Android.Spy.7867

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Spy.1493.origin

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(???) content####.google####.com:443
TCP(???) 1####.1.1.1:443
UDP(???) f####.gst####.com:443
TCP(???) ifco####.io:443
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.16.55.83:8444
TCP(HTTP/1.1) 1####.16.55.83:8443
TCP(TLS/1.0) ed####.me.g####.com:443
TCP(TLS/1.0) use-####.a####.com.####.net:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) www.biedr####.pl:443
TCP(TLS/1.0) p.typ####.net-stl####.####.net:443
TCP(TLS/1.0) content####.google####.com:443
TCP(TLS/1.0) clients####.google####.com:443
TCP(TLS/1.0) san-dow####.a####.com.####.net:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) st####.biedr####.pl:443

DNS requests:

biedr####.pl
cdn.biedr####.pl
clients####.google####.com
content####.google####.com
ed####.me.g####.com
f####.google####.com
f####.gst####.com
ifco####.io
p.typ####.net-stl####.####.net
san-dow####.a####.com.####.net
st####.biedr####.pl
up####.google####.com
use-####.a####.com.####.net
www.biedr####.pl
www.googlet####.com

HTTP GET requests:

1####.16.55.83:8443/control?sessionId=####
1####.16.55.83:8444/data?sessionId=####

File system changes:

Creates the following files:

/app_webview/Default/####/000003.log
/app_webview/Default/####/LOCK
/app_webview/Default/####/LOG
/app_webview/Default/####/MANIFEST-000001
/app_webview/Default/Cookies
/app_webview/Default/Web Data
/app_webview/Default/Web Data-journal
/app_webview/webview_data.lock
/app_webview_overlay_process/Default/####/000003.log
/app_webview_overlay_process/Default/####/LOCK
/app_webview_overlay_process/Default/####/LOG
/app_webview_overlay_process/Default/####/MANIFEST-000001
/app_webview_overlay_process/Default/Web Data
/app_webview_overlay_process/Default/Web Data-journal
/app_webview_overlay_process/webview_data.lock
/cache/WebView/####/1283462aca212f37_0
/cache/WebView/####/15923b032c299093_0
/cache/WebView/####/1686905c98543273_0
/cache/WebView/####/1b99bdbd342a979c_0
/cache/WebView/####/1e0387f226c44fd5_0
/cache/WebView/####/22712f757b7497bf_0
/cache/WebView/####/2aecc74b589d50c9_0
/cache/WebView/####/2ba4819b4d537444_0
/cache/WebView/####/322e9e20aa59f9b1_0
/cache/WebView/####/3c416d9b8f8e4e38_0
/cache/WebView/####/444fb7770fb1d74d_0
/cache/WebView/####/4d918ad5f28f8011_0
/cache/WebView/####/58f9a09dbffc3f0e_0
/cache/WebView/####/682d8caa5b453e79_0
/cache/WebView/####/6893987644d70e4c_0
/cache/WebView/####/6a51984ceaabcafb_0
/cache/WebView/####/6c62ee82a62aee45_0
/cache/WebView/####/7972f2bfe362e2a4_0
/cache/WebView/####/80ea10e3bd62e59a_0
/cache/WebView/####/8b8f50aa4671bc78_0
/cache/WebView/####/9048541435336156_0
/cache/WebView/####/929721a55d330616_0
/cache/WebView/####/97eb8a56018211ed_0
/cache/WebView/####/a6a1ffc942305914_0
/cache/WebView/####/ac3a414f972deac8_0
/cache/WebView/####/b3204ce3ba9f84ee_0
/cache/WebView/####/b77ba0a15d727d7b_0
/cache/WebView/####/d5c6b6e05aaee5bf_0
/cache/WebView/####/e4c67e776c1dd39c_0
/cache/WebView/####/f3ab33680e49a283_0
/cache/WebView/####/f80df9d6063cb46b_0
/cache/doh_cache/journal
/data/data/####/.org.chromium.Chromium.htwMSi
/data/data/####/.org.chromium.Chromium.kA3Lwd
/data/data/####/000001.dbtmp
/data/data/####/02bd9c346a63047a_0
/data/data/####/052d2bb2a251eb12_0
/data/data/####/075d2ad1ca9c90cb_0
/data/data/####/0be057c51745acb8_0
/data/data/####/0c01f6da2b73eb1d_0
/data/data/####/0cd207c9454b3158_0
/data/data/####/0e9fe0cc4eb31bc5_0
/data/data/####/10ab7849cd4899a6_0
/data/data/####/11c2e8a9dd21e0d5_0
/data/data/####/11fd0e14f7103094_0
/data/data/####/14656f327427da63_0
/data/data/####/1822bcd889271666_0
/data/data/####/1c3e8a7ccead1a82_0
/data/data/####/1d5297e48a53a5de_0
/data/data/####/1fe0676b949fc6a2_0
/data/data/####/2b3a04f6b26d1ff0_0
/data/data/####/2beed6f0373f36ba_0
/data/data/####/2fae858a141139d8_0
/data/data/####/2fd6b217155c3fab_0
/data/data/####/37dd683b40ed4c1f_0
/data/data/####/3a078690db654e9e_0
/data/data/####/3debd0c57afbc1ca_0
/data/data/####/3e33117f206c0116_0
/data/data/####/424e7e68c0ab6394_0
/data/data/####/441f916607c57c54_0
/data/data/####/44f8047c0c7c4558_0
/data/data/####/45b4df76b1544074_0
/data/data/####/466216ad656b53fc_0
/data/data/####/485ff2ad6e62b812_0
/data/data/####/496c01313869cd5e_0
/data/data/####/4a62d804c925792b_0
/data/data/####/4da9f39077b65410_0
/data/data/####/4e2fe62bffe4e2f2_0
/data/data/####/530ca4e21ca384a8_0
/data/data/####/566b4335a2f4c950_0
/data/data/####/5870cbdf6f960f50_0
/data/data/####/63c203805a5fe2d6_0
/data/data/####/69fee193adce1a7d_0
/data/data/####/6a566bf0673c5657_0
/data/data/####/6d6b5e8ae9365d16_0
/data/data/####/6e894aaca3b88b16_0
/data/data/####/6f17bc89875fa822_0
/data/data/####/708ee8ccecc2b093_0
/data/data/####/722d105dbbac989a_0
/data/data/####/7295672e80b59a98_0
/data/data/####/72c293e7e32c93b7_0
/data/data/####/7972f2bfe362e2a4_0
/data/data/####/7f509e5b14d1d959582b2a03a217a962.0.tmp
/data/data/####/7f509e5b14d1d959582b2a03a217a962.1.tmp
/data/data/####/80c747ca86f0efb4_0
/data/data/####/8705bc968d9a724d_0
/data/data/####/89c65fbe8c008fb0_0
/data/data/####/8b4b41d548925930_0
/data/data/####/8b4df3ef80c10603_0
/data/data/####/8c5235f97cfc1788_0
/data/data/####/8dc39b9cb21b6c45_0
/data/data/####/8ee56a159b5fa6dd_0
/data/data/####/929721a55d330616_0
/data/data/####/984cb83c94a873a6_0
/data/data/####/9cc3e81c299142d8_0
/data/data/####/9e590db0a3d15b8e_0
/data/data/####/9ebef9269d852477_0
/data/data/####/9efa33ef628571c7_0
/data/data/####/9f65cb15948b74ed_0
/data/data/####/BrowserMetrics-spare.pma.tmp
/data/data/####/Cookies-journal
/data/data/####/MANIFEST-000001
/data/data/####/PEZqL.js
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a0b81387090c27ef_0
/data/data/####/a1745ad40a43ddca_0
/data/data/####/a1a83cf027a60160_0
/data/data/####/a58109a62ff40ccc_0
/data/data/####/ab7d5bc311c8ec79_0
/data/data/####/androidx.work.workdb-journal
/data/data/####/androidx.work.workdb-wal
/data/data/####/androidx.work.workdb.lck
/data/data/####/b0b63e58828c8c83_0
/data/data/####/b89f11f9f10dd53e_0
/data/data/####/ba9afe30712764e4_0
/data/data/####/c2fb599d44be3730_0
/data/data/####/c4a183f363c8cbac_0
/data/data/####/c6ab1f23a52238ee_0
/data/data/####/c71dfbff620d04c2_0
/data/data/####/c7cc8383ba2ab16e_0
/data/data/####/c8043e64b36943b3_0
/data/data/####/cf22b331c43c39c8_0
/data/data/####/d4f4d14792df474f_0
/data/data/####/da5ac79bb6735eb8_0
/data/data/####/df3a85611c84b3da_0
/data/data/####/e38289fe286f0bd4_0
/data/data/####/e46a57f0cd69b07b_0
/data/data/####/e6f18b16f8f50fee_0
/data/data/####/ecb6cddfa7ce2a59_0
/data/data/####/edca71949662a944_0
/data/data/####/f03457727d170d5d_0
/data/data/####/f41f9898041ff902_0
/data/data/####/f57956b00e16d911_0
/data/data/####/fd6a0c40d817e621_0
/data/data/####/fdf093bb45ce386a_0
/data/data/####/font_unique_name_table.pb
/data/data/####/index
/data/data/####/journal.bkp (deleted)
/data/data/####/journal.tmp
/data/data/####/net.srqxtuqn.plusddh5f.xml
/data/data/####/notification_persistence.xml
/data/data/####/pref_store
/data/data/####/profileInstalled
/data/data/####/settings.dat
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/todelete_7972f2bfe362e2a4_0_1 (deleted)
/data/data/####/todelete_80c747ca86f0efb4_0_1 (deleted)
/data/data/####/todelete_8da6f6163dde694b_0_1 (deleted)
/data/data/####/todelete_929721a55d330616_0_1 (deleted)
/data/data/####/uninstall_protection.xml
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/data/misc/####/primary.prof
/no_backup/androidx.work.workdb
/no_backup/androidx.work.workdb-shm
/no_backup/androidx.work.workdb-wal

Miscellaneous:

Accesses camera interface.

Gets information about active device administrators.

Gets information about installed apps.

Displays its own windows over windows of other apps.

Gets information about sent/received SMS.

Intercepts notifications.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial