Android.BankBot.Ermac.188

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.BankBot.Ermac.6.origin

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) matov####.top:80
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) dl.go####.com:443
TCP(TLS/1.0) ed####.me.g####.com:443
TCP(TLS/1.0) clients####.google####.com:443

DNS requests:

clients####.google####.com
dl.go####.com
ed####.me.g####.com
matov####.top
up####.google####.com

HTTP GET requests:

matov####.top/socket.io/?EIO=####&transport=####
matov####.top/socket.io/?EIO=####&transport=####&sid=####

HTTP POST requests:

matov####.top/php/0aew6syz5qijw59fbf2.php/
matov####.top/php/0g0y0kzhh.php/
matov####.top/php/0n4.php/
matov####.top/php/0s9ctubbj.php/
matov####.top/php/0vt6x.php/
matov####.top/php/0wwmeh5kps.php/
matov####.top/php/1.php/
matov####.top/php/11gju2f3odfh8w1edjnz.php/
matov####.top/php/1uvd.php/
matov####.top/php/1ymv9.php/
matov####.top/php/2.php/
matov####.top/php/208nnm36bt.php/
matov####.top/php/22ggblwop8.php/
matov####.top/php/22v.php/
matov####.top/php/2almjrrh4d4hz5nm.php/
matov####.top/php/2fe9f09usr3.php/
matov####.top/php/2fp.php/
matov####.top/php/2juuae9jt9g9n2xgp6.php/
matov####.top/php/2nfr4yqb0qjl6t01.php/
matov####.top/php/2o9c.php/
matov####.top/php/2sovx5x.php/
matov####.top/php/2t.php/
matov####.top/php/2wx.php/
matov####.top/php/33qresm5pl16d8d.php/
matov####.top/php/345663.php/
matov####.top/php/35jq7doa7cynxy4mhhu.php/
matov####.top/php/3aj.php/
matov####.top/php/3dv6oyg3x52tubmpwaq.php/
matov####.top/php/3f9xc65j2p9z4cg5m0l8.php/
matov####.top/php/3hdhlg36.php/
matov####.top/php/3kz67c06.php/
matov####.top/php/3sr3sz.php/
matov####.top/php/3ty.php/
matov####.top/php/4.php/
matov####.top/php/4buzv6n4vd0y.php/
matov####.top/php/4kqqo2s3uq4kslpi.php/
matov####.top/php/4kwmo4xh2u52o2ih.php/
matov####.top/php/4wux6.php/
matov####.top/php/58wt1zyu.php/
matov####.top/php/590f47x.php/
matov####.top/php/5c53cukp.php/
matov####.top/php/5dxrivyj97y.php/
matov####.top/php/5fg16s6uuywhiml.php/
matov####.top/php/5k.php/
matov####.top/php/5ryzmv6b8g7wki6icr.php/
matov####.top/php/5upi75as8vppu9.php/
matov####.top/php/5xk849a1dd2sbrx5n.php/
matov####.top/php/64jlk0m300ymohisx.php/
matov####.top/php/64rfly5otpo6uzgzk.php/
matov####.top/php/6994xadgvgw.php/
matov####.top/php/6haxptp1fty52y1gh.php/
matov####.top/php/6kgijyj2.php/
matov####.top/php/6sl8vx5fsvbnxzz9.php/
matov####.top/php/6tsj8.php/
matov####.top/php/73cyv7ufm.php/
matov####.top/php/748lx.php/
matov####.top/php/76w0.php/
matov####.top/php/7sir9.php/
matov####.top/php/8.php/
matov####.top/php/81m1s.php/
matov####.top/php/81uhybf9u.php/
matov####.top/php/83hgbrjj7u6yp1xjq22x.php/
matov####.top/php/84mn.php/
matov####.top/php/855.php/
matov####.top/php/85ul3.php/
matov####.top/php/889h3rry.php/
matov####.top/php/8c.php/
matov####.top/php/8kb7vnjms.php/
matov####.top/php/8mw1m7ufundo493eur.php/
matov####.top/php/8mwk.php/
matov####.top/php/8p2bmxm0hq.php/
matov####.top/php/8qk.php/
matov####.top/php/8srjm9ihyjo1dx.php/
matov####.top/php/8vlqcr7uai8l.php/
matov####.top/php/8x2k3tcqa8hxv.php/
matov####.top/php/8zrsa392blu7wev.php/
matov####.top/php/9.php/
matov####.top/php/96kpmdhx1xr4y69fl6b.php/
matov####.top/php/9ely6wdj.php/
matov####.top/php/9fog42vqaohz1x1nz.php/
matov####.top/php/9gg2ulngae7hcd3r0swp.php/
matov####.top/php/9hn94b1eur2o8yp.php/
matov####.top/php/9vrl4e.php/
matov####.top/php/a2g9xu3ot4x7ik.php/
matov####.top/php/adanksugzzn0m7vr.php/
matov####.top/php/af738bt20.php/
matov####.top/php/afyqopphojxi.php/
matov####.top/php/ahnpchiriplw4sr53.php/
matov####.top/php/an3yi3ok2fzgvvx.php/
matov####.top/php/apajn4dd28imhho7.php/
matov####.top/php/atg6m227u.php/
matov####.top/php/az.php/
matov####.top/php/b.php/
matov####.top/php/b89gfmheo8sfqgjoqanm.php/
matov####.top/php/bkbzxd7615iwprc.php/
matov####.top/php/bkck7ostreqyf23dgyfl.php/
matov####.top/php/brmi.php/
matov####.top/php/buaj.php/
matov####.top/php/c.php/
matov####.top/php/c8sq.php/
matov####.top/php/c9bsi1vr0a7ad3wmu58.php/
matov####.top/php/cchbn11xobydb.php/
matov####.top/php/cetqv4e.php/
matov####.top/php/ch29opybxa.php/
matov####.top/php/cj7etmuc07827vaxsvjj.php/
matov####.top/php/cjskcglab.php/
matov####.top/php/ckz0jo03kgb.php/
matov####.top/php/czdmj4rh7t.php/
matov####.top/php/d1rg2zraud3kz6iyk.php/
matov####.top/php/d6cfx87bjxf67saqd.php/
matov####.top/php/dbtjedk9szycnei.php/
matov####.top/php/dca0bo.php/
matov####.top/php/de7o1axmfcadnmw.php/
matov####.top/php/dejz91yow.php/
matov####.top/php/do6d.php/
matov####.top/php/dtdmgibjoh0r6.php/
matov####.top/php/dv4.php/
matov####.top/php/e10ss63jl0l3fgo.php/
matov####.top/php/e9nnaxg.php/
matov####.top/php/ez43l5q5.php/
matov####.top/php/f756pq.php/
matov####.top/php/f8p63r929k07tskjo8n.php/
matov####.top/php/f9jsg.php/
matov####.top/php/fam6zd.php/
matov####.top/php/fcaxl7j8xhl1ts.php/
matov####.top/php/fjo2sizc0.php/
matov####.top/php/fla.php/
matov####.top/php/fn1ypr8uupu28rptq.php/
matov####.top/php/fw3mwbvcffhx8ghrq.php/
matov####.top/php/g153v7tk64c3rue.php/
matov####.top/php/g3plto7topnhvrn38.php/
matov####.top/php/g54atmrbx2vhazl.php/
matov####.top/php/g92zfgtxmdfo3.php/
matov####.top/php/gbt0sjze0ssx.php/
matov####.top/php/gmr9qnp56dyj.php/
matov####.top/php/grweu6.php/
matov####.top/php/gxwhtchprszwf31g6c1.php/
matov####.top/php/gyryp.php/
matov####.top/php/h25vprxc9q.php/
matov####.top/php/h89sv.php/
matov####.top/php/h8yp00dzoc5va.php/
matov####.top/php/hn8t1ugtg.php/
matov####.top/php/hrfjpc27l2c779lu2u0.php/
matov####.top/php/hrk32b4onf.php/
matov####.top/php/hrytd6jck1vtc.php/
matov####.top/php/hvlyyvqmo6.php/
matov####.top/php/i0a0ogl2rt93vv1.php/
matov####.top/php/i78zyequosc4zh.php/
matov####.top/php/ii5akdv.php/
matov####.top/php/ikve8u5qk1umanovd.php/
matov####.top/php/ix7ck.php/
matov####.top/php/iyg972tkerda58ty.php/
matov####.top/php/j0x7c0cftnm1.php/
matov####.top/php/j2e8rha14ankni7o.php/
matov####.top/php/j7nri0o.php/
matov####.top/php/jilmntfyy8yx.php/
matov####.top/php/jinif54zdsrwg4.php/
matov####.top/php/jpeerec0mymgr37y2x.php/
matov####.top/php/k8.php/
matov####.top/php/k94p3f1.php/
matov####.top/php/kb.php/
matov####.top/php/kbr3nas.php/
matov####.top/php/kj1v8qfgsb.php/
matov####.top/php/kn.php/
matov####.top/php/l.php/
matov####.top/php/l4d6sd32lzy5rdi.php/
matov####.top/php/l5ijyusqqsvsqih.php/
matov####.top/php/l96mj2si20nfk.php/
matov####.top/php/ll06smqgk7.php/
matov####.top/php/lq3nwjpayf8.php/
matov####.top/php/lqkkxt.php/
matov####.top/php/lr.php/
matov####.top/php/lwneknz90v94kk4qgs8r.php/
matov####.top/php/mbhrb7a9.php/
matov####.top/php/mh.php/
matov####.top/php/mzgb62jzgl7cvw.php/
matov####.top/php/n056bwvqy51rqwhl07si.php/
matov####.top/php/n3at9oujc.php/
matov####.top/php/n6ves9t5ru.php/
matov####.top/php/natd4toj.php/
matov####.top/php/nlu652pkoz8c6mv.php/
matov####.top/php/npnfyhb8rb9zt8khq.php/
matov####.top/php/nwh7umxaje.php/
matov####.top/php/nxpryrryqlwct7.php/
matov####.top/php/nxuytrbgkccik88.php/
matov####.top/php/nyv7fnizwwvqfwkz.php/
matov####.top/php/o.php/
matov####.top/php/ofijti3wnck23.php/
matov####.top/php/oikeoyj59rvt002nvapi.php/
matov####.top/php/p0al6hnskbo5yi044za3.php/
matov####.top/php/p69mxw.php/
matov####.top/php/ppblwwuz2tvfb6ns.php/
matov####.top/php/ppy92i0lo4fcpcjis.php/
matov####.top/php/psdtrtarg3.php/
matov####.top/php/punm.php/
matov####.top/php/pv1d7g0s1gm6zsnywst.php/
matov####.top/php/q2mx.php/
matov####.top/php/q8utiilsvttu5ny37.php/
matov####.top/php/qa.php/
matov####.top/php/qqjjy.php/
matov####.top/php/qw52ufyyds9b0j4arda.php/
matov####.top/php/r1qc2h0.php/
matov####.top/php/rb66i75a70iqyrpfz6w.php/
matov####.top/php/rep46l5s2cbq.php/
matov####.top/php/rs7s3zshxb4y8xp.php/
matov####.top/php/ruj9tx9zfrgtux5fh.php/
matov####.top/php/rzjv426s33fa.php/
matov####.top/php/s4pp3xxy6xts933.php/
matov####.top/php/s5x9zcyzc8xx04z.php/
matov####.top/php/se0bvwe93cw.php/
matov####.top/php/sfns.php/
matov####.top/php/sml9.php/
matov####.top/php/so3lgk.php/
matov####.top/php/ss.php/
matov####.top/php/sszfk29d1xu2r3o5q.php/
matov####.top/php/t5ucqb0r8la9k3g6p6xr.php/
matov####.top/php/tcxtvdhbjl1uenih7e75.php/
matov####.top/php/tenhvjdml65i.php/
matov####.top/php/tiui7k3nsgt2ce9vpn5.php/
matov####.top/php/tjmamj.php/
matov####.top/php/toblf7unwx8a7p7yv.php/
matov####.top/php/tojjzk7mmmymjiy30.php/
matov####.top/php/tp9ty.php/
matov####.top/php/u.php/
matov####.top/php/u15qkcwoz.php/
matov####.top/php/ubn49owhxs1b7l9qkdv3.php/
matov####.top/php/ucw79ssdxq0hadkrax0.php/
matov####.top/php/uhdy.php/
matov####.top/php/unelw02o2apywoiemzw8.php/
matov####.top/php/uow2ppmdgn4fz709pl.php/
matov####.top/php/uqe22z4pd6fmx.php/
matov####.top/php/uubc22.php/
matov####.top/php/vdvz.php/
matov####.top/php/vihpfjznnh293.php/
matov####.top/php/vik3kzr2rzxk1nau7.php/
matov####.top/php/vjblr0y.php/
matov####.top/php/vsa5gmcgiuvedxu7.php/
matov####.top/php/vwfhvm4nplt45mntqd2.php/
matov####.top/php/vx8uxn.php/
matov####.top/php/wadzdevq.php/
matov####.top/php/wc6lz.php/
matov####.top/php/wf54mexc20epr.php/
matov####.top/php/wfce1s16eb.php/
matov####.top/php/wmixk8l2lyefoa06b81x.php/
matov####.top/php/wwcm.php/
matov####.top/php/wx7g4.php/
matov####.top/php/wxd31hw8us7.php/
matov####.top/php/wz7wvnrbg.php/
matov####.top/php/xbxced18wezrwmugksn7.php/
matov####.top/php/xo1m.php/
matov####.top/php/xozx4n.php/
matov####.top/php/xvrmiaylnyl12.php/
matov####.top/php/y.php/
matov####.top/php/y2ys.php/
matov####.top/php/yb5cfxks.php/
matov####.top/php/yk214jqb.php/
matov####.top/php/yy2n18rkzet.php/
matov####.top/php/z.php/
matov####.top/php/zeyhmu.php/
matov####.top/php/zjc7u.php/
matov####.top/php/zpxxocxx4ue7.php/
matov####.top/php/zqrgxqcbyd.php/
matov####.top/php/zsf7.php/
matov####.top/socket.io/?EIO=####&transport=####&sid=####

File system changes:

Creates the following files:

/com.zeyavumixizu.havano/app_webview/####/000003.log
/com.zeyavumixizu.havano/app_webview/####/LOCK
/com.zeyavumixizu.havano/app_webview/####/LOG
/com.zeyavumixizu.havano/app_webview/####/MANIFEST-000001
/com.zeyavumixizu.havano/app_webview/####/Web Data
/com.zeyavumixizu.havano/app_webview/####/Web Data-journal
/com.zeyavumixizu.havano/app_webview/webview_data.lock
/com.zeyavumixizu.havano/no_backup/androidx.work.workdb
/com.zeyavumixizu.havano/no_backup/androidx.work.workdb-shm
/com.zeyavumixizu.havano/no_backup/androidx.work.workdb-wal
/data/misc/####/primary.prof
/data/user/####/.org.chromium.Chromium.nmZ2Sk (deleted)
/data/user/####/.org.chromium.Chromium.xPg5bo
/data/user/####/000001.dbtmp
/data/user/####/BrowserMetrics-spare.pma.tmp
/data/user/####/CURRENT
/data/user/####/MANIFEST-000001
/data/user/####/WebViewChromiumPrefs.xml
/data/user/####/androidx.work.workdb-journal (deleted)
/data/user/####/androidx.work.workdb-wal
/data/user/####/font_unique_name_table.pb
/data/user/####/index
/data/user/####/qFZjWq.json
/data/user/####/qFZjWq.json.cur.prof
/data/user/####/qFZjWq.vdex
/data/user/####/settings.dat
/data/user/####/settings.xml
/data/user/####/settings.xml.bak
/data/user/####/temp-index
/data/user/####/variations_seed_new
/data/user/####/variations_stamp

Miscellaneous:

Executes the following shell scripts:

/system/bin/su

Uses elevated priveleges.

Displays its own windows over windows of other apps.

Intercepts notifications.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial