Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.543.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- cha####.####.com
- p####.####.top
- h####.####.com
- c####.####.org
- c####.####.cn
- v####.####.com
- 5####.####.56
- statson####.####.com
- a####.####.com
- 1####.####.67
HTTP GET requests:
- c####.####.org/strategy/base
- c####.####.org/strategy/sul18
- c####.####.org/strategy/UnknownDev
- c####.####.cn/sfile/201705/17/all/cp_V2.7.8.txt
- c####.####.cn/upload/201705/18/img/20170518160129023.png
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/loss_4.3
- 5####.####.56/checker
- c####.####.org/strategy/dev_root2
- c####.####.cn/upload/201705/18/app/20170518160130745.apk
- 5####.####.56/core
- c####.####.org/strategy/larger4.3
- c####.####.org/strategy/dev_root
HTTP POST requests:
- p####.####.top/sdf/lgc
- statson####.####.com/pushlog
- p####.####.top/hadat/erq/qq
- 1####.####.67/log/interface.html
- p####.####.top/jzbdt/mank/gscjz/ihwud
- h####.####.com/app.gif
- p####.####.top/jzbdt/rhpuj/fnswu
- p####.####.top/jzbdt/zkw/x
- p####.####.top/hadat/k/hlarj
- a####.####.com/app_logs
- cha####.####.com/rest/2.0/channel/channel
- 1####.####.67/strategy/interface.html
- cha####.####.com/rest/2.0/channel/3510737639148564843
- v####.####.com/device/add
Modified file system:
Creates the following files:
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/device.db
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/debuggerd
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/toolbox
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/supolicy
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/supolicy
- <Package Folder>/shared_prefs/app_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/root3
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/pidof
- <Package Folder>/app_plugin_download/cdd91e81-19f9-47ba-b08c-3e8a9b9a3fdc
- <Package Folder>/databases/cartoon-journal
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/supolicy
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/shared_prefs/user_info.xml
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/pidof
- <Package Folder>/app_subox_download/6763be07-7212-4da6-a762-ecc8e51d41dd
- <Package Folder>/files/.imprint
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/fileWork
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/wsroot.sh
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/install-recovery.sh
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/Matrix
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/fileWork
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/wsroot.sh
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/supolicy
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/toolbox
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/app_subox_download/b8ad0a74-cf45-44b5-b8ae-2b122daa1cd2
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/su
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/toolbox
- <Package Folder>/app_ec2f731a-f315-46e5-ae1c-1680ff93ce25/checker.jar
- <Package Folder>/app_push_lib/plugin-deploy.jar
- <Package Folder>/app_subox_download/510c3c7d-ab11-4e99-bec4-9a59d58e8ed3
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/app_plugin_download/ec772e69-5b07-4f64-8fbc-3c8629b1f591
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/debuggerd
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/wsroot.sh
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/fileWork
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/pidof
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/toolbox
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/ddexe
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/install-recovery.sh
- <Package Folder>/app_subox_download/bb784fbf-4778-4e05-9e9e-e6a83ce8ed02
- <Package Folder>/files/wv.jar
- <Package Folder>/shared_prefs/app_config.xml.bak
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/toolbox
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/su
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/install-recovery.sh
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/Matrix
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/su
- <Package Folder>/app_subox_download/213109da-471c-4978-ba98-2bfb11098b00
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/su
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/Matrix
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/wsroot.sh
- <Package Folder>/app_subox_download/08ed72bc-0f99-49dd-a201-d21ee031c91e
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/install-recovery.sh
- <Package Folder>/app_anonymous_files/anonymous_core.so
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/wsroot.sh
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/install-recovery.sh
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/fileWork
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/Matrix
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/debuggerd
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/fileWork
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/debuggerd
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/install-recovery.sh
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/toolbox
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/su
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/pidof
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/ddexe
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/ddexe
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/supolicy
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/ddexe
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/su
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/wsroot.sh
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/pidof
- <Package Folder>/app_subox_download/1d248dd1-5127-41f6-81ae-9edb3a65fa96
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/fileWork
- <Package Folder>/app_59cd278b-c6ae-4ddb-ae15-e0ad718ebda3/Matrix
- <Package Folder>/shared_prefs/user_info.xml.bak
- <Package Folder>/files/im.jar
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/pidof
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/debuggerd
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/app_push_lib/plugin-deploy.key
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_f14e98ba-0c1e-482f-981f-26898c32ea15/Matrix
- <Package Folder>/app_subox_download/147f4912-6597-4990-8afe-7c402656b6a2
- <Package Folder>/app_ca1115e9-b75b-46a7-8a61-1780ca927013/ddexe
- <Package Folder>/app_135a3ede-454e-403f-84a7-31ae0e92e298/supolicy
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/app_6c6b4a3f-0396-44fe-abb2-ad6acb845ba3/debuggerd
- <Package Folder>/app_fc2b923a-825a-4229-9b7c-cea7dfac39f1/ddexe
Miscellaneous:
Executes next shell scripts:
- chmod 777 /storage/emulated/0/Android/data/####/files/Download/Android/azb/2ea145779e097f9712aeedc768b845b3.apk
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/2ea145779e097f9712aeedc768b845b3.apk
- sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- <dexopt>
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
