Android.Packed.25607

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.589.origin

Downloads the following detected threats from the Web:

Android.DownLoader.589.origin

Network activity:

Connecting to:

1####.####.67
5####.####.56
c####.####.cn
c####.####.org
c####.####.top
d####.####.com
g####.####.top
m####.####.com

HTTP GET requests:

5####.####.56/checker
c####.####.cn/sfile/201705/31/all/cp_V2.8.3.txt
c####.####.org/strategy/dev_root
c####.####.top/upload/201706/5/app/20170605115942974.apk
m####.####.com/sdk-core-v40.js

HTTP POST requests:

1####.####.67/strategy/interface.html
d####.####.com/aap.do
g####.####.top/hadat/oi/dlpe

Modified file system:

Creates the following files:

<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/Matrix
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/ddexe
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/debuggerd
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/fileWork
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/install-recovery.sh
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/pidof
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/su
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/supolicy
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/toolbox
<Package Folder>/app_26b7e5d1-c262-4ca0-8f1f-e0acab7cb515/wsroot.sh
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/Matrix
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/ddexe
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/debuggerd
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/fileWork
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/install-recovery.sh
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/pidof
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/su
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/supolicy
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/toolbox
<Package Folder>/app_286f21ee-1f97-40f9-aef2-2ce45eafeff3/wsroot.sh
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/Matrix
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/ddexe
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/debuggerd
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/fileWork
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/install-recovery.sh
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/pidof
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/su
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/supolicy
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/toolbox
<Package Folder>/app_3652ec56-1000-4a36-b4f0-0a654482275b/wsroot.sh
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/Matrix
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/ddexe
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/debuggerd
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/device.db
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/fileWork
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/install-recovery.sh
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/pidof
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/root3
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/su
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/supolicy
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/toolbox
<Package Folder>/app_50783e38-c9fa-427d-b604-7b8378ece1c8/wsroot.sh
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/Matrix
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/ddexe
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/debuggerd
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/fileWork
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/install-recovery.sh
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/pidof
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/su
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/supolicy
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/toolbox
<Package Folder>/app_8a36ee15-7cf7-49f2-914a-03eb16d5a229/wsroot.sh
<Package Folder>/app_c7327435-73a8-48f9-a481-18215b36c05d/checker.jar
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/Matrix
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/ddexe
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/debuggerd
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/fileWork
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/install-recovery.sh
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/pidof
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/su
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/supolicy
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/toolbox
<Package Folder>/app_e7e3b4d9-a048-411f-8b9c-68614076c7d9/wsroot.sh
<Package Folder>/app_plugin_download/bc9cf823-fde8-4995-b4c9-f8ca117c2cfe
<Package Folder>/app_plugin_download/c5dbef43-14ed-43e7-8c18-57151afa7280
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
<Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
<Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
<Package Folder>/app_subox/c61913b615fb6224701377a119081f36
<Package Folder>/app_subox_download/15517d41-766e-473e-ac8b-b5c402bc290c
<Package Folder>/app_subox_download/17037f9f-37b2-4887-85e5-fa54d16bef5b
<Package Folder>/app_subox_download/870b6447-3066-47b4-8ad9-dd2f02a5b440
<Package Folder>/app_subox_download/a41dc98e-5072-49bd-a32d-0012e9d079cb
<Package Folder>/app_subox_download/b479603b-a724-4a44-b262-12399d1b54c1
<Package Folder>/app_subox_download/b99febca-94dd-4ca6-82ef-08161fac37ad
<Package Folder>/app_subox_download/ceda320d-b8be-4079-acbe-96e86b9e2985
<Package Folder>/app_subox_download/e1a1ee43-6e6a-49de-9954-8319713cfd17
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/index
<Package Folder>/databases/####/http_media.admob.com_0.localstorage-journal
<Package Folder>/databases/####/http_media.admob.com_0.localstorage-journal (deleted)
<Package Folder>/databases/google_analytics_v2.db-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/.flurryagent.5911bf6d
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/cg.jar
<Package Folder>/files/gaClientId
<Package Folder>/files/lw.jar
<Package Folder>/shared_prefs/cbPrefs.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/kr.xml.bak
<Package Folder>/shared_prefs/qsb.xml
<Package Folder>/shared_prefs/sfe.xml
<Package Folder>/shared_prefs/sfe.xml.bak
<Package Folder>/shared_prefs/subox.xml
<Package Folder>/shared_prefs/wv.xml
<Package Folder>/shared_prefs/wv.xml.bak
<SD-Card>/.probe
<SD-Card>/Android/####/620af6b667da3
<SD-Card>/Android/####/78d10be7831efbcd1e62a93023a126bc.apk
<SD-Card>/Android/####/7e265867124e773e7ee5144c9e05b36f20fe43bc.png
<SD-Card>/Android/####/88c49754ba39a3d631057556370b8307a1d93866.png
<SD-Card>/Android/####/V2.8.3.txt
<SD-Card>/Android/####/b.tmp
<SD-Card>/Android/####/d8777704ca39818104e18d3612c297fabc079503.png

Miscellaneous:

Executes next shell scripts:

<dexopt>
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/78d10be7831efbcd1e62a93023a126bc.apk
chmod 777 /storage/emulated/0/Android/data/com.skagowgzoiewtou.ezdh.sagipewqthbo/files/Download/Android/azb/78d10be7831efbcd1e62a93023a126bc.apk
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
sh

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial