Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.543.origin
Downloads the following detected threats from the Web:
- Android.SmsSend.18556
Network activity:
Connecting to:
- c####.####.org
- p####.####.top
- 5####.####.56
- c####.####.cn
- 1####.####.67
HTTP GET requests:
- c####.####.org/strategy/base
- c####.####.org/strategy/sul18
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/dev_root
- c####.####.org/strategy/dev_root2
- c####.####.cn/upload/201705/10/app/20170510142328422.apk
- c####.####.cn/sfile/201705/17/all/cp_V2.7.8.txt
- c####.####.org/strategy/larger4.3
- 5####.####.56/checker
- c####.####.org/strategy/UnknownDev
- c####.####.cn/upload/201703/10/img/20170310154746318.png
- 5####.####.56/core
- c####.####.org/strategy/loss_4.3
HTTP POST requests:
- p####.####.top/hadat/wztzc/b
- p####.####.top/jzbdt/kn/m
- 1####.####.67/log/interface.html
- p####.####.top/hadat/nqktq/mw
- p####.####.top/jzbdt/n/oo/ead
- p####.####.top/sdf/ejz
- p####.####.top/jzbdt/s/tmrxt
- p####.####.top/hadat/bv/sxcb
- 1####.####.67/strategy/interface.html
Modified file system:
Creates the following files:
- <Package Folder>/app_subox_download/f01b4d4e-d9cf-4ac1-92f8-8540a82362e2
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/Matrix
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/su
- <Package Folder>/app_subox_download/7b22d516-9727-4bf7-9b1f-3d54a5c86a92
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/fileWork
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/files/uj.jar
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/Matrix
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/app_subox_download/60457453-c7dd-4f0a-92a1-02702f61dbb5
- <Package Folder>/app_plugin_download/d99f4047-3e59-4039-abdd-211dfc50e1c7
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/pidof
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/install-recovery.sh
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/ddexe
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/wsroot.sh
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/pidof
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/device.db
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox_download/7f68ce6b-fa26-4d8f-ae75-95f23151ef23
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/toolbox
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/toolbox
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/ddexe
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/pidof
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/supolicy
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/wsroot.sh
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/supolicy
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_subox_download/12901b4a-aebf-431e-851a-86d5f698678c
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/debuggerd
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/pidof
- <Package Folder>/files/nr.jar
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/root3
- <Package Folder>/app_subox_download/7cf81193-a877-454e-8f61-6eac1b691871
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/su
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/Matrix
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/wsroot.sh
- <Package Folder>/app_9093d07c-c782-4ec3-87d4-da71a2c473a6/checker.jar
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/fileWork
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/supolicy
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/Matrix
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/su
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/wsroot.sh
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/su
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/install-recovery.sh
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/wsroot.sh
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/debuggerd
- <Package Folder>/app_anonymous_files/anonymous_core.so
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/fileWork
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/ddexe
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/toolbox
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/install-recovery.sh
- <Package Folder>/shared_prefs/achievement_data.xml
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/ddexe
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/fileWork
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/wsroot.sh
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/debuggerd
- <Package Folder>/app_plugin_download/e3038cd7-821f-40bc-bdf4-6cca9c078bcf
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/pidof
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/su
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/debuggerd
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/supolicy
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/ddexe
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/toolbox
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/pidof
- <Package Folder>/app_262759ff-6b29-491a-8d0d-2806867a9f2b/install-recovery.sh
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/fileWork
- <Package Folder>/app_subox_download/53e46f8e-1f23-4d77-b6e0-eef0193724d1
- <Package Folder>/app_8529974c-ce57-42b9-8dc4-bc9efd85f860/install-recovery.sh
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/toolbox
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/debuggerd
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/Matrix
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/supolicy
- <Package Folder>/app_eaf42a28-b609-43b0-add1-2d6ed2fcc339/fileWork
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/debuggerd
- <Package Folder>/app_d0e737b7-bc4a-41cd-80d6-b0cf7f091946/su
- <Package Folder>/app_subox_download/1bb763cc-9fec-4514-b132-316ee73ee339
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/install-recovery.sh
- <Package Folder>/shared_prefs/achievement_data.xml.bak
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/supolicy
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/Matrix
- <Package Folder>/app_a5a7f0f4-240a-4050-a72e-81de1e5eae06/toolbox
- <Package Folder>/app_5de6c4e1-94f4-4c52-8985-e7c46de508c9/ddexe
Miscellaneous:
Executes next shell scripts:
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- sh
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/7211aeb0472807fbb07af100f3a58f8b.apk
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- <dexopt>
- chmod 777 /storage/emulated/0/Android/data/####/files/Download/Android/azb/7211aeb0472807fbb07af100f3a58f8b.apk
Contains functionality to send SMS messages automatically.
