Android.Packed.19440

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.511.origin

Network activity:

Connecting to:

j####.####.cn
1####.####.67

HTTP GET requests:

1####.####.67/strategy/symlink-adbd
1####.####.67/strategy/dev_root2
1####.####.67/strategy/larger4.3
1####.####.67/strategy/UnknownDev
1####.####.67/strategy/sul18
1####.####.67/strategy/loss_4.3
1####.####.67/strategy/dev_root

HTTP POST requests:

1####.####.67/log/interface.html
j####.####.cn/ct/q/rhjd
1####.####.67/strategy/interface.html
j####.####.cn/ct/ke/bglw
j####.####.cn/ct/pjcuj/ey/d

Modified file system:

Creates the following files:

/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/toolbox
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/Matrix
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/pidof
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/debuggerd
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/wsroot.sh
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/install-recovery.sh
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/toolbox
/data/data/####/app_subox_download/dd2f9c96-9366-431e-b76a-d7bd54020a2f
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/su
/data/data/####/shared_prefs/qq.xml
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/Matrix
/data/data/####/app_subox_download/052ef506-cf96-4799-ad28-02e13120c096
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/ddexe
/data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/fileWork
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/toolbox
/data/data/####/databases/t_u.db-journal
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/ddexe
/data/data/####/databases/webview.db-journal
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/install-recovery.sh
/data/data/####/app_ehtmp/eh.jar
/data/data/####/shared_prefs/qq.xml.bak
/data/data/####/app_subox_download/1c3f3d25-2fa9-4ca4-abb9-f7117ddcbe75
/data/data/####/app_ulr/[B@4a9aec34.jar
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/su
/data/data/####/app_subox_download/94828f4e-977f-4bf6-acd8-c134cf9e9d57
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/pidof
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/fileWork
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/ddexe
/data/data/####/files/SUBOXLOG_
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/Matrix
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/fileWork
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/Matrix
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/su
/data/data/####/files/hk.jar
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/supolicy
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/toolbox
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/fileWork
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/ddexe
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/install-recovery.sh
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/pidof
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/toolbox
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/install-recovery.sh
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/install-recovery.sh
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/Matrix
/data/data/####/cache/ads252182920.jar
/data/data/####/app_anonymous_files/anonymous_core.so
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/su
/data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/app_subox_download/33c3bb87-b238-4d1a-86c3-40c0bba33d96
/data/data/####/shared_prefs/i_l_y.xml
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/supolicy
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/ddexe
/data/data/####/app_subox/b18a021d11a3004d25017230b681476b
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/wsroot.sh
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/debuggerd
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/toolbox
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/fileWork
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/su
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/debuggerd
/data/data/####/app_subox_download/2d8da785-5ce3-49b1-b075-7754627014b1
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/wsroot.sh
/data/data/####/app_subox/c61913b615fb6224701377a119081f36
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/fileWork
/data/data/####/app_subox_download/e61f2364-8e44-4638-b1f9-4ccc29323b4b
/data/data/####/shared_prefs/myAppPrefs.xml
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/install-recovery.sh
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/wsroot.sh
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/device.db
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/pidof
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/wsroot.sh
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/debuggerd
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/supolicy
/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/Matrix
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/supolicy
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/ddexe
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/debuggerd
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/pidof
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/supolicy
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/root3
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/supolicy
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/debuggerd
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/su
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/wsroot.sh
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/pidof
/data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708

Sets the 'executable' attribute to the following files:

/data/data/####/app_3561d20c-188c-47ec-9513-53b2ae9ff8cf/Matrix
/data/data/####/app_ba868dd4-9120-4839-9991-d2cbe1f4c4f0/Matrix
/data/data/####/app_c1d1c467-5aa1-478a-aabc-afd8fbff97f8/Matrix
/data/data/####/app_18f464aa-0228-4b31-927e-96b7aff21d2b/Matrix
/data/data/####/app_3ae1ed1d-648c-4907-a53b-457e6e6e880c/Matrix
/data/data/####/app_acea50a1-91d1-4d94-912d-8a398ea76bc3/Matrix

Miscellaneous:

Executes next shell scripts:

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial