Android.Packed.19432

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.511.origin

Network activity:

Connecting to:

c####.####.org
y####.####.cn
n####.####.cn
1####.####.67
o####.####.cn

HTTP GET requests:

c####.####.org/strategy/sul18
c####.####.org/strategy/symlink-adbd
c####.####.org/strategy/dev_root
c####.####.org/strategy/dev_root2
c####.####.org/strategy/larger4.3
c####.####.org/strategy/loss_4.3

HTTP POST requests:

n####.####.cn/ct/rwbhw/rll
1####.####.67/log/interface.html
y####.####.cn/ct/glewx/nxalk/mlgyv
o####.####.cn/5/init
n####.####.cn/ct/s/i
1####.####.67/strategy/interface.html

Modified file system:

Creates the following files:

/data/data/####/files/iapppay/SDK_tmp/pay_type_14.png
/data/data/####/files/iapppay/SDK_tmp/pay_type_17.png
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/Matrix
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/su
/data/data/####/files/iapppay/SDK_tmp/pay_type_9.png
/data/data/####/shared_prefs/bmob_data.xml
/data/data/####/files/iapppay/SDK_tmp/lpay_logo.png
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/supolicy
/data/data/####/files/iapppay/SDK_tmp/pay_logo.png
/sdcard/.qqlive/xiandai.db
/data/data/####/files/iapppay/SDK_tmp/aibei.txt
/data/data/####/files/iapppay/SDK_tmp/pay_type_15.png
/data/data/####/files/iapppay/SDK_tmp/pay_charge.png
/data/data/####/app_subox_download/2a0e2616-1017-4e2a-b649-f5648b6c6b6d
/data/data/####/app_Bmob/applicationId
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/su
/data/data/####/files/rj.jar
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/device.db
/data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/wsroot.sh
/data/data/####/databases/t_u.db-journal
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/supolicy
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/fileWork
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/install-recovery.sh
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/pidof
/data/data/####/shared_prefs/iapppay_proxy_log.xml
/data/data/####/files/iapppay/SDK_tmp/libcasdkjni.so
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/debuggerd
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/Matrix
/data/data/####/files/iapppay/SDK_tmp/pay_type_7p.png
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/wsroot.sh
/data/data/####/files/iapppay/SDK_tmp/build_info_file
/data/data/####/files/iapppay/SDK_tmp/lpay_arrow_down.png
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/pidof
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/Matrix
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/debuggerd
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/ddexe
/data/data/####/databases/phraseex.db-journal
/data/data/####/files/iapppay/SDK_tmp/main.jar
/data/data/####/files/iapppay/SDK_tmp/pay_tips.png
/data/data/####/files/iapppay/SDK_tmp/pay_type_5.png
/data/data/####/files/app_flag
/sdcard/.qqlive/xinhua.db
/data/data/####/files/SUBOXLOG_
/data/data/####/app_subox_download/9df34bbd-e8e0-4c54-b51a-b05040fb716c
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/su
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/wsroot.sh
/data/data/####/app_subox_download/faf1ba92-326d-4707-8612-05128112e95a
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/fileWork
/data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/files/iapppay/SDK_tmp/pay_type_1.png
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/debuggerd
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/pidof
/data/data/####/files/iapppay/SDK_tmp/pay_checkbox_checked.png
/data/data/####/files/iapppay/SDK_tmp/pay_checkbox_unchecked.png
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/toolbox
/sdcard/.iapppay_proxy/iapppay/iapppay_3.0.5002_0.zip
/data/data/####/shared_prefs/dsi.xml
/sdcard/.iapppay_proxy/iapppay/Config/FileConfig
/data/data/####/files/iapppay/SDK_tmp/lpay_title_bg.png
/sdcard/.qqlive/dic.zip
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/fileWork
/data/data/####/app_subox/b18a021d11a3004d25017230b681476b
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/supolicy
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/ddexe
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/su
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/fileWork
/data/data/####/files/iapppay/indebuginfo.log
/data/data/####/files/iapppay/SDK_tmp/libidentifyapp.so
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/pidof
/data/data/####/files/iapppay/SDK_tmp/pay_type_8.png
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/wsroot.sh
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/toolbox
/data/data/####/app_subox_download/178e7b38-da67-43e8-9d9d-2dfa758c5c0c
/data/data/####/databases/phraseex.db
/data/data/####/shared_prefs/key_of_xml.xml
/data/data/####/files/iapppay/SDK_tmp/pay_account.png
/data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/files/iapppay/SDK_tmp/apay_cheap.png
/data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/app_74068432-60d8-46af-a341-30bd44671497/eh.jar
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/install-recovery.sh
/data/data/####/files/iapppay/SDK_tmp/pay_right_arrow.png
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/supolicy
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/su
/data/data/####/files/iapppay/SDK_tmp/pay_top_line_bg.png
/data/data/####/shared_prefs/kr.xml
/data/data/####/files/mobclick_agent_cached_####
/data/data/####/files/iapppay/SDK_tmp/pay_spr.png
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/install-recovery.sh
/data/data/####/files/iapppay/SDK_tmp/pull_down_normal.png
/data/data/####/shared_prefs/mobclick_agent_state_####.xml
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/fileWork
/data/data/####/files/iapppay/SDK_tmp/pay_type_16.png
/data/data/####/files/iapppay/SDK_tmp/pay_clear.png
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/ddexe
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/supolicy
/data/data/####/files/iapppay/SDK_tmp/pay_spr_on.png
/data/data/####/files/iapppay/SDK_tmp/pay_type_11.png
/data/data/####/files/iapppay/SDK_tmp/pay_charge_on.png
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/toolbox
/data/data/####/files/iapppay/SDK_tmp/pay_type_13.png
/data/data/####/files/iapppay/SDK_tmp/pay_type_12.png
/data/data/####/files/iapppay/SDK_tmp/lpay_arrow_up.png
/data/data/####/files/iapppay/SDK_tmp/pay_type_7new.png
/data/data/####/files/iapppay/SDK_tmp/libusedes.so
/data/data/####/app_anonymous_files/anonymous_core.so
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/root3
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/Matrix
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/ddexe
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/debuggerd
/data/data/####/shared_prefs/kr.xml.bak
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/toolbox
/data/data/####/app_subox_download/f0f2e6eb-60fe-4430-b785-b3c59c37df73
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/install-recovery.sh
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/Matrix
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/ddexe
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/install-recovery.sh
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/debuggerd
/data/data/####/files/iapppay/SDK_tmp/apay_hub_divid.png
/sdcard/.qqlive/xinhua.db-journal
/data/data/####/files/iapppay/lst
/data/data/####/files/iapppay/SDK_tmp/pay_spinner_black_48.png
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/toolbox
/data/data/####/shared_prefs/mobclick_agent_header_####.xml
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/wsroot.sh
/data/data/####/files/iapppay/SDK_tmp/pull_down_press.png
/data/data/####/files/iapppay/SDK_tmp/pay_type_4.png
/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/pidof
/data/data/####/app_subox_download/6aa84cd8-fff2-41e4-a8ea-437c70f7ce34
/data/data/####/files/iapppay/SDK_tmp/pay_type_2.png

Sets the 'executable' attribute to the following files:

/data/data/####/app_092ed09b-c394-42f7-a61f-39554680bb33/Matrix
/data/data/####/app_c36bfc83-2fc8-489a-92ef-63779e5f177e/Matrix
/data/data/####/app_402c977e-bf61-4dcf-bf91-8b0e457e5c62/Matrix
/data/data/####/app_de063833-7b5c-42a4-9a68-ef0d50e649b4/Matrix
/data/data/####/app_c23262f9-160e-46f7-85dd-366dc9b4950e/Matrix

Miscellaneous:

Executes next shell scripts:

logcat -d -v raw -s AndroidRuntime:E -p ####
sh
logcat -c

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial