Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.BankBot.Ermac.6.origin
Детект на основе машинного обучения.
Сетевая активность:
Подключается к:
- UDP(???) acco####.go####.com:443
- UDP(???) www.gst####.com:443
- UDP(DNS) <Google DNS>
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) ch####.store:80
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) content####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) dl.go####.com:443
- TCP(TLS/1.0) acco####.you####.com:443
- TCP(TLS/1.0) acco####.go####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
Запросы DNS:
- acco####.go####.com
- acco####.you####.com
- ch####.store
- clients####.google####.com
- content####.google####.com
- dl.go####.com
- ed####.me.g####.com
- f####.gst####.com
- p####.go####.com
- uie####.asia
- up####.google####.com
- www.go####.com
- www.gst####.com
Запросы HTTP GET:
- ch####.store/socket.io/?EIO=####&transport=####
Запросы HTTP POST:
- ch####.store/php/0fcq37j.php/
- ch####.store/php/2cco9swqbeyzb7d9j.php/
- ch####.store/php/2g8fq2omepnhikoe7v.php/
- ch####.store/php/2ovh76vj0.php/
- ch####.store/php/2rn89fk3fo4q8.php/
- ch####.store/php/3.php/
- ch####.store/php/31hwo7esrzaxsh92vh.php/
- ch####.store/php/4tjwhcczs38pp.php/
- ch####.store/php/67i0rnv81xzfmu3vupnw.php/
- ch####.store/php/6joek5ty4.php/
- ch####.store/php/6lwejf9deo.php/
- ch####.store/php/7c6qxgeggc2m.php/
- ch####.store/php/7n9rtq1dscugr2tamsm.php/
- ch####.store/php/7y74vdj64.php/
- ch####.store/php/a7fh2l2i5j0ugh.php/
- ch####.store/php/ag09bqldpzwxn4e.php/
- ch####.store/php/aq630.php/
- ch####.store/php/axh9qv28qd6jl.php/
- ch####.store/php/bad6mmgi9lyfabdhjo6.php/
- ch####.store/php/blf39xphpbzw0cucpgd.php/
- ch####.store/php/bs93hx843ore2jyre3.php/
- ch####.store/php/c7ckzcdigbl37lqs1ljn.php/
- ch####.store/php/c8jp.php/
- ch####.store/php/cao.php/
- ch####.store/php/cgrafjnkt65.php/
- ch####.store/php/cicsyqmr6mwkv1qup.php/
- ch####.store/php/csx9os5q.php/
- ch####.store/php/d1ip1njfahbj.php/
- ch####.store/php/d3gahwzb.php/
- ch####.store/php/dvm4lf.php/
- ch####.store/php/e13y0m07rxoo31.php/
- ch####.store/php/eoq1dldc5edzst3w.php/
- ch####.store/php/eos8no9eoaqolb9jng.php/
- ch####.store/php/ey6u.php/
- ch####.store/php/f9ibjbfogubys5p.php/
- ch####.store/php/gbr.php/
- ch####.store/php/gi6j9qi.php/
- ch####.store/php/gxjaop4lzjgja9.php/
- ch####.store/php/gyd.php/
- ch####.store/php/hfpzbfhn3rztq51qf.php/
- ch####.store/php/hx3hhed936goahys.php/
- ch####.store/php/iffk7n6g817e8.php/
- ch####.store/php/ji37y.php/
- ch####.store/php/k2wiq.php/
- ch####.store/php/kdztyrv6dvt09n.php/
- ch####.store/php/l10ztrk9d9625pnl46d.php/
- ch####.store/php/l2dlroxo9e3ojck8.php/
- ch####.store/php/l6a9h8smyk2j4.php/
- ch####.store/php/l94z7b.php/
- ch####.store/php/lgt1c8.php/
- ch####.store/php/maepcvv2kknupncbt6t.php/
- ch####.store/php/mhvstoywk2vpuyyv1c.php/
- ch####.store/php/mqvggsxp4.php/
- ch####.store/php/n.php/
- ch####.store/php/n1lvzx4dwn.php/
- ch####.store/php/n7u9x20xzx.php/
- ch####.store/php/ndo2.php/
- ch####.store/php/nk8bt6m.php/
- ch####.store/php/nnzi6qwgc.php/
- ch####.store/php/nu6deie1ya.php/
- ch####.store/php/nwlss16or6gse.php/
- ch####.store/php/oal100ihfne.php/
- ch####.store/php/or9ad.php/
- ch####.store/php/p6uohka88.php/
- ch####.store/php/q4ohgu8x79.php/
- ch####.store/php/q5hmsnz.php/
- ch####.store/php/qq.php/
- ch####.store/php/r.php/
- ch####.store/php/ra7.php/
- ch####.store/php/sbn5gul.php/
- ch####.store/php/sgbnb7dcynz48jh.php/
- ch####.store/php/srnbhtol3paze2ncriw.php/
- ch####.store/php/t1yq.php/
- ch####.store/php/tjbpike3909151kujs7.php/
- ch####.store/php/tom.php/
- ch####.store/php/u2.php/
- ch####.store/php/ud51ctw9lo9tt2yj493.php/
- ch####.store/php/uhnmlb.php/
- ch####.store/php/umx0y0csl5.php/
- ch####.store/php/w.php/
- ch####.store/php/wc.php/
- ch####.store/php/wtkvl7e1.php/
- ch####.store/php/x43wl922m57jfxy7nnxk.php/
- ch####.store/php/x7wv.php/
- ch####.store/php/yudjqt5g6e25.php/
- ch####.store/php/zixex1fw.php/
- ch####.store/socket.io/?EIO=####&transport=####
Изменения в файловой системе:
Создает следующие файлы:
- /com.fukuhulemagi.gegi/app_webview/####/000003.log
- /com.fukuhulemagi.gegi/app_webview/####/Cookies
- /com.fukuhulemagi.gegi/app_webview/####/LOCK
- /com.fukuhulemagi.gegi/app_webview/####/LOG
- /com.fukuhulemagi.gegi/app_webview/####/MANIFEST-000001
- /com.fukuhulemagi.gegi/app_webview/####/Web Data
- /com.fukuhulemagi.gegi/app_webview/####/Web Data-journal
- /com.fukuhulemagi.gegi/app_webview/webview_data.lock
- /com.fukuhulemagi.gegi/no_backup/androidx.work.workdb
- /com.fukuhulemagi.gegi/no_backup/androidx.work.workdb-shm
- /com.fukuhulemagi.gegi/no_backup/androidx.work.workdb-wal
- /data/misc/####/primary.prof
- /data/user/####/.org.chromium.Chromium.0kOkKh (deleted)
- /data/user/####/000001.dbtmp
- /data/user/####/0535d838cc793714_0
- /data/user/####/094fd961e6d1159d_0
- /data/user/####/114723717085e67f_0
- /data/user/####/16a09e6957b729ea_0
- /data/user/####/2e36782378ea8bb1_0
- /data/user/####/33166b95042feb2d_0
- /data/user/####/35e0b20743a202df_0
- /data/user/####/3ec5651274bb7778_0
- /data/user/####/42360a480d7d8afb_0
- /data/user/####/42ff27d59a47d1f3_0
- /data/user/####/603318339e95fcf5_0
- /data/user/####/7effd90cee2146da_0
- /data/user/####/8270618f32d0add7_0
- /data/user/####/8e10f629c9990b58_0
- /data/user/####/96b17042dd37cd86_0
- /data/user/####/BrowserMetrics-spare.pma
- /data/user/####/CURRENT
- /data/user/####/Cookies-journal
- /data/user/####/MANIFEST-000001
- /data/user/####/WebViewChromiumPrefs.xml
- /data/user/####/a746c227fadd0341_0
- /data/user/####/ae246da70bc5d4f9_0
- /data/user/####/androidx.work.workdb-wal
- /data/user/####/b991d48d660f3c00_0
- /data/user/####/b9e0c77db73faf7b_0
- /data/user/####/c368f8d71a2a25e9_0
- /data/user/####/e13f2daf36ad18c3_0
- /data/user/####/e7883a0ba319b6cd_0
- /data/user/####/f2425866324a0c81_0
- /data/user/####/f40983292d9d3921_0
- /data/user/####/f536d18bbc6028a2_0
- /data/user/####/fcd2c2fb55f1de58_0
- /data/user/####/font_unique_name_table.pb
- /data/user/####/index
- /data/user/####/pref_store
- /data/user/####/settings.dat
- /data/user/####/settings.xml
- /data/user/####/settings.xml.bak
- /data/user/####/temp-index
- /data/user/####/the-real-index
- /data/user/####/todelete_1ee8e579fbed50e4_0_1 (deleted)
- /data/user/####/todelete_7e5271d65b027836_0_1 (deleted)
- /data/user/####/todelete_c802dee663c2a7b8_0_1 (deleted)
- /data/user/####/todelete_d57e111deba96e3a_0_1 (deleted)
- /data/user/####/todelete_e244630a90af53b1_0_1 (deleted)
- /data/user/####/todelete_ead9e48e1d6c6a56_0_1 (deleted)
- /data/user/####/todelete_f2347facc1e193e7_0_1 (deleted)
- /data/user/####/variations_seed_new
- /data/user/####/variations_stamp
- /data/user/####/xYYta.json
- /data/user/####/xYYta.json.cur.prof
Другие:
Перехватывает уведомления.
Запрашивает разрешение на отображение системных уведомлений.
Имеет подозрительные повреждения, типичные для вредоносных файлов.
Пытается определить окружение песочницы.
