Android.Spy.8724

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Spy.1486.origin

Network activity:

Connects to:

UDP(???) analy####.ah####.com:443
UDP(DNS) <Google DNS>
TCP(TLS/1.0) tw####.com:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) 91p####.com:443
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) yjmti####.i1zxf53####.com:4516
TCP(TLS/1.0) analy####.ah####.com:443
TCP(TLS/1.0) ed####.me.g####.com:443

DNS requests:

91p####.com
analy####.ah####.com
analy####.go####.com
ed####.me.g####.com
s####.g.doublec####.net
sv####.5q7####.cc
tw####.com
up####.google####.com
www.go####.ru
www.googlet####.com
yjmti####.i1zxf53####.com

File system changes:

Creates the following files:

/app_webview/BrowserMetrics/BrowserMetrics-6AB383C5-EFE.pma (deleted)
/app_webview/Default/####/000003.log
/app_webview/Default/####/LOCK
/app_webview/Default/####/LOG
/app_webview/Default/####/MANIFEST-000001
/app_webview/Default/Cookies
/app_webview/Default/Web Data
/app_webview/Default/Web Data-journal
/app_webview/webview_data.lock
/cache/WebView/####/0f771a83e6d8caf5_0
/cache/WebView/####/125dabcf153887b0_0
/cache/WebView/####/199400ab99e5aca6_0
/cache/WebView/####/2477fb5f68028b50_0
/cache/WebView/####/364f3b95f04a766c_0
/cache/WebView/####/4e60d150dcd6bfd7_0
/cache/WebView/####/51fc8d76923b2397_0
/cache/WebView/####/580eb4b2b35daf26_0
/cache/WebView/####/5fd9425faf6d5de8_0
/cache/WebView/####/68403a9e3b169684_0
/cache/WebView/####/6a280b97365b8479_0
/cache/WebView/####/8ced82134c5fdafe_0
/cache/WebView/####/92b3bbbaf1b1e746_0
/cache/WebView/####/a68b26f617c45041_0
/cache/WebView/####/aef10af73fef638b_0
/cache/WebView/####/d5517ca9284939f7_0
/cache/WebView/####/e8127545669b8a54_0
/cache/WebView/####/ee9c41ebb1b80efe_0
/data/data/####/.org.chromium.Chromium.2A6nrP (deleted)
/data/data/####/.org.chromium.Chromium.JTzNSr
/data/data/####/.org.chromium.Chromium.TrgRsB (deleted)
/data/data/####/.org.chromium.Chromium.YZT6Cf
/data/data/####/.org.chromium.Chromium.kXv41T (deleted)
/data/data/####/000001.dbtmp
/data/data/####/0aa26bf738581519_0
/data/data/####/0f771a83e6d8caf5_0
/data/data/####/125dabcf153887b0_0
/data/data/####/199400ab99e5aca6_0
/data/data/####/2477fb5f68028b50_0
/data/data/####/29f11414eec9588e_0
/data/data/####/35262ec57c1d0195_0
/data/data/####/364f3b95f04a766c_0
/data/data/####/426c1b7620e69e2a_0
/data/data/####/490d26fa0c93c12d_0
/data/data/####/4e60d150dcd6bfd7_0
/data/data/####/4f4921751f055da0_0
/data/data/####/51fc8d76923b2397_0
/data/data/####/5381fd19bb485aec_0
/data/data/####/580eb4b2b35daf26_0
/data/data/####/5fd9425faf6d5de8_0
/data/data/####/6a280b97365b8479_0
/data/data/####/840e60d7f30996e5_0
/data/data/####/85063dc983919746_0
/data/data/####/8ced82134c5fdafe_0
/data/data/####/92b3bbbaf1b1e746_0
/data/data/####/BrowserMetrics-spare.pma.tmp
/data/data/####/CURRENT
/data/data/####/Cookies-journal
/data/data/####/LOCK
/data/data/####/LOCK (deleted)
/data/data/####/MANIFEST-000001
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a354e85c0d2973c9_0
/data/data/####/a68b26f617c45041_0
/data/data/####/aef10af73fef638b_0
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/androidx.work.workdb-wal
/data/data/####/androidx.work.workdb.lck
/data/data/####/b0e5d9a2eac0a4f9_0
/data/data/####/b15a1772cc3d0cd0_0
/data/data/####/cb4e34e8037e7446_0
/data/data/####/classes.dex
/data/data/####/classes.dex.cur.prof
/data/data/####/classes.vdex
/data/data/####/classes2.dex
/data/data/####/classes2.dex.cur.prof
/data/data/####/classes2.vdex
/data/data/####/classes3.dex
/data/data/####/classes3.dex.cur.prof
/data/data/####/classes3.vdex
/data/data/####/classes4.dex
/data/data/####/classes4.dex.cur.prof
/data/data/####/classes4.vdex
/data/data/####/d4e4d75dec9d5e86_0
/data/data/####/d5517ca9284939f7_0
/data/data/####/e3512f7c787568b3_0
/data/data/####/ee9c41ebb1b80efe_0
/data/data/####/font_unique_name_table.pb
/data/data/####/index
/data/data/####/myc7xq.zjv45j.kqrgfjq.xml
/data/data/####/settings.dat
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/todelete_0f771a83e6d8caf5_0_1 (deleted)
/data/data/####/todelete_125dabcf153887b0_0_1 (deleted)
/data/data/####/todelete_199400ab99e5aca6_0_1 (deleted)
/data/data/####/todelete_2477fb5f68028b50_0_1 (deleted)
/data/data/####/todelete_364f3b95f04a766c_0_1 (deleted)
/data/data/####/todelete_39d2b17637227d02_0_1 (deleted)
/data/data/####/todelete_4e60d150dcd6bfd7_0_1 (deleted)
/data/data/####/todelete_51fc8d76923b2397_0_1 (deleted)
/data/data/####/todelete_5381fd19bb485aec_0_1 (deleted)
/data/data/####/todelete_580eb4b2b35daf26_0_1 (deleted)
/data/data/####/todelete_68403a9e3b169684_0_1 (deleted)
/data/data/####/todelete_82aa3dbcb576a061_0_1 (deleted)
/data/data/####/todelete_8ced82134c5fdafe_0_1 (deleted)
/data/data/####/todelete_92b3bbbaf1b1e746_0_1 (deleted)
/data/data/####/todelete_a68b26f617c45041_0_1 (deleted)
/data/data/####/todelete_aef10af73fef638b_0_1 (deleted)
/data/data/####/todelete_b3b6cdba241ea1e6_0_1 (deleted)
/data/data/####/todelete_d5517ca9284939f7_0_1 (deleted)
/data/data/####/todelete_ee9c41ebb1b80efe_0_1 (deleted)
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/no_backup/androidx.work.workdb
/no_backup/androidx.work.workdb-shm
/no_backup/androidx.work.workdb-wal

Miscellaneous:

Executes the following shell scripts:

/system/bin/app_process64 /system/bin --application org.chromium.components.crash.browser.CrashpadMain /system/bin/app_process64 --sanitization-information=0x1c78000204e0 --write-minidump-to-log --database=/data/user/0/<Package>/cache/WebView/Crashpad --annotation=abi_name=x86_64, x86 --annotation=android_build_fp=<System Property>/drw_x86_64/dimas_x86_64:12/SP2A.220505.008/eng.develo.20260610.110942:eng/test-keys --annotation=android_build_id=SP2A.220505.008 --annotation=board=goldfish_x86_64 --annotation=brand=<System Property> --annotation=channel=unknown --annotation=custom_themes=false --annotation=device=dimas_x86_64 --annotation=gms_core_version=gms versionCode not available. --annotation=installer_package_name= --annotation=model=SM-G780G --annotation=plat=Android --annotation=prod=AndroidWebView --annotation=ptype=browser --annotation=resources_version=Not Enabled --annotation=sdk=32 --annotation=ver=95.0.4638.74 --trace-parent-with-exception=0x1c78000b8808

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

Contains hidden alternative main activities.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial