af80041292377c4d_0_1 (deleted)
/data/data/####/todelete_b06eac46ebe42e92_0_1 (deleted)
/data/data/####/todelete_b2371f39a29232e5_0_1 (deleted)
/data/data/####/todelete_b52fe1ac6f905c38_0_1 (deleted)
/data/data/####/todelete_ce6208c772a10674_0_1 (deleted)
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/data/misc/####/primary.prof
/databases/monitored_apps.db

Miscellaneous:

Accesses the ITelephony private interface.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Parses information from SMS.

Intercepts notifications.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial