Analysis Report 7RORCb5RSo

Overview

General Information

Joe Sandbox Version:	24.0.0
Analysis ID:	672842
Start date:	21.09.2018
Start time:	21:26:16
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 4m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7RORCb5RSo
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android x86 5.1
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.and@0/249@5/0
Warnings:	Show All No interacted views Not all executed log events are in report (maximum 10 identical API calls) Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing dynamic data code.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for submitted file

Show sources

Source: 7RORCb5RSo

Avira: Label: ANDROID/Dropper.NACP.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: 7RORCb5RSo

virustotal: Detection: 40%

Perma Link

Location Tracing:

Queries the phones location (GPS)

Show sources

Source: com.midmsz.lhlytazfhrp.ESbKZOA;->b:31	API Call: android.location.Location.getLatitude
Source: com.midmsz.lhlytazfhrp.ESbKZOA;->b:33	API Call: android.location.Location.getLongitude
Source: com.midmsz.lhlytazfhrp.dSDrkSh;->b:32	API Call: android.location.Location.getLatitude
Source: com.midmsz.lhlytazfhrp.dSDrkSh;->b:34	API Call: android.location.Location.getLongitude

Privilege Escalation:

Checks if the device administrator is active

Show sources

Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->a:69	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: com.midmsz.lhlytazfhrp.YOdljfSlmTYA;->onHandleIntent:82	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: com.midmsz.lhlytazfhrp.lCxfdob;->onHandleIntent:47	API Call: android.app.admin.DevicePolicyManager.isAdminActive

Tries to add a new device administrator

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.a.a;->onCreate:12

API Call: android.content.Intent.<init> android.app.action.ADD_DEVICE_ADMIN

Spreading:

Accesses external storage location

Show sources

Source: com.midmsz.lhlytazfhrp.EPjYwbYa;->onHandleIntent:104	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.midmsz.lhlytazfhrp.Lyawisar;->onHandleIntent:71	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.midmsz.lhlytazfhrp.ufhkflzriv;->onHandleIntent:63	API Call: android.os.Environment.getExternalStorageDirectory

Networking:

Checks an internet connection is available

Show sources

Source: com.midmsz.lhlytazfhrp.c;->r:121	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.midmsz.lhlytazfhrp.c;->n:1337	API Call: android.net.NetworkInfo.isConnected
Source: com.midmsz.lhlytazfhrp.c;->m:1334	API Call: android.net.NetworkInfo.isConnected

Opens an internet connection

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.b$a;->a:3	API Call: java.net.URL.openConnection("https://stefankoebalimivsemotdelom.com/private/checkPanel.php")
Source: com.midmsz.lhlytazfhrp.c$a;->a:9	API Call: java.net.URL.openConnection("https://twitter.com/JackCorne")
Source: com.midmsz.lhlytazfhrp.qfjbtlzm.b$a;->a:3	API Call: java.net.URL.openConnection("http://adobe3245292f9f.pw/private/checkPanel.php")
Source: com.midmsz.lhlytazfhrp.NLkgkai$a;->a:13	API Call: java.net.URL.openConnection (not executed)
Source: com.midmsz.lhlytazfhrp.c;->a:208	API Call: java.net.URL.openConnection (not executed)
Source: com.midmsz.lhlytazfhrp.c;->a:316	API Call: java.net.URL.openConnection (not executed)

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: twitter.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /JackCorne HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: mobile.twitter.comConnection: Keep-AliveAccept-Encoding: gzip

Found strings which match to known social media urls

Show sources

Source: android	String found in binary or memory: <td><a href="https://support.twitter.com/"> Help</a></td> equals www.twitter.com (Twitter)
Source: android	String found in binary or memory: By using Twitters services you agree to our <a href="https://support.twitter.com/articles/20170514">Cookie Use</a> and <a href="https://support.twitter.com/articles/20174632">Data Transfer</a> outside the EU. We and our partners operate globally and use cookies, including for analytics, personalisation, and ads. equals www.twitter.com (Twitter)
Source: android	String found in binary or memory: <link rel="canonical" href="https://twitter.com/jackcorne"> equals www.twitter.com (Twitter)
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: )com.imo.android.imoim,com.twitter.android equals www.twitter.com (Twitter)
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: =com.imo.android.imoim,com.twitter.android,com.android.vending equals www.twitter.com (Twitter)
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: com.imb.banking2,)com.imo.android.imoim,com.twitter.android=com.imo.android.imoim,com.twitter.android,com.android.vending equals www.twitter.com (Twitter)
Source: android	String found in binary or memory: com.imo.android.imoim,com.twitter.android equals www.twitter.com (Twitter)
Source: android	String found in binary or memory: com.imo.android.imoim,com.twitter.android,com.android.vending equals www.twitter.com (Twitter)
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: https://twitter.com/JackCorne equals www.twitter.com (Twitter)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: stefankoebalimivsemotdelom.com

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: POST /private/checkPanel.php HTTP/1.1Content-Length: 0User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: stefankoebalimivsemotdelom.comConnection: Keep-AliveAccept-Encoding: gzipContent-Type: application/x-www-form-urlencoded

Urls found in memory or binary data

Show sources

Source: android	String found in binary or memory: http://adobe3245292f9f.pw
Source: android	String found in binary or memory: http://adobe3245292f9f.pw/private/checkPanel.php
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: http://en.utrace.de
Source: xjhzyerdwxwl.dex.dr, android	String found in binary or memory: http://ktosdelaetskrintotpidor.com
Source: zqnanaz.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto
Source: dcuahmuli.xml, zmlycmyztje.xml	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: http://sositehuypidarasi.com
Source: android	String found in binary or memory: http://www.openmobilealliance.org/tech/DTD/xhtml-mobile11.dtd
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: https://&https://stefankoebalimivsemotdelom.comRhttps://support.google.com/calendar/answer/6261951?h
Source: android	String found in binary or memory: https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/assets/as.css
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/assets/m2_tweets.js
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/images/brandbar_divider
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/images/favicon.ico
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/images/sprites/magnifyi
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/images/sprites/notifica
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/javascripts/framebust.j
Source: android	String found in binary or memory: https://ma.twimg.com/twitter-mobile/3010d5e15915cc908e62a14eb1ffb7d95c1248b6/javascripts/servicework
Source: xjhzyerdwxwl.dex.dr, android	String found in binary or memory: https://stefankoebalimivsemotdelom.com
Source: android	String found in binary or memory: https://stefankoebalimivsemotdelom.com/private/checkPanel.php
Source: xjhzyerdwxwl.dex.dr, android	String found in binary or memory: https://support.google.com/calendar/answer/6261951?hl=en&co=GENIE.Platform=Android
Source: android	String found in binary or memory: https://support.twitter.com/
Source: android	String found in binary or memory: https://support.twitter.com/articles/20170514
Source: android	String found in binary or memory: https://support.twitter.com/articles/20174632
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: https://twitter.com/JackCorne
Source: android	String found in binary or memory: https://twitter.com/jackcorne

Uses HTTP for connecting to the internet

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.b$a;->a:22	API Call: com.android.okhttp.internal.http.HttpsURLConnectionImpl.connect
Source: com.midmsz.lhlytazfhrp.c$a;->a:14	API Call: com.android.okhttp.internal.http.HttpsURLConnectionImpl.connect
Source: com.midmsz.lhlytazfhrp.NLkgkai$a;->a:15	API Call: java.net.HttpURLConnection.connect

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46631
Source: unknown	Network traffic detected: HTTP traffic on port 42137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36597
Source: unknown	Network traffic detected: HTTP traffic on port 34933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47319
Source: unknown	Network traffic detected: HTTP traffic on port 57396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49139
Source: unknown	Network traffic detected: HTTP traffic on port 43051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33547
Source: unknown	Network traffic detected: HTTP traffic on port 56730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42137
Source: unknown	Network traffic detected: HTTP traffic on port 33547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49642
Source: unknown	Network traffic detected: HTTP traffic on port 38849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52018
Source: unknown	Network traffic detected: HTTP traffic on port 53015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35322
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57396
Source: unknown	Network traffic detected: HTTP traffic on port 53041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49155
Source: unknown	Network traffic detected: HTTP traffic on port 49155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43051
Source: unknown	Network traffic detected: HTTP traffic on port 35322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34933
Source: unknown	Network traffic detected: HTTP traffic on port 44720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59347
Source: unknown	Network traffic detected: HTTP traffic on port 47319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53041
Source: unknown	Network traffic detected: HTTP traffic on port 46631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43322
Source: unknown	Network traffic detected: HTTP traffic on port 34345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59347 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Found potential keylogger

Show sources

Source: Lcom/midmsz/lhlytazfhrp/ClzpwjSDbK;->a()V	Instruction: "const-string v5, "keylogger""
Source: Lcom/midmsz/lhlytazfhrp/ClzpwjSDbK;->a()V	Instruction: "const-string v9, "getkeylogger""
Source: Lcom/midmsz/lhlytazfhrp/ClzpwjSDbK;->a()V	Instruction: "const-string v9, "getkeylogger -> commands""
Source: Lcom/midmsz/lhlytazfhrp/c;->b(Landroid/content/Context;)V	Instruction: "const-string v0, "keylogger""
Source: Lcom/midmsz/lhlytazfhrp/c;->b(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;	Instruction: "const-string v1, "/private/datakeylogger.php""
Source: Lcom/midmsz/lhlytazfhrp/ieURcXnUxB;->onAccessibilityEvent(Landroid/view/accessibility/AccessibilityEvent;)V	Instruction: "const-string v10, "keylogger""

Has permission to record audio in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECORD_AUDIO

Records audio/media

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.hbanyboq.XiNFRe;->a:15	API Call: android.media.MediaRecorder.start
Source: com.midmsz.lhlytazfhrp.qfjbtlzm.hbanyboq.rEWlchjPN;->a:27	API Call: android.media.MediaRecorder.start

Accesses the audio/media managers

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.hbanyboq.XiNFRe;->a:4	API Call: android.media.MediaRecorder.<init>
Source: com.midmsz.lhlytazfhrp.qfjbtlzm.hbanyboq.rEWlchjPN;->a:15	API Call: android.media.MediaRecorder.<init>

E-Banking Fraud:

Detected Anubis BankBot ransomware / banking trojan

Show sources

Source: Lcom/midmsz/lhlytazfhrp/ClzpwjSDbK;->a()V	Method string: htmllocker
Source: Lcom/midmsz/lhlytazfhrp/ClzpwjSDbK;->a()V	Method string: ERROR -> htmllocker
Source: Lcom/midmsz/lhlytazfhrp/c;->b(Landroid/content/Context;)V	Method string: htmllocker
Source: Lcom/midmsz/lhlytazfhrp/c;->d(Landroid/content/Context;Ljava/lang/String;)Ljava/lang/String;	Method string: htmllocker
Source: Lcom/midmsz/lhlytazfhrp/EPjYwbYa;->a(Ljava/io/File;)V	Method string: .AnubisCrypt
Source: Lcom/midmsz/lhlytazfhrp/EPjYwbYa;->b(Ljava/io/File;)V	Method string: .AnubisCrypt
Source: Lcom/midmsz/lhlytazfhrp/misnhpdmas/mkZckIRiMZ;->onCreate(Landroid/os/Bundle;)V	Method string: htmllocker

Found large list of e-Banking application (likely related to e-Banking fraud)

Show sources

Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.spardat.bcrmobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.spardat.netbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bankaustria.android.olb
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bmo.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.cibc.android.mobi
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbc.mobile.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.scotiabank.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.td
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: cz.airbank.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: eu.inmite.prj.kb.mobilbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bankinter.launcher
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.kutxabank.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rsi
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.tecnocom.cajalaboral
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: es.bancopopular.nbmpopular
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: es.evobanco.bancamovil
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: es.lacaixa.mobile.android.newwapicon
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.dbs.hk.dbsmbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.FubonMobileClient
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.hangseng.rbmobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.MobileTreeApp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.mtel.androidbea
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.scb.breezebanking.hk
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: hk.com.hsbc.hsbchkmobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.aff.otpdirekt
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ideomobile.hapoalim
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.infrasofttech.indianBank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.mobikwik_new
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.oxigen.oxigenwallet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: jp.co.aeonbank.android.passbook
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: jp.co.netbk
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: jp.co.rakuten_bank.rakutenbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: jp.co.sevenbank.AppPassbook
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: jp.co.smbc.direct
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: jp.mufg.bk.applisp.app
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.barclays.ke.mobile.android.ui
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: nz.co.anz.android.mobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: nz.co.asb.asbmobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: nz.co.bnz.droidbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: nz.co.kiwibank.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.getingroup.mobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: eu.eleader.mobilebanking.pekao.firm
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: eu.eleader.mobilebanking.pekao
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: eu.eleader.mobilebanking.raiffeisen
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.bzwbk.bzwbk24
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.ipko.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.mbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: alior.bankingapp.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.comarch.mobile.banking.bgzbnpparibas.biznes
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.comarch.security.mobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.empik.empikapp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.empik.empikfoto
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.finanteq.finance.ca
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.orangefinansek
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: eu.eleader.mobilebanking.invest
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.aliorbank.aib
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.allegro
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.bosbank.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.bph
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.bps.bankowoscmobilna
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.bzwbk.ibiznes24
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.bzwbk.mobile.tab.bzwbk24
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.ceneo
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.com.rossmann.centauros
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.fmbank.smart
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.ideabank.mobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.ing.mojeing
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.millennium.corpApp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.orange.mojeorange
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.pkobp.iko
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: pl.pkobp.ipkobiznes
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.kuveytturk.mobil
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.magiclick.odeabank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.mobillium.papara
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.pozitron.albarakaturk
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.teb
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ccom.tmob.denizbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.tmob.tabletdeniz
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.vakifbank.mobilel
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: tr.com.sekerbilisim.mbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: wit.android.bcpBankingApp.millenniumPL
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.advantage.RaiffeisenBank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: hr.asseco.android.jimba.mUCI.ro
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: may.maybank.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ro.btrl.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.amazon.mShop.android.shopping
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.amazon.windowshop
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ebay.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.sberbankmobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.sberbank.spasibo
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.sberbank_sbbol
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.sberbank.mobileoffice
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.sberbank.sberbankir
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.alfabank.mobile.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.alfabank.oavdo.amc
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: by.st.alfa
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.alfabank.sense
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.alfadirect.app
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.mw
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.idamob.tinkoff.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.tcsbank.c2c
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.tinkoff.mgp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.tinkoff.sme
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.tinkoff.goabroad
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.vtb24.mobilebanking.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: ru.bm.mbm
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.vtb.mobilebank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bssys.VTBClient
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bssys.vtb.mobileclient
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.akbank.android.apps.akbank_direkt
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.akbank.android.apps.akbank_direkt_tablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.akbank.softotp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.akbank.android.apps.akbank_direkt_tablet_20
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.fragment.akbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ykb.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ykb.android.mobilonay
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ykb.avm
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ykb.androidtablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.veripark.ykbaz
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.softtech.iscek
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.yurtdisi.iscep
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.softtech.isbankasi
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.monitise.isbankmoscow
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.finansbank.mobile.cepsube
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: finansbank.enpara
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.magiclick.FinansPOS
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.matriksdata.finansyatirim
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: finansbank.enpara.sirketim
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.vipera.ts.starter.QNB
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.redrockdigimark
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.garanti.cepsubesi
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.garanti.cepbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.garantibank.cepsubesiro
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: biz.mobinex.android.apps.cep_sifrematik
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.garantiyatirim.fx
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.tmobtech.halkbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.SifrebazCep
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: eu.newfrontier.iBanking.mobile.Halk.Retail
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: tr.com.tradesoft.tradingsystem.gtpmobile.halk
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.DijitalSahne.EnYakinHalkbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ziraat.ziraatmobil
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ziraat.ziraattablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.matriksmobile.android.ziraatTrader
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.matriksdata.ziraatyatirim.pad
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.comdirect.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.commerzbanking.mobil
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.consorsbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.db.mm.deutschebank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.dkb.portalapp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.de.dkb.portalapp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ing.diba.mbbr2
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.postbank.finanzassistent
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: mobile.santander.de
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.fiducia.smartphone.android.banking.vr
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: fr.creditagricole.androidapp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: fr.axa.monaxa
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: fr.banquepopulaire.cyberplus
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: net.bnpparibas.mescomptes
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.boursorama.android.clients
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.caisseepargne.android.mobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: fr.lcl.android.customerarea
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.paypal.android.p2pmobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.wf.wellsfargomobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.wf.wellsfargomobile.tablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.wellsFargo.ceomobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.usbank.mobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.usaa.mobile.android.usaa
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.suntrust.mobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.moneybookers.skrillpayments.neteller
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.moneybookers.skrillpayments
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.clairmail.fth
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.konylabs.capitalone
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.yinzcam.facilities.verizon
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.chase.sig.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.infonow.bofa
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bankofamerica.cashpromobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: uk.co.bankofscotland.businessbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.grppl.android.shell.BOS
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbs.mobile.android.natwestoffshore
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbs.mobile.android.natwest
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbs.mobile.android.natwestbandc
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbs.mobile.investisir
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.phyder.engage
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbs.mobile.android.rbs
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbs.mobile.android.rbsbandc
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: uk.co.santander.santanderUK
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: uk.co.santander.businessUK.bb
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.sovereign.santander
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ifs.banking.fiid4202
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.fi6122.godough
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.rbs.mobile.android.ubr
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.htsu.hsbcpersonalbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.grppl.android.shell.halifax
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.grppl.android.shell.CMBlloydsTSB73
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.barclays.android.barclaysmobilebanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.unionbank.ecommerce.mobile.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.unionbank.ecommerce.mobile.commercial.legacy
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.snapwork.IDBI
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.idbibank.abhay_card
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: src.com.idbi
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.idbi.mpassbook
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.ing.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.snapwork.hdfc
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.sbi.SBIFreedomPlus
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: hdfcbank.hdfcquickbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.csam.icici.bank.imobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: in.co.bankofbaroda.mpassbook
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.axis.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: cz.csob.smartbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: cz.sberbankcz
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: sk.sporoapps.accounts
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: sk.sporoapps.skener
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.cleverlance.csas.servis24
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: org.westpac.bank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: nz.co.westpac
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: au.com.suncorp.SuncorpBank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: org.stgeorge.bank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: org.banksa.bank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: au.com.newcastlepermanent
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: au.com.nab.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: au.com.mebank.banking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: au.com.ingdirect.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: MyING.be
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.imb.banking2
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.fusion.ATMLocator
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: au.com.cua.mb
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.commbank.netbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.cba.android.netbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.citibank.mobile.au
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.citibank.mobile.uk
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.citi.citimobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: org.bom.bank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bendigobank.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: me.doubledutch.hvdnz.cbnationalconference2016
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: au.com.bankwest.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bankofqueensland.boq
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.anz.android.gomoney
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.anz.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.anz.SingaporeDigitalBanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.anzspot.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.crowdcompass.appSQ0QACAcYJ
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.arubanetworks.atmanz
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.quickmobile.anzirevents15
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.volksbank.volksbankmobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: it.volksbank.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: it.secservizi.mobile.atime.bpaa
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.fiducia.smartphone.android.securego.vr
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.isis_papyrus.raiffeisen_pay_eyewdg
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.easybank.mbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.easybank.tablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.easybank.securityapp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.bawag.mbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bawagpsk.securityapp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: at.psa.app.bawag
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.pozitron.iscep
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.vakifbank.mobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.pozitron.vakifbank
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.starfinanz.smob.android.sfinanzstatus
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.starfinanz.mobile.android.pushtan
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.entersekt.authapp.sparkasse
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.starfinanz.smob.android.sfinanzstatus.tablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.starfinanz.smob.android.sbanking
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.palatine.android.mobilebanking.prod
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: fr.laposte.lapostemobile
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: fr.laposte.lapostetablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.cm_prod.bad
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.cm_prod.epasal
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.cm_prod_tablet.bad
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.cm_prod.nosactus
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: mobi.societegenerale.mobile.lappli
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bbva.netcash
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bbva.bbvacontigo
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bbva.bbvawallet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: es.bancosantander.apps
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.santander.app
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: es.cm.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: es.cm.android.tablet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bankia.wallet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.binance.dev
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.btcturk
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.binance.odapplications
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.blockfolio.blockfolio
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.crypter.cryptocyrrency
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: io.getdelta.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.edsoftapps.mycoinsvalue
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.coin.profit
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.mal.saul.coinmarketcap
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.tnx.apps.coinportfolio
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.coinbase.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.portfolio.coinbase_tracker
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: de.schildbach.wallet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: piuk.blockchain.android
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: info.blockchain.merchant
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.jackpf.blockchainsearch
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.unocoin.unocoinwallet
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.unocoin.unocoinmerchantPoS
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.thunkable.android.santoshmehta364.UNOCOIN_LIVE
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: wos.com.zebpay
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.localbitcoinsmbapp
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.thunkable.android.manirana54.LocalBitCoins
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.thunkable.android.manirana54.LocalBitCoins_unblock
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.localbitcoins.exchange
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.coins.bit.local
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.coins.ful.bit
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.jamalabbasii1998.localbitcoin
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: zebpay.Application
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.bitcoin.ss.zebpayindia
Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: com.kryptokit.jaxx

Contains package name strings related to banking (usually for identifying banking APKs)

Show sources

Source: Lcom/midmsz/lhlytazfhrp/b;->a(Landroid/content/Context;)Ljava/lang/String;

Method String: at.spardat.netbanking, com.bankaustria.android.olb, com.scotiabank.mobile, cz.airbank.android, eu.inmite.prj.kb.mobilbank, com.bankinter.launcher, com.kutxabank.android, com.dbs.hk.dbsmbanking, com.scb.breezebanking.hk, hk.com.hsbc.hsbchkmobilebanking, jp.co.aeonbank.android.passbook, jp.co.rakuten_bank.rakutenbank, jp.co.sevenbank.AppPassbook, nz.co.anz.android.mobilebanking, nz.co.bnz.droidbanking, nz.co.kiwibank.mobile, com.getingroup.mobilebanking, eu.eleader.mobilebanking.pekao.firm, eu.eleader.mobilebanking.pekao, eu.eleader.mobilebanking.raiffeisen, com.comarch.mobile.banking.bgzbnpparibas.biznes, com.comarch.security.mobilebanking, eu.eleader.mobilebanking.invest, pl.aliorbank.aib, pl.bosbank.mobile, pl.bps.bankowoscmobilna, pl.fmbank.smart, pl.ideabank.mobilebanking, com.magiclick.odeabank, com.vakifbank.mobilel, tr.com.sekerbilisim.mbank, may.maybank.android, ru.sberbank.spasibo, ru.sberbank.mobileoffice, ru.sberbank.sberbankir, ru.alfabank.mobile.android, ru.alfabank.oavdo.amc, ru.alfabank.sense, ru

Has functionalty to add an overlay to other apps

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.a.c$a;->onStart:83

API Call: WindowManager.addView

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

May check for popular installed apps

Show sources

Source: Lcom/midmsz/lhlytazfhrp/ieURcXnUxB$1;->run()V	Method string: "com.imo.android.imoim,com.twitter.android"
Source: Lcom/midmsz/lhlytazfhrp/ieURcXnUxB$1;->run()V	Method string: "com.imo.android.imoim,com.twitter.android"
Source: Lcom/midmsz/lhlytazfhrp/ieURcXnUxB$1;->run()V	Method string: "com.imo.android.imoim,com.twitter.android,com.android.vending"

May query for the most recent running application (usually for UI overlaying)

Show sources

Source: com.midmsz.lhlytazfhrp.mcTWTMbWl;->b	getRunningTasks and getPackageName invocations in same method: com.midmsz.lhlytazfhrp.mcTWTMbWl;->b:8, com.midmsz.lhlytazfhrp.mcTWTMbWl;->b:13
Source: com.midmsz.lhlytazfhrp.mcTWTMbWl;->b	getRunningTasks and getPackageName invocations in same method: com.midmsz.lhlytazfhrp.mcTWTMbWl;->b:8, com.midmsz.lhlytazfhrp.mcTWTMbWl;->b:13

Spam, unwanted Advertisements and Ransom Demands:

Tries to disable the administrator user

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.a.a;->onCreate:26

API Call: android.app.admin.DevicePolicyManager.removeActiveAdmin

Dials phone numbers

Show sources

Source: com.midmsz.lhlytazfhrp.misnhpdmas.RcGhOT;->onCreate:22

API Call: com.midmsz.lhlytazfhrp.misnhpdmas.RcGhOT.startActivity

Has permission to perform phone calls in the background

Show sources

Source: submitted apk

Request permission: android.permission.CALL_PHONE

Has permission to send SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.SEND_SMS

Has permission to write to the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.WRITE_SMS

May check for popular installed apps

Show sources

Source: Lcom/midmsz/lhlytazfhrp/ieURcXnUxB$1;->run()V	Method string: "com.imo.android.imoim,com.twitter.android"
Source: Lcom/midmsz/lhlytazfhrp/ieURcXnUxB$1;->run()V	Method string: "com.imo.android.imoim,com.twitter.android"
Source: Lcom/midmsz/lhlytazfhrp/ieURcXnUxB$1;->run()V	Method string: "com.imo.android.imoim,com.twitter.android,com.android.vending"

Sends SMS using SmsManager

Show sources

Source: com.midmsz.lhlytazfhrp.c;->c:1193

API Call: android.telephony.SmsManager.sendMultipartTextMessage

Operating System Destruction:

Lists and deletes files in the same context

Show sources

Source: com.midmsz.lhlytazfhrp.EPjYwbYa;->b:70	API Calls in same method context: File.listFiles,File.delete
Source: com.midmsz.lhlytazfhrp.EPjYwbYa;->a:30	API Calls in same method context: File.listFiles,File.delete

Change of System Appearance:

May access the Android keyguard (lock screen)

Show sources

Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: Landroid/app/KeyguardManager;
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: inKeyguardRestrictedInputMode
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: keyguard
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: Landroid/app/KeyguardManager;"Landroid/app/Notification$Builder;
Source: xjhzyerdwxwl.dex.dr	String found in binary or memory: keyguardkeylogger

Acquires a wake lock

Show sources

Source: com.midmsz.lhlytazfhrp.YOdljfSlmTYA;->onHandleIntent:24

API Call: android.os.PowerManager$WakeLock.acquire

Mutes ringtone sound

Show sources

Source: com.midmsz.lhlytazfhrp.c;->l:1332	API Call: android.media.AudioManager.setRingerMode("0")
Source: com.midmsz.lhlytazfhrp.misnhpdmas.RcGhOT;->onCreate:25	API Call: android.media.AudioManager.setRingerMode("0")

Sets a repeating alarm

Show sources

Source: com.midmsz.lhlytazfhrp.c;->a:73

API Call: android.app.AlarmManager.setRepeating

System Summary:

Requests permissions only permitted to signed APKs

Show sources

Source: submitted apk

Request permission: android.permission.PACKAGE_USAGE_STATS

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.ACCESS_FINE_LOCATION
Source: submitted apk	Request permission: android.permission.CALL_PHONE
Source: submitted apk	Request permission: android.permission.GET_TASKS
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.READ_CONTACTS
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.READ_SMS
Source: submitted apk	Request permission: android.permission.RECEIVE_SMS
Source: submitted apk	Request permission: android.permission.RECORD_AUDIO
Source: submitted apk	Request permission: android.permission.SEND_SMS
Source: submitted apk	Request permission: android.permission.SYSTEM_ALERT_WINDOW
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE
Source: submitted apk	Request permission: android.permission.WRITE_SMS

Classification label

Show sources

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.and@0/249@5/0

Reads shares settings

Show sources

Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "Interval": null
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "swspacket": null
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "interval": 10000
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "time_work": 0
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "urls": MzA5MGMwOGE4ZjNjMzk1MGM2OGQ2ZjI0OGI3ZjMyMDgwNjc4YzEyNWEzYTFiMDExNDljYTllMTBiYjM5MDNjNzIyZjNiYzgzZDlkNQ==
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "startRequest": Access=0Perm=0
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "save_inj":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "cryptfile": false
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "startRecordSound": stop
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "recordsoundseconds": 0
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "StringAccessibility": Enable access for
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "SettingsAll":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "play_protect":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "url": null
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "network": false
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "gps": false
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "htmllocker":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "urls": MzA5MGMwOGFjNjI5MzkxZWQxOTY2ODI3ZDkyMzZkNTI1MTIzOTIyZmYzYWFmNzE3NGQ=
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "websocket":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "spamSMS":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "findfiles":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "time_work": 25
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "status":
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "time_work": 50
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "time_work": 75
Source: com.midmsz.lhlytazfhrp.c;->d:1200	API Call: "time_work": 100

Data Obfuscation:

Accesses Class Loader via Reflection

Show sources

Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621

API Call: Reflective call: public java.lang.ClassLoader java.lang.Class.getClassLoader()

Loads new DEX files via dynamic constructor

Show sources

Source: com.ifenbof.rloaerl.bucqrDfK;->uDsLeosDkNjy:58

API Call: Constructor call: public dalvik.system.DexClassLoader(java.lang.String,java.lang.String,java.lang.String,java.lang.ClassLoader)

Found very long method strings

Show sources

Source: Lcom/midmsz/lhlytazfhrp/b;-><clinit>()V

Method string: [az]Yand\u0131rmaq \u00fc\u00e7\u00fcn giri\u015f::[sq]Mund\u00ebsimi i aksesit p\u00ebr::[am]\u12f0\u1228\u1303 \u1218\u12f5\u1228\u1235 \u12f0\u1228\u1303 \u12a0\u120d\u1270\u1230\u1320\u12cd\u121d::[en]Enable access for::[ar]\u062a\u0645\u0643\u064a\u0 Length: 6006

Obfuscates method names

Show sources

Source: 7RORCb5RSo

Total valid method names: 10%

Uses reflection

Show sources

Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public android.content.Context android.content.ContextWrapper.getBaseContext()
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public java.io.File android.app.ContextImpl.getDir(java.lang.String,int)
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public java.lang.String java.io.File.getAbsolutePath()
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public android.content.res.AssetManager android.content.ContextWrapper.getAssets()
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public final android.content.res.AssetFileDescriptor android.content.res.AssetManager.openNonAssetFd(java.lang.String) throws java.io.IOException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public java.io.FileInputStream android.content.res.AssetFileDescriptor.createInputStream() throws java.io.IOException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public int android.content.res.AssetFileDescriptor$AutoCloseInputStream.read(byte[]) throws java.io.IOException
Source: com.ifenbof.rloaerl.alpEDTaEFP;->uDsLeosDkNjy:99	API Call: Real call: public static void java.lang.System.arraycopy(byte[],int,byte[],int,int)
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public int android.content.res.AssetFileDescriptor$AutoCloseInputStream.read(byte[]) throws java.io.IOException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public int android.content.res.AssetFileDescriptor$AutoCloseInputStream.read(byte[]) throws java.io.IOException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public static java.lang.Class java.lang.Class.forName(java.lang.String) throws java.lang.ClassNotFoundException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:624	API Call: Real call: public void java.io.OutputStream.write(byte[]) throws java.io.IOException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public java.lang.ClassLoader java.lang.Class.getClassLoader()
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public static java.lang.Class java.lang.Class.forName(java.lang.String) throws java.lang.ClassNotFoundException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public static java.lang.Class java.lang.Class.forName(java.lang.String) throws java.lang.ClassNotFoundException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public static java.lang.Class java.lang.Class.forName(java.lang.String) throws java.lang.ClassNotFoundException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:301	API Call: Real call: public static final java.lang.Boolean java.lang.Boolean.TRUE
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public void java.lang.reflect.AccessibleObject.setAccessible(boolean)
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:411	API Call: Real call: final android.app.LoadedApk android.app.ContextImpl.mPackageInfo
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public void java.lang.reflect.AccessibleObject.setAccessible(boolean)
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public static java.lang.Class java.lang.Class.forName(java.lang.String) throws java.lang.ClassNotFoundException
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public boolean java.io.File.delete()
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:621	API Call: Real call: public boolean java.io.File.delete()
Source: com.midmsz.lhlytazfhrp.c;->a:35	API Call: java.lang.reflect.Method.invoke
Source: com.midmsz.lhlytazfhrp.c;->a:63	API Call: java.lang.reflect.Method.invoke
Source: com.midmsz.lhlytazfhrp.c;->a:95	API Call: java.lang.reflect.Method.invoke
Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->qimcrpUJVuZn:557	API Call: java.lang.reflect.Field.get

Persistence and Installation Behavior:

Tries to get accessibilty permissions (for UI automation)

Show sources

Source: com.midmsz.lhlytazfhrp.misnhpdmas.amvCJP;->onCreate:6

API Call: com.midmsz.lhlytazfhrp.misnhpdmas.amvCJP.startActivity

Creates files

Show sources

Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->b:1297	API Call: com.midmsz.lhlytazfhrp.ClzpwjSDbK.openFileOutput
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->a:56	API Call: com.midmsz.lhlytazfhrp.ieURcXnUxB.openFileOutput
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->b:112	API Call: com.midmsz.lhlytazfhrp.ieURcXnUxB.openFileOutput

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Installs a new wake lock (to get activate on phone screen on)

Show sources

Source: com.midmsz.lhlytazfhrp.YOdljfSlmTYA;->onHandleIntent:23

API Call: android.os.PowerManager.newWakeLock

Starts/registers a service/receiver on phone boot (autostart)

Show sources

Source: com.midmsz.lhlytazfhrp.sajqbronxe.rHVmIGXxH;->a:5	API Call: android.content.Context.startService (not executed)
Source: com.midmsz.lhlytazfhrp.sajqbronxe.rHVmIGXxH;->a:27	API Call: android.content.Context.startService (not executed)
Source: com.midmsz.lhlytazfhrp.sajqbronxe.rHVmIGXxH;->b:53	API Call: android.content.Context.startService (not executed)

Hooking and other Techniques for Hiding and Protection:

Potential hidden JAR / DEX file creation routine find

Show sources

Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->CmnvQKmOxW:47

API Call: java.lang.String.<init> /xjhzyerdwxwl.jar

Potential hidden file creation routine find

Show sources

Source: com.ifenbof.rloaerl.hzeGAusFSaNG;->uDsLeosDkNjy:696

API Call: java.lang.String.<init> java.io.FileOutputStream

Protects itself from removal

Show sources

Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:403

API Calls in same method context: AccessibilityNodeInfo.findAccessibilityNodeInfosByText,AccessibilityEvent.getPackageName

Has permission to draw over other applications or user interfaces

Show sources

Source: submitted apk

Request permission: android.permission.SYSTEM_ALERT_WINDOW

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Queries list of running processes/tasks

Show sources

Source: com.midmsz.lhlytazfhrp.mcTWTMbWl;->b:8	API Call: android.app.ActivityManager.getRunningTasks
Source: com.midmsz.lhlytazfhrp.mcTWTMbWl;->b:17	API Call: android.app.ActivityManager.getRunningAppProcesses

Removes its application launcher (likely to stay hidden)

Show sources

Source: com.midmsz.lhlytazfhrp.misnhpdmas.QmkEVeIcy;->onCreate:16

API Call: android.content.pm.PackageManager.setComponentEnabledSetting

Malware Analysis System Evasion:

Accesses android OS build fields

Show sources

Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->a:35	Field Access: android.os.Build$VERSION.RELEASE
Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->a:37	Field Access: android.os.Build.MODEL
Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->a:41	Field Access: android.os.Build.PRODUCT
Source: com.midmsz.lhlytazfhrp.c;->q:1352	Field Access: android.os.Build.BOARD
Source: com.midmsz.lhlytazfhrp.c;->q:1355	Field Access: android.os.Build.BRAND
Source: com.midmsz.lhlytazfhrp.c;->q:1358	Field Access: android.os.Build.CPU_ABI
Source: com.midmsz.lhlytazfhrp.c;->q:1361	Field Access: android.os.Build.DEVICE
Source: com.midmsz.lhlytazfhrp.c;->q:1364	Field Access: android.os.Build.DISPLAY
Source: com.midmsz.lhlytazfhrp.c;->q:1367	Field Access: android.os.Build.HOST
Source: com.midmsz.lhlytazfhrp.c;->q:1370	Field Access: android.os.Build.ID
Source: com.midmsz.lhlytazfhrp.c;->q:1373	Field Access: android.os.Build.MANUFACTURER
Source: com.midmsz.lhlytazfhrp.c;->q:1376	Field Access: android.os.Build.MODEL
Source: com.midmsz.lhlytazfhrp.c;->q:1379	Field Access: android.os.Build.PRODUCT
Source: com.midmsz.lhlytazfhrp.c;->q:1382	Field Access: android.os.Build.TAGS
Source: com.midmsz.lhlytazfhrp.c;->q:1385	Field Access: android.os.Build.TYPE
Source: com.midmsz.lhlytazfhrp.c;->q:1388	Field Access: android.os.Build.USER

Queries the unique operating system id (ANDROID_ID)

Show sources

Source: com.midmsz.lhlytazfhrp.c;->q:1347	API Call: android.provider.Settings.Secure.getString
Source: com.midmsz.lhlytazfhrp.c;->q:1347	API Call: android.provider.Settings.Secure.getString
Source: com.midmsz.lhlytazfhrp.c;->q:1347	API Call: android.provider.Settings.Secure.getString
Source: com.midmsz.lhlytazfhrp.c;->q:1347	API Call: android.provider.Settings.Secure.getString
Source: com.midmsz.lhlytazfhrp.c;->q:1347	API Call: android.provider.Settings.Secure.getString
Source: com.midmsz.lhlytazfhrp.c;->q:1347	API Call: android.provider.Settings.Secure.getString

Anti Debugging:

Access the class loader (often done to load a new code)

Show sources

Source: Lcom/ifenbof/rloaerl/hzeGAusFSaNG;->uDsLeosDkNjy(Ljava/lang/Object;Ljava/lang/Object;)V

Method string: "mClassLoader"

HIPS / PFW / Operating System Protection Evasion:

Uses the DexClassLoader (often used for code injection)

Show sources

Source: com.midmsz.lhlytazfhrp.c;->a:30	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.midmsz.lhlytazfhrp.c;->a:32	API Call: dalvik.system.DexClassLoader.loadClass (not executed)
Source: com.midmsz.lhlytazfhrp.c;->a:57	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.midmsz.lhlytazfhrp.c;->a:59	API Call: dalvik.system.DexClassLoader.loadClass (not executed)
Source: com.midmsz.lhlytazfhrp.c;->a:89	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.midmsz.lhlytazfhrp.c;->a:91	API Call: dalvik.system.DexClassLoader.loadClass (not executed)

Language, Device and Operating System Detection:

Queries the network operator ISO country code

Show sources

Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->a:47	API Call: android.telephony.TelephonyManager.getNetworkCountryIso returned ""
Source: com.midmsz.lhlytazfhrp.c;->p:1343	API Call: android.telephony.TelephonyManager.getNetworkCountryIso

Queries the network operator name

Show sources

Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->a:55

API Call: android.telephony.TelephonyManager.getNetworkOperatorName returned "Swisscom Ltd"

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: com.midmsz.lhlytazfhrp.ClzpwjSDbK;->a:60

API Call: android.telephony.TelephonyManager.getLine1Number

Stealing of Sensitive Information:

Uses accessibility services (likely to control other applications)

Show sources

Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:233	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:238	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:264	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:290	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:308	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:323	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:339	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:349	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:359	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.midmsz.lhlytazfhrp.ieURcXnUxB;->onAccessibilityEvent:365	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText

Creates SMS data (e.g. PDU)

Show sources

Source: com.midmsz.lhlytazfhrp.sajqbronxe.rHVmIGXxH;->b:41

API Call: android.telephony.SmsMessage.createFromPdu

Has permission to read contacts

Show sources

Source: submitted apk

Request permission: android.permission.READ_CONTACTS

Has permission to read the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.READ_SMS

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Has permission to receive SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_SMS

Monitors incoming SMS

Show sources

Source: com.midmsz.lhlytazfhrp.sajqbronxe.rHVmIGXxH

Registered receiver: android.provider.Telephony.SMS_RECEIVED

Queries SMS data

Show sources

Source: com.midmsz.lhlytazfhrp.prYyUQn;->c:4	API Call: android.net.Uri.parse("content://sms/inbox")
Source: com.midmsz.lhlytazfhrp.prYyUQn;->b:49	API Call: android.net.Uri.parse("content://sms/sent")

Queries a list of installed applications

Show sources

Source: com.midmsz.lhlytazfhrp.b;->a:49	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: com.midmsz.lhlytazfhrp.c;->c:1007	API Call: android.content.pm.PackageManager.getInstalledApplications

Queries phone contact information

Show sources

Source: com.midmsz.lhlytazfhrp.misnhpdmas.jahfLZvxewv;->a:9	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI
Source: com.midmsz.lhlytazfhrp.misnhpdmas.jahfLZvxewv;->a:69	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI

Redirects camera/video feed

Show sources

Source: com.midmsz.lhlytazfhrp.qfjbtlzm.hbanyboq.XiNFRe;->a:11	API Call: android.media.MediaRecorder.setOutputFile
Source: com.midmsz.lhlytazfhrp.qfjbtlzm.hbanyboq.rEWlchjPN;->a:23	API Call: android.media.MediaRecorder.setOutputFile

Has permission to query the current location

Show sources

Source: submitted apk

Request permission: android.permission.ACCESS_FINE_LOCATION

Remote Access Functionality:

Found parser code for incoming SMS (may be used to act on incoming SMS, BOT)

Show sources

Source: com.midmsz.lhlytazfhrp.sajqbronxe.rHVmIGXxH;->a:29

API Call: java.lang.String.equals android.provider.Telephony.SMS_RECEIVED

Found suspicious command strings (may be related to BOT commands)

Show sources

Source: Lcom/midmsz/lhlytazfhrp/qfjbtlzm/hbanyboq/rEWlchjPN$1;->run()V	Method string: "stop record sound"
Source: Lcom/midmsz/lhlytazfhrp/qfjbtlzm/ehzutzj/RAJfXSspO;->onHandleIntent(Landroid/content/Intent;)V	Method string: "sendsms"
Source: Lcom/midmsz/lhlytazfhrp/b;-><init>()V	Method string: "android.permission.send_sms"
Source: Lcom/midmsz/lhlytazfhrp/qfjbtlzm/hbanyboq/rEWlchjPN;->a(Landroid/content/Context;Ljava/lang/String;I)V	Method string: "start record sound"
Source: Lcom/midmsz/lhlytazfhrp/qfjbtlzm/hbanyboq/rEWlchjPN$1;->run()V	Instruction: "const-string v3, "stop record sound""
Source: Lcom/midmsz/lhlytazfhrp/qfjbtlzm/ehzutzj/RAJfXSspO;->onHandleIntent(Landroid/content/Intent;)V	Instruction: "const-string v0, "sendsms""
Source: Lcom/midmsz/lhlytazfhrp/b;-><init>()V	Instruction: "const-string v1, "android.permission.send_sms""
Source: Lcom/midmsz/lhlytazfhrp/qfjbtlzm/hbanyboq/rEWlchjPN;->a(Landroid/content/Context;Ljava/lang/String;I)V	Instruction: "const-string v2, "start record sound""

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7RORCb5RSo	41%	virustotal		Browse
7RORCb5RSo	100%	Avira	ANDROID/Dropper.NACP.Gen

Dropped Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
stefankoebalimivsemotdelom.com	4%	virustotal		Browse
adobe3245292f9f.pw	9%	virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ktosdelaetskrintotpidor.com	0%	virustotal		Browse
https://stefankoebalimivsemotdelom.com/private/checkPanel.php	0%	virustotal		Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 7RORCb5RSo

Overview

General Information

Detection

Classification

Signature Overview

AV Detection:

Location Tracing:

Privilege Escalation:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

Operating System Destruction:

Change of System Appearance:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Antivirus Detection

Initial Sample

Dropped Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Screenshots

Thumbnails