Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.543.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- p####.####.top
- 1####.####.67
- c####.####.org
- 5####.####.56
- c####.####.cn
- a####.####.com
HTTP GET requests:
- c####.####.cn/upload/201705/12/img/20170512181047179.png
- c####.####.org/strategy/base
- c####.####.org/strategy/sul18
- c####.####.org/strategy/UnknownDev
- c####.####.cn/sfile/201705/17/all/cp_V2.7.8.txt
- c####.####.cn/upload/201705/18/img/20170518160129023.png
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/loss_4.3
- 5####.####.56/checker
- c####.####.cn/upload/201704/19/app/20170419164327750.apk
- c####.####.cn/upload/201705/12/app/20170512181057113.apk
- c####.####.org/strategy/dev_root2
- c####.####.cn/upload/201705/18/app/20170518160130745.apk
- c####.####.cn/upload/201607/12/img/20160712113200038.png
- 5####.####.56/core
- c####.####.org/strategy/dev_root
- c####.####.org/strategy/larger4.3
HTTP POST requests:
- p####.####.top/hadat/dwtwf/bve
- p####.####.top/hadat/nt/rkbh
- p####.####.top/jzbdt/meyqd/o
- 1####.####.67/log/interface.html
- p####.####.top/hadat/k/dtnei
- p####.####.top/hadat/yckuy/bty
- 1####.####.67/strategy/interface.html
- p####.####.top/sdf/sxc
- p####.####.top/hadat/rkeh/ribx
- p####.####.top/hadat/lb/wv
- a####.####.com/ad-service/ad/mark
- p####.####.top/jzbdt/vgsax/gbsw
- p####.####.top/hadat/xq/ztjqa
- p####.####.top/jzbdt/jdtlj/fmgxm
- p####.####.top/jzbdt/px/gzto/kex
- p####.####.top/hadat/kjzq/ngft
- p####.####.top/hadat/joag/ch
- p####.####.top/hadat/hm/ywqx
- p####.####.top/jzbdt/r/fkp/s
Modified file system:
Creates the following files:
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/su
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/su
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/debuggerd
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/toolbox
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/toolbox
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/toolbox
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/wsroot.sh
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/debuggerd
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/debuggerd
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/pidof
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/install-recovery.sh
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/install-recovery.sh
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/toolbox
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/Matrix
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/fileWork
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/wsroot.sh
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/supolicy
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/app_subox_download/98f1ffe4-d8b1-41d5-ab7b-1401aad8230d
- <Package Folder>/app_plugin_download/6d1a7edf-3d0b-463b-93b1-3a62dc448ad0
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/toolbox
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/ddexe
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/fileWork
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/su
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/supolicy
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/fileWork
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/pidof
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/fileWork
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/supolicy
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/debuggerd
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/pidof
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/debuggerd
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/debuggerd
- <Package Folder>/app_subox_download/c932007e-6b4e-44f0-a9fd-3ad706cae50e
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/pidof
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_subox_download/3decd56c-ead8-44b0-a71c-86ddb047e935
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/root3
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/supolicy
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/install-recovery.sh
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/ddexe
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/app_plugin_download/c070c04a-9e1e-44c4-8463-665498481e85
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/pidof
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/wsroot.sh
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/ddexe
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/Matrix
- <Package Folder>/app_8bd19bdc-9e33-4f29-98b1-5cbce794ece8/checker.jar
- <Package Folder>/app_anonymous_files/anonymous_core.so
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/su
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/ddexe
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/ddexe
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/fileWork
- <Package Folder>/databases/recoder.db-journal
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/app_subox_download/ffa55d0b-6b1b-450d-bb8a-0077c798eddb
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/supolicy
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/wsroot.sh
- <Package Folder>/files/yd.jar
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/fileWork
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/supolicy
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/su
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/toolbox
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/wsroot.sh
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/device.db
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/su
- <Package Folder>/app_subox_download/753e6f3e-8ee1-4a46-ae05-9b39525fa97c
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/Matrix
- <Package Folder>/app_subox_download/539dc61d-47f2-435c-86d1-1f2c365c07b4
- <Package Folder>/app_baa7d570-0b7c-42b3-8878-2748441874e3/wsroot.sh
- <Package Folder>/app_a59a22d4-a8ff-4207-bb03-334f4b3bd215/Matrix
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/Matrix
- <Package Folder>/files/yf.jar
- <Package Folder>/app_cf990313-0e62-40d8-b9c1-c50909d6dbeb/ddexe
- <Package Folder>/app_subox_download/577d82d5-eb9e-4658-84d5-909cd9936f77
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/pidof
- <Package Folder>/app_f573024b-8ac3-4d15-ba24-68b3b7a0dee5/install-recovery.sh
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/install-recovery.sh
- <Package Folder>/app_d3ff2868-5889-4be3-929b-6b8933a83968/install-recovery.sh
- <Package Folder>/app_subox_download/dcf23f3e-7eb7-4dcd-a47e-e95418e363e9
- <Package Folder>/app_fc7f0a14-252e-4274-9b97-fbc60f4ca192/Matrix
Miscellaneous:
Executes next shell scripts:
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/d20b9c9d3d1e2f04037d0db0678470fe.apk
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/Android/data/####/files/Download/Android/azb/15ef7c9930076d3321eb5e2afd2acfc3.apk
- chmod 777 /storage/emulated/0/Android/data/####/files/Download/Android/azb/d20b9c9d3d1e2f04037d0db0678470fe.apk
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- getprop
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/sh -c getprop
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- sh
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/15ef7c9930076d3321eb5e2afd2acfc3.apk
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- <dexopt>
- /system/bin/sh -c type su
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
