Android.SpyMax.230

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SpyMax.16
Android.SpyMax.17
Android.SpyMax.19
Android.SpyMax.20
Android.SpyMax.21
Android.SpyMax.22
Android.SpyMax.23
Android.SpyMax.24

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) www.go####.ru:443
TCP(TLS/1.0) s.y####.jp:443
TCP(TLS/1.0) con####.face####.net:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) t####.creativ####.com:443
TCP(TLS/1.0) am.y####.co.jp:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) st####.ads-twi####.com:443
TCP(TLS/1.0) c####.line-####.net.####.net:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) tr.l####.me:443
TCP(TLS/1.0) img.ak.impac####.jp:443
TCP(TLS/1.0) rr6---s####.g####.com:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) t####.co:443
TCP(TLS/1.0) www.app.kur####.####.jp:443
TCP(TLS/1.0) analy####.go####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) bat-bin####.a-####.a-ms####.net:443
TCP(TLS/1.0) ads.twi####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) cdn.k####.net:443
TCP(TLS/1.0) b97.y####.co.jp:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP 1####.233.210.35:27772

DNS requests:

35.210.233.####.arpa
am.y####.co.jp
analy####.go####.com
analy####.twi####.com
and####.a####.go####.com
and####.google####.com
b92.y####.co.jp
b97.y####.co.jp
b99.y####.co.jp
bat.b####.com
cdn.ad####.smt.####.jp
cdn.k####.net
con####.face####.net
connect####.gst####.com
d.line-####.net
f####.gst####.com
gmscomp####.google####.com
googl####.g.doublec####.net
img.ak.impac####.jp
m####.go####.com
p####.google####.com
pla####.google####.com
rr6---s####.g####.com
s####.g.doublec####.net
s.y####.jp
st####.ads-twi####.com
t####.co
t####.creativ####.com
tr.l####.me
www.app.kur####.####.jp
www.face####.com
www.go####.com
www.go####.ru
www.google####.com
www.google-####.com
www.googlet####.com

File system changes:

Creates the following files:

/data/data/####/00c12b3052703884_0 (deleted)
/data/data/####/01d127b600a41765_0 (deleted)
/data/data/####/0440b085aab447e7_0
/data/data/####/0440b085aab447e7_1
/data/data/####/05066ef21418a132_0 (deleted)
/data/data/####/07968b795f2c42ff_0 (deleted)
/data/data/####/0ab29cb19e7ee8c2_0
/data/data/####/0bad0504da391d41_0 (deleted)
/data/data/####/0de8bfcdb0108314_0
/data/data/####/0de8bfcdb0108314_1
/data/data/####/11612f17f0bbedbb_0 (deleted)
/data/data/####/1173d21233298766_0 (deleted)
/data/data/####/127c6ec809457a62_0 (deleted)
/data/data/####/14060389f05c4370_0 (deleted)
/data/data/####/16504816ca636024_0 (deleted)
/data/data/####/17bd30a10b241449_0 (deleted)
/data/data/####/185e2f97a0bab8f4_0 (deleted)
/data/data/####/1cb8e82e12f1700f_0 (deleted)
/data/data/####/21f265fc448f93e3_0 (deleted)
/data/data/####/22391b13c6dc96d1_0 (deleted)
/data/data/####/2345a7a4581f59ec_0
/data/data/####/2345a7a4581f59ec_1
/data/data/####/25067fc7d9670554_0
/data/data/####/278160b4d2798c51_0
/data/data/####/278160b4d2798c51_1
/data/data/####/28033d5dc4c72fc5_0 (deleted)
/data/data/####/2940195bd9870d6e_0
/data/data/####/2940195bd9870d6e_1
/data/data/####/2a923d7263262a9b_0 (deleted)
/data/data/####/2ad8b4219d7848fd_0 (deleted)
/data/data/####/2d00cc3908a1eecf_0 (deleted)
/data/data/####/2ecbcd9db710fe21_0 (deleted)
/data/data/####/2f3dd0958435fc25_0 (deleted)
/data/data/####/30d663b7c776bed9_0 (deleted)
/data/data/####/32373126703bb7f6_0 (deleted)
/data/data/####/3289907e353fa3a8_0
/data/data/####/3289907e353fa3a8_1
/data/data/####/33a02c3538c1c13f_0 (deleted)
/data/data/####/35f3137a35efe120_0
/data/data/####/35f3137a35efe120_1
/data/data/####/3d21e68b8ad08e46_0 (deleted)
/data/data/####/3eb7d831e4382cba_0 (deleted)
/data/data/####/4377500b7272435d_0 (deleted)
/data/data/####/444222660e8f4333_0
/data/data/####/444222660e8f4333_1
/data/data/####/44b011a84131e7e8_0
/data/data/####/44b011a84131e7e8_1
/data/data/####/44f371b3975441f4_0 (deleted)
/data/data/####/47065f7e16ba30ee_0 (deleted)
/data/data/####/47ce0b77cea86792_0 (deleted)
/data/data/####/495f2333a636ef5c_0
/data/data/####/495f2333a636ef5c_1
/data/data/####/4e33d15be17e76c8_0
/data/data/####/4e33d15be17e76c8_1
/data/data/####/4e5371bcf277ed5a_0 (deleted)
/data/data/####/529d0c5ed0d2b9a2_0 (deleted)
/data/data/####/54a84915a6266571_0
/data/data/####/54a84915a6266571_1
/data/data/####/55d5d3896184c526_0 (deleted)
/data/data/####/56a25c6dbaf35afc_0
/data/data/####/56a25c6dbaf35afc_1
/data/data/####/58f8ea517c3ed8cf_0 (deleted)
/data/data/####/5961ad5e92579144_0 (deleted)
/data/data/####/59d036da76545ae0_0
/data/data/####/59d036da76545ae0_1
/data/data/####/5c1bfa82f19d655a_0 (deleted)
/data/data/####/61fc4ca581fe6b01_0 (deleted)
/data/data/####/653737ceb1489bad_0 (deleted)
/data/data/####/668017db1371d75a_0
/data/data/####/668017db1371d75a_1
/data/data/####/685c9ca020aeda7f_0
/data/data/####/685c9ca020aeda7f_1
/data/data/####/698ce152d64b4d08_0
/data/data/####/698ce152d64b4d08_1
/data/data/####/69e5c348532b47a9_0 (deleted)
/data/data/####/6a8dbcc4d067c45a_0 (deleted)
/data/data/####/6b86bb68d2d627fa_0
/data/data/####/6b86bb68d2d627fa_1
/data/data/####/707efc33a8a9df36_0
/data/data/####/72950c325d6e4bfb_0
/data/data/####/72950c325d6e4bfb_1
/data/data/####/72fa440fb0813a7c_0 (deleted)
/data/data/####/745007895ccf0c3f_0 (deleted)
/data/data/####/75ce6208a1120104_0
/data/data/####/75ce6208a1120104_1
/data/data/####/7dc96bf6369dbb40_0 (deleted)
/data/data/####/81b360be44f699d9_0
/data/data/####/81b360be44f699d9_1
/data/data/####/821d2164d47db650_0 (deleted)
/data/data/####/83d1f049b9f22240_0
/data/data/####/83d1f049b9f22240_1
/data/data/####/8b5701348147d6b1_0 (deleted)
/data/data/####/8c04abe1da7df9e9_0
/data/data/####/8c04abe1da7df9e9_1
/data/data/####/8e711b2a15b90b60_0 (deleted)
/data/data/####/8f1347751823f881_0 (deleted)
/data/data/####/910e686e20565832_0
/data/data/####/910e686e20565832_1
/data/data/####/931e2d08a033194d_0 (deleted)
/data/data/####/988d962deda62db2_0
/data/data/####/988d962deda62db2_1
/data/data/####/991bdfa247d5c4a9_0 (deleted)
/data/data/####/9be3d13218ed8339_0
/data/data/####/9be3d13218ed8339_1
/data/data/####/Cookies-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a2a2e46921ea2051_0 (deleted)
/data/data/####/a39c3eea481cc55b_0 (deleted)
/data/data/####/a468420ab1f6b3e0_0 (deleted)
/data/data/####/a608caedeab77e4b_0
/data/data/####/a608caedeab77e4b_1
/data/data/####/a7b5f67413ba38bb_0 (deleted)
/data/data/####/aded510d9eb30f6a_0
/data/data/####/aded510d9eb30f6a_1
/data/data/####/b10961671e483019_0 (deleted)
/data/data/####/b28f1ad53fe431f6_0
/data/data/####/b28f1ad53fe431f6_1
/data/data/####/b43864a90babb1c5_0
/data/data/####/b43864a90babb1c5_1
/data/data/####/b51fe9df9731e52e_0
/data/data/####/b51fe9df9731e52e_1
/data/data/####/b8f68974faedde85_0
/data/data/####/bba50bd7007ac14d_0 (deleted)
/data/data/####/bd11fed7678ebb99_0
/data/data/####/bd11fed7678ebb99_1
/data/data/####/bf58136779036ef7_0 (deleted)
/data/data/####/c07be44aa740bd5a_0
/data/data/####/c07be44aa740bd5a_1
/data/data/####/c20cd0b32fcfe0e9_0 (deleted)
/data/data/####/c2c738a2c50c1745_0 (deleted)
/data/data/####/c73bafbb9b5dfa4d_0
/data/data/####/c8f48f860432d730_0 (deleted)
/data/data/####/ca415bd651e361fd_0 (deleted)
/data/data/####/cceded2a799e3e83_0
/data/data/####/cceded2a799e3e83_1
/data/data/####/cf1a6b63ea2f69b6_0
/data/data/####/cf1a6b63ea2f69b6_1
/data/data/####/cff360be2f9b7fd4_0 (deleted)
/data/data/####/com.faceai.boot.xml
/data/data/####/com.faceai.boot_preferences.xml
/data/data/####/d0d0073902a8a591_0
/data/data/####/d0d0073902a8a591_1
/data/data/####/d2dfcc13c709736f_0 (deleted)
/data/data/####/d2ee78c105efca0f_0
/data/data/####/d2ee78c105efca0f_1
/data/data/####/d49bcdf06c1c4b54_0
/data/data/####/d49bcdf06c1c4b54_1
/data/data/####/d92af3d07285b0e3_0 (deleted)
/data/data/####/dc4cbec8020f34da_0 (deleted)
/data/data/####/dce2347c27f28e10_0 (deleted)
/data/data/####/e0728c25af779a39_0 (deleted)
/data/data/####/e27d6e2380dc6b2d_0 (deleted)
/data/data/####/e3edade16efdedbf_0 (deleted)
/data/data/####/e461e061fb9e4779_0 (deleted)
/data/data/####/e68c21574ff0e053_0 (deleted)
/data/data/####/f0230e99df5ad2c9_0 (deleted)
/data/data/####/f1ef1f8b651e95ab_0 (deleted)
/data/data/####/f59e7ea01667abf9_0 (deleted)
/data/data/####/f60aec199c47747b_0 (deleted)
/data/data/####/fa67eed16425ad87_0
/data/data/####/fa67eed16425ad87_1
/data/data/####/fde8a70930236642_0 (deleted)
/data/data/####/ff176ef88bfd88f6_0
/data/data/####/ff176ef88bfd88f6_1
/data/data/####/ffc19c2d7432ce59_0 (deleted)
/data/data/####/https_www.app.kurashi.tepco.co.jp_0.localstorage-journal
/data/data/####/index
/data/data/####/metrics_guid
/data/data/####/sysinfo0.dex
/data/data/####/sysinfo0.dex.flock (deleted)
/data/data/####/sysinfo1.dex
/data/data/####/sysinfo1.dex.flock (deleted)
/data/data/####/sysinfo2.dex
/data/data/####/sysinfo2.dex.flock (deleted)
/data/data/####/sysinfo3.dex
/data/data/####/sysinfo3.dex.flock (deleted)
/data/data/####/sysinfo4.dex
/data/data/####/sysinfo4.dex.flock (deleted)
/data/data/####/sysinfo5.dex
/data/data/####/sysinfo5.dex.flock (deleted)
/data/data/####/sysinfo6.dex
/data/data/####/sysinfo6.dex.flock (deleted)
/data/data/####/sysinfo7.dex
/data/data/####/sysinfo7.dex.flock (deleted)
/data/data/####/temp-index
/data/data/####/the-real-index
/data/media/####/kvm.dat
/data/media/####/log-2023-06-09.txt
/data/media/####/sysinfo0
/data/media/####/sysinfo1
/data/media/####/sysinfo2
/data/media/####/sysinfo3
/data/media/####/sysinfo4
/data/media/####/sysinfo5
/data/media/####/sysinfo6
/data/media/####/sysinfo7
/data/misc/####/primary.prof

Miscellaneous:

Gets information about network.

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial