Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.687.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) onyuzyo####.eba.gov.tr:443
- TCP(TLS/1.0) 2####.85.233.95:443
- TCP(TLS/1.0) w####.eba.gov.tr:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) ebaasi####.eba.gov.tr:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) cdnv####.eba.gov.tr:443
- TCP(TLS/1.0) cd####.eba.gov.tr:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) u####.com:443
- TCP(TLS/1.2) 1####.194.73.94:443
- TCP(TLS/1.2) 1####.194.221.101:443
- TCP(TLS/1.2) p####.google####.com:443
DNS requests:
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- cd####.eba.gov.tr
- cdnv####.eba.gov.tr
- ebaasi####.eba.gov.tr
- f####.google####.com
- f####.gst####.com
- instant####.google####.com
- m####.go####.com
- md####.google####.com
- onyuzyo####.eba.gov.tr
- p####.google####.com
- u####.com
- w####.eba.gov.tr
- www.google-####.com
- www.googlet####.com
File system changes:
Creates the following files:
- /data/data/####/006380d5f803de8f_0
- /data/data/####/006380d5f803de8f_1
- /data/data/####/03a74d8584801272_0
- /data/data/####/03a74d8584801272_1
- /data/data/####/0915d595da02f326_0
- /data/data/####/0915d595da02f326_1
- /data/data/####/0c856e84e6f3eddf_0
- /data/data/####/10d21a47ec8b5410_0
- /data/data/####/10d21a47ec8b5410_1
- /data/data/####/14f2eafd674a479c_0
- /data/data/####/14f2eafd674a479c_1
- /data/data/####/164d2e8d460f9fcf_0
- /data/data/####/177328847fe70073_0
- /data/data/####/177328847fe70073_1
- /data/data/####/185d54499e3a6540_0
- /data/data/####/1976138f3efb1694_0
- /data/data/####/1976138f3efb1694_1
- /data/data/####/1afea2a7a1d10890_0
- /data/data/####/25a20401fee17bcf_0
- /data/data/####/25a20401fee17bcf_1
- /data/data/####/25f1499f73c52c11_0
- /data/data/####/2940195bd9870d6e_0
- /data/data/####/2940195bd9870d6e_1
- /data/data/####/2ab65fd4992c29bd_0
- /data/data/####/2b4d51ada38399a0_0
- /data/data/####/2c059df4ea4fa42d_0
- /data/data/####/2d714e198e424766_0
- /data/data/####/31366ea10b14027b_0
- /data/data/####/32b1b2b596454f69_0
- /data/data/####/32f4a9a3b0a89793_0
- /data/data/####/37ca075d61c8a0b0_0
- /data/data/####/3b11502e21f217c1_0
- /data/data/####/3be9df44ffff45cf_0
- /data/data/####/3c61e6a2a17ea142_0
- /data/data/####/4067ee3d173466ac_0
- /data/data/####/4067ee3d173466ac_1
- /data/data/####/41399af53283a041_0
- /data/data/####/41399af53283a041_1
- /data/data/####/427df09bd238615c_0
- /data/data/####/427df09bd238615c_1
- /data/data/####/45f394dc27a2ba2e_0
- /data/data/####/46027ced47d6bc2e_0
- /data/data/####/46027ced47d6bc2e_1
- /data/data/####/470f22c6b59d59f4_0
- /data/data/####/470f22c6b59d59f4_1
- /data/data/####/49646b8b0fa44286_0
- /data/data/####/513eedbba511878f_0
- /data/data/####/52ec9544a7cd89f8_0
- /data/data/####/57b825664eed1438_0
- /data/data/####/62b3670425d85c4a_0
- /data/data/####/682309ed13d15d42_0
- /data/data/####/6baf67d1f0f61e33_0
- /data/data/####/6baf67d1f0f61e33_1
- /data/data/####/6cd1d224dd4ad33c_0
- /data/data/####/6ce06dd4e6e99260_0
- /data/data/####/6e1c6ebe310df726_0
- /data/data/####/8099e44831344ccb_0
- /data/data/####/8245661639b4f662_0
- /data/data/####/839a3083683fd791_0
- /data/data/####/839a3083683fd791_1
- /data/data/####/8784f1671fc91788_0
- /data/data/####/89ae3fc727c75af6_0
- /data/data/####/925b9ee6344cca1c_0
- /data/data/####/925b9ee6344cca1c_1
- /data/data/####/92db67038c4f4f62_0
- /data/data/####/935b90d86b8080a0_0
- /data/data/####/935b90d86b8080a0_1
- /data/data/####/981de479b7431368_0
- /data/data/####/981de479b7431368_1
- /data/data/####/9d90638aec486493_0
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a2efe0bc31b8bdbe_0
- /data/data/####/a2efe0bc31b8bdbe_1
- /data/data/####/a4059ea9f76ef475_0
- /data/data/####/a47edae1dd60b843_0
- /data/data/####/a47edae1dd60b843_1
- /data/data/####/a53d0f748745abf3_0
- /data/data/####/a5f68674a9e7608e_0
- /data/data/####/ab1d514d3ea6a003_0
- /data/data/####/afb99eca68946fdc_0
- /data/data/####/b0a1cde564123d6e_0
- /data/data/####/b4499cacf45829fa_0
- /data/data/####/b6508c85d87ecaac_0
- /data/data/####/b8f58f1b6ff4ff8a_0
- /data/data/####/bbddac80b23de488_0
- /data/data/####/c0abbee2fe1dcb75_0
- /data/data/####/c25164b49ca2dd90_0
- /data/data/####/c25164b49ca2dd90_1
- /data/data/####/d23423e1c407485f_0
- /data/data/####/d2f66302191d24a1_0
- /data/data/####/d8f9243a04e95eac_0
- /data/data/####/d8f9243a04e95eac_1
- /data/data/####/dfc048c97e688470_0
- /data/data/####/e06f8f3b94e1bf0a_0
- /data/data/####/e14c00ecd51f71f5_0
- /data/data/####/e3ebace8b27da496_0
- /data/data/####/ed877c334d9cdd92_0
- /data/data/####/ef647e77f9de3bc6_0
- /data/data/####/ef647e77f9de3bc6_1
- /data/data/####/f521e97b6e16cd1c_0
- /data/data/####/fa298b93772894eb_0
- /data/data/####/fe36108e67ddd072_0
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/music.ill.survey_preferences.xml
- /data/data/####/pO.dex
- /data/data/####/pO.dex.flock (deleted)
- /data/data/####/pO.json
- /data/data/####/ring0.xml
- /data/data/####/ring0.xml.bak
- /data/data/####/the-real-index
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_DynamicOptDex/pO.json --oat-fd=33 --oat-location=/data/user/0/<Package>/app_DynamicOptDex/pO.dex --compiler-filter=speed
Gets information about network.
Gets information about active device administrators.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Intercepts notifications.
