Android.BankBot.Ermac.187

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.BankBot.Ermac.6.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) matov####.top:80
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) acco####.you####.com:443
TCP(TLS/1.0) dl.go####.com:443
TCP(TLS/1.0) content####.google####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) ed####.me.g####.com:443
TCP(TLS/1.0) acco####.go####.com:443
TCP(TLS/1.0) p####.go####.com:443
TCP(TLS/1.0) clients####.google####.com:443
UDP acco####.go####.com:443
UDP f####.gst####.com:443

DNS requests:

acco####.go####.com
acco####.you####.com
clients####.google####.com
content####.google####.com
dl.go####.com
ed####.me.g####.com
f####.gst####.com
matov####.top
p####.go####.com
up####.google####.com
www.gst####.com

HTTP GET requests:

matov####.top/socket.io/?EIO=####&transport=####
matov####.top/socket.io/?EIO=####&transport=####&sid=####

HTTP POST requests:

matov####.top/php/00b3e6bl1cpfot05r8db.php/
matov####.top/php/07ekv0ub.php/
matov####.top/php/0aqd.php/
matov####.top/php/0e.php/
matov####.top/php/0p75k413y.php/
matov####.top/php/0v6ijceyc6btv.php/
matov####.top/php/14jd4sxontab99m.php/
matov####.top/php/18ek.php/
matov####.top/php/1mrmtgu.php/
matov####.top/php/1ttw6p.php/
matov####.top/php/1w.php/
matov####.top/php/27led2.php/
matov####.top/php/2a3kn39j9tymxg21pa04.php/
matov####.top/php/2c4w8p4xo8o7cywtmf.php/
matov####.top/php/2edmju8m4x35bw1.php/
matov####.top/php/2tvvfew0k5ahl0nlh8.php/
matov####.top/php/300j.php/
matov####.top/php/3e0ooc.php/
matov####.top/php/3v47.php/
matov####.top/php/4.php/
matov####.top/php/4bllnav4xr7vjwil.php/
matov####.top/php/4dwl1uu9z8wu4m0l.php/
matov####.top/php/4siyldgrwgj9yathv.php/
matov####.top/php/4su6hv.php/
matov####.top/php/4ua77.php/
matov####.top/php/4yf77gmji5zrt0.php/
matov####.top/php/5.php/
matov####.top/php/521rm0lx52.php/
matov####.top/php/53upob2nzn0u7nr.php/
matov####.top/php/56eee2yj80.php/
matov####.top/php/5d3e65.php/
matov####.top/php/5f0fn2.php/
matov####.top/php/5ix7wn7d88.php/
matov####.top/php/5khmq6zzt5zuo8ghp2n.php/
matov####.top/php/5pchvcdp9gs1nezxsd.php/
matov####.top/php/5qtj8g8mpivsmr1n.php/
matov####.top/php/5wcf555mbst.php/
matov####.top/php/5x9t9i048qf4kvpt5d.php/
matov####.top/php/5y0suhzma0.php/
matov####.top/php/6lmcji4zrv13kl7.php/
matov####.top/php/6zxkaj6q40g28y4.php/
matov####.top/php/782q20.php/
matov####.top/php/7rdwx55otl5bbpy6fmm2.php/
matov####.top/php/7v95s1mta.php/
matov####.top/php/84.php/
matov####.top/php/8fxxx3o7xpde5g7hv.php/
matov####.top/php/8g.php/
matov####.top/php/8gn2whgt49gjvjbxn.php/
matov####.top/php/8npj.php/
matov####.top/php/8ot4ypgse.php/
matov####.top/php/8s6x1di.php/
matov####.top/php/8ze47j9hk21.php/
matov####.top/php/91kr9hgzwig5mmi.php/
matov####.top/php/991zwp64rixtz7t2m4r.php/
matov####.top/php/a.php/
matov####.top/php/a0vvzm9lzioq.php/
matov####.top/php/a81k6g6hj.php/
matov####.top/php/a8vap28g0ok.php/
matov####.top/php/aeeakyc66ll6dibp.php/
matov####.top/php/afq.php/
matov####.top/php/ajb.php/
matov####.top/php/ap.php/
matov####.top/php/aq1kg1qzamgyx7.php/
matov####.top/php/aq61jedbkjg8l.php/
matov####.top/php/b4gwlt.php/
matov####.top/php/b65thzsj.php/
matov####.top/php/b6dew.php/
matov####.top/php/ba2ok5.php/
matov####.top/php/bap5ezhx.php/
matov####.top/php/bb06iatrxjay22.php/
matov####.top/php/bbjol7t.php/
matov####.top/php/bc7n0zdhec1mnr2.php/
matov####.top/php/bp6z0ik6x3dhh7w.php/
matov####.top/php/btmecckno3c0g1x.php/
matov####.top/php/by9tqb7d70w0w6jabf9.php/
matov####.top/php/c.php/
matov####.top/php/c0stjcymjy.php/
matov####.top/php/c1xunt4s0bqud.php/
matov####.top/php/c50ee.php/
matov####.top/php/cf9m0fo04.php/
matov####.top/php/chz.php/
matov####.top/php/cltpjekmzcxnju11.php/
matov####.top/php/cp4b6.php/
matov####.top/php/crqb818x9oc49vvj.php/
matov####.top/php/cw.php/
matov####.top/php/d.php/
matov####.top/php/d264uvxu.php/
matov####.top/php/d5gq0k1wg.php/
matov####.top/php/dvi9814y4.php/
matov####.top/php/e2y14ezxjd8bfgio.php/
matov####.top/php/ein6z4lz6q9457se.php/
matov####.top/php/elap66.php/
matov####.top/php/eldctjciqsw6m.php/
matov####.top/php/emme09j0tdsf0vutfku.php/
matov####.top/php/epynj3fopo.php/
matov####.top/php/eqqu1drth.php/
matov####.top/php/evgxnwspbr8zuf7zw.php/
matov####.top/php/f9ycsk8p3.php/
matov####.top/php/g.php/
matov####.top/php/ga4gpakmv97cs.php/
matov####.top/php/geeaxvohypigrh4.php/
matov####.top/php/gf1qsdixwm28it52eodj.php/
matov####.top/php/gjgcy.php/
matov####.top/php/gn6nehjovd2e5gn51.php/
matov####.top/php/gnyuxm8i419s.php/
matov####.top/php/gobwdl.php/
matov####.top/php/gy1wvqzg3c3mixwko9n.php/
matov####.top/php/h4.php/
matov####.top/php/h55w11.php/
matov####.top/php/h9iwy928d5m.php/
matov####.top/php/hfbj5e8fju2j.php/
matov####.top/php/hot9zckl.php/
matov####.top/php/hqjy.php/
matov####.top/php/i.php/
matov####.top/php/i2097vwoe.php/
matov####.top/php/i4caaaprt5qx8souy2bk.php/
matov####.top/php/i82b8960676lw.php/
matov####.top/php/ieww5rtp9vim.php/
matov####.top/php/ig9x5q.php/
matov####.top/php/ii31tvpiz1.php/
matov####.top/php/ijk3ztnd2f12s.php/
matov####.top/php/ikkej8.php/
matov####.top/php/iw0c6zfaflx3n.php/
matov####.top/php/ix6o0w54.php/
matov####.top/php/j8n9k4k.php/
matov####.top/php/jed9ulkho5ltsx8.php/
matov####.top/php/jfesd8v7v.php/
matov####.top/php/k1m37j.php/
matov####.top/php/k635xnc5x1ab7vs.php/
matov####.top/php/k6llr8dxcj.php/
matov####.top/php/ka9w279bplkr7q.php/
matov####.top/php/kjqevz3p0e.php/
matov####.top/php/ktzsdybb47c9g.php/
matov####.top/php/kuw6qgwonl248e8lb.php/
matov####.top/php/kxp.php/
matov####.top/php/l0d9362tzmkiheharb.php/
matov####.top/php/l18w22fxzh8jn8p2.php/
matov####.top/php/l2i6s.php/
matov####.top/php/lfbrf638b.php/
matov####.top/php/lg59mjl8wxdl4omhd4.php/
matov####.top/php/lhfi96639kynwbahh7l.php/
matov####.top/php/lncb0yvnx.php/
matov####.top/php/lomdf.php/
matov####.top/php/lpgktm1563qrm.php/
matov####.top/php/luirxskdui2ch.php/
matov####.top/php/lwofucjqz3.php/
matov####.top/php/lwyfi.php/
matov####.top/php/m0j5snh89neuqcp.php/
matov####.top/php/m3hd6bvryb.php/
matov####.top/php/m4pwff.php/
matov####.top/php/m5b.php/
matov####.top/php/m9.php/
matov####.top/php/mbm.php/
matov####.top/php/mg7xa49tp7o.php/
matov####.top/php/micj9f66sutwv.php/
matov####.top/php/mj7pczk8wp1v6oe6qn.php/
matov####.top/php/mw4x2.php/
matov####.top/php/n.php/
matov####.top/php/ncl.php/
matov####.top/php/ni.php/
matov####.top/php/nvoq5bi4wkbbdol0b9a.php/
matov####.top/php/nytloz3z0y.php/
matov####.top/php/o.php/
matov####.top/php/o64trskwlbqan7ilq9.php/
matov####.top/php/o8xtaffet0caa3m43.php/
matov####.top/php/o9.php/
matov####.top/php/opnbujy.php/
matov####.top/php/opzl3ftr54c.php/
matov####.top/php/phlt6me3c05tkw2m9.php/
matov####.top/php/pi7.php/
matov####.top/php/ppa.php/
matov####.top/php/pqpy.php/
matov####.top/php/pthqy5bj3wc5.php/
matov####.top/php/q.php/
matov####.top/php/q2.php/
matov####.top/php/q5yhojmh64w8ih.php/
matov####.top/php/q784.php/
matov####.top/php/qfx6vgii3jxc2xi5yi.php/
matov####.top/php/qhg6xtt93m.php/
matov####.top/php/qk5ald0ma6bs.php/
matov####.top/php/qkkp3dk.php/
matov####.top/php/qsbu5sbuw9cyw1src.php/
matov####.top/php/qz1ghzocxh5.php/
matov####.top/php/r.php/
matov####.top/php/r6ngpv28qu.php/
matov####.top/php/r76q5t36oi489.php/
matov####.top/php/r8j30.php/
matov####.top/php/rc99pkljc8eqi8xj.php/
matov####.top/php/reg0l0eipcn9c1tp.php/
matov####.top/php/rj.php/
matov####.top/php/rvzrirbve.php/
matov####.top/php/rxj9nlxfmaj.php/
matov####.top/php/s33nv3er9.php/
matov####.top/php/se3eagjw0ervl5d.php/
matov####.top/php/svkehxov05xz86dc6v.php/
matov####.top/php/svt.php/
matov####.top/php/sxkfy6p15c7anfighsv.php/
matov####.top/php/t05hlrz2uc.php/
matov####.top/php/ta0dxcv5yxx60o5mvz.php/
matov####.top/php/tchr.php/
matov####.top/php/ti7lnz8v.php/
matov####.top/php/tiz8woxsse05i641.php/
matov####.top/php/toy982x.php/
matov####.top/php/tx5pyd8ljbmfz.php/
matov####.top/php/u5v1un2cg9urhvf.php/
matov####.top/php/uk1ghx6.php/
matov####.top/php/ukokdyi9n.php/
matov####.top/php/uyljf8fy9u.php/
matov####.top/php/v.php/
matov####.top/php/vg.php/
matov####.top/php/vgaul9m.php/
matov####.top/php/vnascxnso5b.php/
matov####.top/php/vs.php/
matov####.top/php/vv5y.php/
matov####.top/php/vvk4ff064z0fk.php/
matov####.top/php/vw0ze.php/
matov####.top/php/wl3rdr.php/
matov####.top/php/x1q.php/
matov####.top/php/x4xy.php/
matov####.top/php/xb.php/
matov####.top/php/xd38kvfq.php/
matov####.top/php/y.php/
matov####.top/php/y3kzh03sf.php/
matov####.top/php/y4bqio2n7gxgig4.php/
matov####.top/php/y5welqo2qt.php/
matov####.top/php/y6.php/
matov####.top/php/y8negzq6xmo7gkhg5.php/
matov####.top/php/y94by.php/
matov####.top/php/yf9rf31sbo0.php/
matov####.top/php/yhu3kg.php/
matov####.top/php/yj6kxpnteoecq23vt9.php/
matov####.top/php/yz.php/
matov####.top/php/z.php/
matov####.top/php/zkltbgsb6zixpj9lv0l.php/
matov####.top/php/zsa65bls2jwqnb.php/
matov####.top/php/zx.php/
matov####.top/socket.io/?EIO=####&transport=####&sid=####

File system changes:

Creates the following files:

/com.tijixuzibalimu.buwufa/app_webview/####/000003.log
/com.tijixuzibalimu.buwufa/app_webview/####/Cookies
/com.tijixuzibalimu.buwufa/app_webview/####/LOCK
/com.tijixuzibalimu.buwufa/app_webview/####/LOG
/com.tijixuzibalimu.buwufa/app_webview/####/MANIFEST-000001
/com.tijixuzibalimu.buwufa/app_webview/####/QuotaManager
/com.tijixuzibalimu.buwufa/app_webview/####/QuotaManager-journal
/com.tijixuzibalimu.buwufa/app_webview/####/Web Data
/com.tijixuzibalimu.buwufa/app_webview/####/Web Data-journal
/com.tijixuzibalimu.buwufa/app_webview/webview_data.lock
/com.tijixuzibalimu.buwufa/no_backup/androidx.work.workdb
/com.tijixuzibalimu.buwufa/no_backup/androidx.work.workdb-shm
/com.tijixuzibalimu.buwufa/no_backup/androidx.work.workdb-wal
/data/misc/####/primary.prof
/data/user/####/.org.chromium.Chromium.VEsFDh
/data/user/####/.org.chromium.Chromium.VG50yz
/data/user/####/000001.dbtmp
/data/user/####/000003.log
/data/user/####/00b035423a0f1d32_0
/data/user/####/102fc01abb802aac_0
/data/user/####/26cfb5f6b06d1f3b_0
/data/user/####/2e5a4249b789ed9e_0
/data/user/####/3262a247618749b7_0
/data/user/####/33166b95042feb2d_0
/data/user/####/46e630b1621ffd68_0
/data/user/####/50290d792a5016e6_0
/data/user/####/75ccbda9fcac692e_0
/data/user/####/7eedde3dd1b2bf60_0
/data/user/####/85f5a064bd168e83_0
/data/user/####/8e10f629c9990b58_0
/data/user/####/8edb83b0e3bcdaac_0
/data/user/####/BrowserMetrics-spare.pma
/data/user/####/Cookies-journal
/data/user/####/LOCK
/data/user/####/LOCK (deleted)
/data/user/####/LOG
/data/user/####/MANIFEST-000001
/data/user/####/WebViewChromiumPrefs.xml
/data/user/####/androidx.work.workdb-journal
/data/user/####/androidx.work.workdb-wal
/data/user/####/bc99def0e900df57_0
/data/user/####/cac7560315ed0acb_0
/data/user/####/ce732803b568c00f_0
/data/user/####/d45359ca833253e0_0
/data/user/####/d5ec304b58d6c756_0
/data/user/####/df7ef0ff682e374d_0
/data/user/####/e26de82d4c7b4ba5_0
/data/user/####/e48f18e64773195c_0
/data/user/####/f1007a87074a8859_0
/data/user/####/fd38aa023270f3aa_0
/data/user/####/font_unique_name_table.pb
/data/user/####/index
/data/user/####/oqLSJm.json
/data/user/####/oqLSJm.json.cur.prof
/data/user/####/oqLSJm.vdex
/data/user/####/settings.dat
/data/user/####/settings.xml
/data/user/####/temp-index
/data/user/####/todelete_1248c01e74accb09_0_1 (deleted)
/data/user/####/todelete_2678a1ba4550e12c_0_1 (deleted)
/data/user/####/todelete_7b11c7c729e65e8f_0_1 (deleted)
/data/user/####/todelete_7e5271d65b027836_0_1 (deleted)
/data/user/####/todelete_98a632d46cb5803e_0_1 (deleted)
/data/user/####/todelete_c802dee663c2a7b8_0_1 (deleted)
/data/user/####/todelete_ead9e48e1d6c6a56_0_1 (deleted)
/data/user/####/variations_seed_new
/data/user/####/variations_stamp

Miscellaneous:

Executes the following shell scripts:

/system/bin/su

Uses elevated priveleges.

Displays its own windows over windows of other apps.

Intercepts notifications.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial