Android.Packed.19431

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.511.origin

Network activity:

Connecting to:

o####.####.cn
1####.####.67

HTTP GET requests:

1####.####.67/strategy/symlink-adbd
1####.####.67/strategy/dev_root2
1####.####.67/strategy/larger4.3
1####.####.67/strategy/UnknownDev
1####.####.67/strategy/sul18
1####.####.67/strategy/loss_4.3
1####.####.67/strategy/dev_root

HTTP POST requests:

1####.####.67/log/interface.html
o####.####.cn/ct/cwp/letf
1####.####.67/strategy/interface.html
o####.####.cn/ct/ox/ntnv/rs
o####.####.cn/ct/hs/p

Modified file system:

Creates the following files:

/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/Matrix
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/Matrix
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/su
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/ddexe
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/toolbox
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/ddexe
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/su
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/ddexe
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/debuggerd
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/debuggerd
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/shared_prefs/qq.xml
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/wsroot.sh
/data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/ddexe
/data/data/####/databases/t_u.db-journal
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/supolicy
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/pidof
/data/data/####/databases/webview.db-journal
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/supolicy
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/supolicy
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/Matrix
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/install-recovery.sh
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/debuggerd
/data/data/####/app_subox_download/3ee08d32-2d92-4b29-b12a-85c02922310d
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/install-recovery.sh
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/pidof
/data/data/####/shared_prefs/qq.xml.bak
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/fileWork
/data/data/####/files/kb.jar
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/files/SUBOXLOG_
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/su
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/Matrix
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/fileWork
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/wsroot.sh
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/install-recovery.sh
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/su
/data/data/####/app_subox_download/768317a8-9ac4-45ad-9bad-eeb5ad88c535
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/fileWork
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/supolicy
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/root3
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/debuggerd
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/fileWork
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/pidof
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/toolbox
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/pidof
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/toolbox
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/Matrix
/data/data/####/app_anonymous_files/anonymous_core.so
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/wsroot.sh
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/wsroot.sh
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/toolbox
/data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/shared_prefs/i_l_y.xml
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/supolicy
/data/data/####/app_subox/b18a021d11a3004d25017230b681476b
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/supolicy
/data/data/####/app_subox_download/1f294741-85ca-4519-9804-8dea31914bc0
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/fileWork
/data/data/####/app_subox_download/51b5c594-b42c-48ff-88a8-897e08d7c653
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/ddexe
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/fileWork
/data/data/####/app_subox/c61913b615fb6224701377a119081f36
/data/data/####/cache/ads1609280947.jar
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/su
/data/data/####/app_subox_download/e05c1bee-79c5-422a-9890-473c230b269b
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/device.db
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/app_subox_download/29f8b262-b5c1-4fbb-bbca-3d665c5ad942
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/su
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/pidof
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/wsroot.sh
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/debuggerd
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/install-recovery.sh
/data/data/####/app_ofi/[B@4a99eb18.jar
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/toolbox
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/wsroot.sh
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/pidof
/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/install-recovery.sh
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/toolbox
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/debuggerd
/data/data/####/app_subox_download/3310c03a-4ee6-4a5c-bf0b-aeb7942ded12
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/Matrix
/data/data/####/app_ehtmp/eh.jar
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/ddexe
/data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/cache/ApplicationCache.db-journal
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/install-recovery.sh

Sets the 'executable' attribute to the following files:

/data/data/####/app_c9705644-b00b-4e30-af06-717dc8a7e7ec/Matrix
/data/data/####/app_337dbaed-dc49-4cb8-80a6-2347008f670a/Matrix
/data/data/####/app_7cd14bcd-f7cf-4671-8762-fafb2f73e1f8/Matrix
/data/data/####/app_2db8638a-6d59-4ead-8ed2-d15a86362992/Matrix
/data/data/####/app_3f12d5bd-4b58-4878-8c94-8ad5c6e515c4/Matrix
/data/data/####/app_f8f6bf06-d5e3-4cb6-b323-e55e9e2d7ca9/Matrix

Miscellaneous:

Executes next shell scripts:

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial