Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.675.origin
Threat detection based on machine learning.
File system changes:
Creates the following files:
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a
- /data/data/####/a-journal
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/fluces.flap876.sour
- /data/data/####/fluces.flap876.sour.xml
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/oNUby.dex
- /data/data/####/oNUby.dex.flock (deleted)
- /data/data/####/oNUby.json
- /data/data/####/the-real-index
- /data/media/####/log.txt
Miscellaneous:
Uses the following algorithms to encrypt data:
- PBEWithMD5AndDES
Uses the following algorithms to decrypt data:
- PBEWithMD5AndDES
- RSA-ECB-PKCS1Padding
Accesses the ITelephony private interface.
Gets information about network.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Intercepts notifications.
Requests the system alert window permission.
