Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.Gigabud.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.a.sh####.com:80
- TCP(TLS/1.0) se####.a####.cc:443
DNS requests:
- se####.a####.cc
- www.b####.com
HTTP GET requests:
- www.a.sh####.com/
File system changes:
Creates the following files:
- /cache/sentry/####/0ed4ff52-dc9a-4745-733a-7bbd2b9894d5.run.lock
- /cache/sentry/####/0fa1bb8a-3f35-467e-ade3-9e2fb32afed2.run.lock
- /cache/sentry/####/36858867-604b-438f-f4e7-2c9d4f969e13.run.lock
- /cache/sentry/####/59b6eedc-3647-4665-f947-31013c4428bc.run.lock
- /cache/sentry/####/62e8d16e-bf0e-4f5e-f76b-19efbeea27fa.run.lock
- /cache/sentry/####/64e9b8df-a99e-44fc-569b-7a1927fbe000.run.lock
- /cache/sentry/####/790b2f8a-888a-413e-84ed-89cc0f2178eb.run.lock
- /cache/sentry/####/7d5866d8-95f8-4295-efe1-e78f6662ed61.run.lock
- /cache/sentry/####/acdc454c-4235-4d75-46af-13d14a7f95f6.run.lock
- /cache/sentry/####/breadcrumbs.json
- /data/data/####/0ed4ff52-dc9a-4745-733a-7bbd2b9894d5.run.lock
- /data/data/####/0ed4ff52-dc9a-4745-733a-7bbd2b9894d5.run.lock (deleted)
- /data/data/####/0fa1bb8a-3f35-467e-ade3-9e2fb32afed2.run.lock
- /data/data/####/0fa1bb8a-3f35-467e-ade3-9e2fb32afed2.run.lock (deleted)
- /data/data/####/10e4049d1fe544289fd7e8a8fd8900f0.envelope
- /data/data/####/12177588-afc5-4d98-d4aa-0123fcfde777.run.lock
- /data/data/####/12177588-afc5-4d98-d4aa-0123fcfde777.run.lock (deleted)
- /data/data/####/1f0a21ae-e93c-42c2-1b53-e872a340544a.run.lock
- /data/data/####/1f0a21ae-e93c-42c2-1b53-e872a340544a.run.lock (deleted)
- /data/data/####/2a2f20cdb3d044b490359129fa9fb7b1.envelope
- /data/data/####/2cc50f5a0a504c8a9e9b48a7a6a1a7bd.envelope
- /data/data/####/2e84e863-553f-4776-389f-a3a5fd0a2264.run.lock
- /data/data/####/2e84e863-553f-4776-389f-a3a5fd0a2264.run.lock (deleted)
- /data/data/####/2fa07d917c9f4179bcc8617b5f6bd91e.envelope
- /data/data/####/315c2e69de7b4379bdfb43d7609920ef.envelope
- /data/data/####/36858867-604b-438f-f4e7-2c9d4f969e13.run.lock
- /data/data/####/36858867-604b-438f-f4e7-2c9d4f969e13.run.lock (deleted)
- /data/data/####/38e29dc3-428c-4ed5-c23c-0bea911f41b3.run.lock (deleted)
- /data/data/####/59b6eedc-3647-4665-f947-31013c4428bc.run.lock
- /data/data/####/59b6eedc-3647-4665-f947-31013c4428bc.run.lock (deleted)
- /data/data/####/62e8d16e-bf0e-4f5e-f76b-19efbeea27fa.run.lock
- /data/data/####/62e8d16e-bf0e-4f5e-f76b-19efbeea27fa.run.lock (deleted)
- /data/data/####/64e9b8df-a99e-44fc-569b-7a1927fbe000.run.lock
- /data/data/####/64e9b8df-a99e-44fc-569b-7a1927fbe000.run.lock (deleted)
- /data/data/####/72baded5-2c2e-423e-018b-53ac568c6dcf.run.lock
- /data/data/####/72baded5-2c2e-423e-018b-53ac568c6dcf.run.lock (deleted)
- /data/data/####/790b2f8a-888a-413e-84ed-89cc0f2178eb.run.lock
- /data/data/####/790b2f8a-888a-413e-84ed-89cc0f2178eb.run.lock (deleted)
- /data/data/####/7d5866d8-95f8-4295-efe1-e78f6662ed61.run.lock
- /data/data/####/9351f2a5ea8d4326835881a38963d841.envelope
- /data/data/####/AppDex_3.vdex
- /data/data/####/AppDex_3.vdex (deleted)
- /data/data/####/LyBW_sp.xml
- /data/data/####/acdc454c-4235-4d75-46af-13d14a7f95f6.run.lock
- /data/data/####/acdc454c-4235-4d75-46af-13d14a7f95f6.run.lock (deleted)
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/breadcrumbs.json.tmp
- /data/data/####/c72ebb0a-3b75-4469-c6e4-3db7800fbbf4.run.lock
- /data/data/####/c72ebb0a-3b75-4469-c6e4-3db7800fbbf4.run.lock (deleted)
- /data/data/####/cc31e81d-323e-47e4-1e38-2977b9a145fe.run.lock
- /data/data/####/cc31e81d-323e-47e4-1e38-2977b9a145fe.run.lock (deleted)
- /data/data/####/cf028d08c9344591a03b6e139ae59dda.envelope
- /data/data/####/d0a94e3f7d9745e492cc8226e23c6fcb.envelope
- /data/data/####/e700b44ffc89444e9fc6bee813e74c4e.envelope
- /data/data/####/environment.json
- /data/data/####/f0dc9194-9546-4c71-4a13-c5c0b9ebfcdd.run.lock
- /data/data/####/f0dc9194-9546-4c71-4a13-c5c0b9ebfcdd.run.lock (deleted)
- /data/data/####/f79f30c4-93d9-4044-8eac-f99fced5985a.run.lock
- /data/data/####/f79f30c4-93d9-4044-8eac-f99fced5985a.run.lock (deleted)
- /data/data/####/last_crash
- /data/data/####/nt.xml
- /data/data/####/release.json
- /data/data/####/sdk-version.json
- /data/data/####/startup_crash
- /data/data/####/tags.json
- /data/data/####/trace.json
- /data/data/####/user.json
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Loads the following dynamic libraries:
- libsentry
- libsentry-android
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
Contains hidden alternative main activities.
