Android.Banker.8239

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Banker.1216.origin

Network activity:

Connects to:

UDP(???) sexydix####.firebas####.com:443
UDP(???) en####.sexy####.com:443
UDP(???) firebas####.google####.com:443
UDP(???) p####.l.go####.com:443
UDP(DNS) <Google DNS>
TCP(TLS/1.0) ed####.me.g####.com:443
TCP(TLS/1.0) parash####.com:56270
TCP(TLS/1.0) p####.l.go####.com:443
TCP(TLS/1.0) parash####.com:39578
TCP(TLS/1.0) sexydix####.b####.net:443
TCP(TLS/1.0) ifco####.io:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) st####.cloudfl####.com:443
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) th####.only####.com:443
TCP(TLS/1.0) pre####.r####.it:443
TCP(TLS/1.0) sexytik####.co:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) sexydix####.firebas####.com:443
TCP(TLS/1.0) www.go####.ru:443
TCP(TLS/1.0) analy####.go####.com:443
TCP(TLS/1.0) en####.sexy####.com:443
TCP(TLS/1.0) quarter####.info:443
TCP(TLS/1.0) sexydix####.com:443
TCP(TLS/1.0) sdads####.b####.net:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) 1####.1.1.1:443
TCP(TLS/1.0) us-cent####.cloudfu####.net:443
TCP(TLS/1.2) 1####.0.9.254:39910
TCP(TLS/1.2) 1####.0.9.254:45356
TCP(TLS/1.2) 1####.0.9.254:47634
TCP(TLS/1.2) 1####.0.9.254:38554
TCP(TLS/1.2) 1####.0.9.254:41720

DNS requests:

analy####.go####.com
ed####.me.g####.com
en####.sexy####.com
externa####.r####.it
f####.gst####.com
fire####.google####.com
firebas####.google####.com
ifco####.io
p####.l.go####.com
parash####.com
pre####.r####.it
quarter####.info
s####.g.doublec####.net
sdads####.b####.net
sexy####.com
sexydix####.b####.net
sexydix####.b####.net
sexydix####.com
sexydix####.firebas####.com
sexytik####.co
st####.cloudfl####.com
th####.only####.com
up####.google####.com
us-cent####.cloudfu####.net
vz-5b86####.b####.net
www.go####.ru
www.google####.com
www.googlet####.com

File system changes:

Creates the following files:

/app_webview/Default/####/000003.log
/app_webview/Default/####/000004.log
/app_webview/Default/####/Databases.db
/app_webview/Default/####/Databases.db-journal
/app_webview/Default/####/LOCK
/app_webview/Default/####/LOG
/app_webview/Default/####/MANIFEST-000001
/app_webview/Default/Cookies
/app_webview/Default/QuotaManager
/app_webview/Default/QuotaManager-journal
/app_webview/Default/Web Data
/app_webview/Default/Web Data-journal
/app_webview/webview_data.lock
/app_webview_overlay_process/Default/####/000003.log
/app_webview_overlay_process/Default/####/LOCK
/app_webview_overlay_process/Default/####/LOG
/app_webview_overlay_process/Default/####/MANIFEST-000001
/app_webview_overlay_process/Default/Web Data
/app_webview_overlay_process/Default/Web Data-journal
/app_webview_overlay_process/webview_data.lock
/cache/WebView/####/270d79934ebc4f99_0
/cache/WebView/####/39ed394ff936bdc0_0
/cache/WebView/####/3edd47d9bd7e6a6a_0
/cache/WebView/####/656f018571eed22b_0
/cache/WebView/####/77f26a410d1077c8_0
/cache/WebView/####/78cdd49b8a6048bb_0
/cache/WebView/####/8275c3dba02796cc_0
/cache/WebView/####/90c477163017e7a4_0
/cache/WebView/####/97456e85aacfbbbb_0
/cache/WebView/####/cc4c7a1b780a28e7_0
/cache/WebView/####/e04e9c6d2c434cbc_0
/cache/WebView/####/f232a71abb83ee2b_0
/cache/WebView/####/fb5328d08e98b61e_0
/cache/doh_cache/journal
/data/data/####/.org.chromium.Chromium.RoeOui (deleted)
/data/data/####/.org.chromium.Chromium.pGvMAe
/data/data/####/000001.dbtmp
/data/data/####/000003.log
/data/data/####/000005.ldb
/data/data/####/0006e40c3106ab26_0
/data/data/####/008b4776c2a32711_0
/data/data/####/01dcc8bc83eb097b_0
/data/data/####/02c0234fa1088003_0
/data/data/####/03607921ea7b6d77_0
/data/data/####/053afcb7ab6231c2_0
/data/data/####/0599ad42a13de253_0
/data/data/####/061fdca8532283cc_0
/data/data/####/0a4a6b4debeb332c_0
/data/data/####/0a9a99eb427013d0_0
/data/data/####/0e798de344456bdbd3fcc12a5f302fdf.0.tmp
/data/data/####/0e798de344456bdbd3fcc12a5f302fdf.1.tmp
/data/data/####/152a081ba8f145c3_0
/data/data/####/15aed986206f1e92_0
/data/data/####/1b2767a12b2c49ccb910c8ca1a7c29c4.envelope
/data/data/####/1c2812de0d3c2440_0
/data/data/####/1db3b5d579db95f4_0
/data/data/####/1e10fd3e97e34f00_0
/data/data/####/20fc62d3ba7f7973_0
/data/data/####/230f7914374c9ec0_0
/data/data/####/2a8a75772b556d91_0
/data/data/####/2d39b17cb9f4443c_0
/data/data/####/3033016adf329aa4_0
/data/data/####/33b951f7dd879156_0
/data/data/####/35bc3ff35147eb49_0
/data/data/####/38254069ad893974_0
/data/data/####/39405d224f8bbb95_0
/data/data/####/3a338f55ab620ac7_0
/data/data/####/3abbf92358e7e950_0
/data/data/####/3b5037a4d7dcf113_0
/data/data/####/3bbacca859672c24_0
/data/data/####/3c28accbc12fccc8_0
/data/data/####/3deced2c3d4c8e47_0
/data/data/####/431b34ff43c06ca7_0
/data/data/####/4487ef61dd9bb89a_0
/data/data/####/448afa8f332faeb0_0
/data/data/####/4555467b5a34e22b_0
/data/data/####/4a75908de50d617a_0
/data/data/####/4ba37280a33aeaad_0
/data/data/####/4c49a8ac14028f01_0
/data/data/####/50d07766e2a2c166_0
/data/data/####/58e7eee115be5f19_0
/data/data/####/5d24e8fa574e25c7_0
/data/data/####/5dfa1ad94d3af19b_0
/data/data/####/5f79928cb8d12630_0
/data/data/####/60ced264eb2dfbb3_0
/data/data/####/61f1c66d3d94abb1_0
/data/data/####/6caf28ea9ce1e96d_0
/data/data/####/6f2df2541291222d_0
/data/data/####/7b4097947a456f85_0
/data/data/####/7c0d95c44dca1505_0
/data/data/####/7cfff91b123bc863_0
/data/data/####/80637af37715863f_0
/data/data/####/81272f8dddf29067_0
/data/data/####/8388e9f6ccf9966f_0
/data/data/####/8ad29375bab8fd68_0
/data/data/####/8ea06849cdc18bbc_0
/data/data/####/8f28a392fd9faba7_0
/data/data/####/8fe0e47873dc4e6d_0
/data/data/####/993c7e79fc57b441_0
/data/data/####/9f923053facc0dc1_0
/data/data/####/BEKsbwR.jpeg
/data/data/####/BrowserMetrics-spare.pma
/data/data/####/Cookies-journal
/data/data/####/INSTALLATION
/data/data/####/MANIFEST-000001
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a1ee769279f17555_0
/data/data/####/a3fea6b5d934969e_0
/data/data/####/a46aacacc13abbda_0
/data/data/####/a695bf86c9e14d0b_0
/data/data/####/a812872ecf8382f3_0
/data/data/####/a8b68182de61b7df_0
/data/data/####/ab25b210d1ca27e3_0
/data/data/####/ad3a7d5e20df4b33_0
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/androidx.work.workdb-wal
/data/data/####/androidx.work.workdb.lck
/data/data/####/application-exits.seen
/data/data/####/application-exits.seen.lock
/data/data/####/application-exits.seen.tmp
/data/data/####/b042789ef494f890_0
/data/data/####/b1ba65cf73cb5c25_0
/data/data/####/b1fcd0270d3f79f3_0
/data/data/####/b23a33f2c8ad1100_0
/data/data/####/b5c439ba2d64c0cd_0
/data/data/####/b8b32c8e9ded97c3_0
/data/data/####/ba6bac8e70b6dace_0
/data/data/####/bde1c7bf4dc1a0a9_0
/data/data/####/be29068a7e5e25d7_0
/data/data/####/bf612cf0c4ef87d5_0
/data/data/####/breadcrumbs.json.tmp
/data/data/####/c7251b54b6cc10a5_0
/data/data/####/c78d08ac20a228a3_0
/data/data/####/ccb4751de80a6f2f_0
/data/data/####/cdc8200698d8dd41_0
/data/data/####/d335b714a14236b6_0
/data/data/####/d95cedea722248d0_0
/data/data/####/dc67af7545da16c5_0
/data/data/####/dist.json
/data/data/####/e17574f286bb517b_0
/data/data/####/e2b24eca34a73968_0
/data/data/####/e2de58f02fde5eb5_0
/data/data/####/e384c69a2f691e4e_0
/data/data/####/e95e27e57ac794be_0
/data/data/####/e9c439aaba0fc22f_0
/data/data/####/eaaf5a3f88e51ead_0
/data/data/####/environment.json
/data/data/####/f29ccbe72929b80e_0
/data/data/####/f3d78dc320dc1bfb_0
/data/data/####/f47ee97c2b1ee8b2_0
/data/data/####/f6ced6e1942f59ab_0
/data/data/####/ff793fbd5755ca40_0
/data/data/####/font_unique_name_table.pb
/data/data/####/index
/data/data/####/journal
/data/data/####/journal.bkp (deleted)
/data/data/####/last_crash
/data/data/####/net.ddulvjc.helper27uv.xml
/data/data/####/notification_persistence.xml
/data/data/####/outbox-v1.json.lock
/data/data/####/outbox-v1.json.tmp
/data/data/####/pref_store
/data/data/####/profileInstalled
/data/data/####/proguard-uuid.json
/data/data/####/release.json
/data/data/####/replay-error-sample-rate.json
/data/data/####/sdk-version.json
/data/data/####/settings.dat
/data/data/####/startup_crash
/data/data/####/tags.json
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/todelete_558b63124e7daed0_0_1 (deleted)
/data/data/####/todelete_cf2ef9d0a543fa9c_0_1 (deleted)
/data/data/####/uninstall_protection.xml
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/data/data/####/wireless_adb_identity.xml
/data/misc/####/primary.prof
/no_backup/androidx.work.workdb
/no_backup/androidx.work.workdb-shm
/no_backup/androidx.work.workdb-wal
/no_backup/sentry/####/breadcrumbs.json

Miscellaneous:

Intercepts notifications.

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial