Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.543.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.543.origin
Network activity:
Connecting to:
- 1####.####.67
- 5####.####.56
- c####.####.cn
- c####.####.org
- p####.####.top
HTTP GET requests:
- 5####.####.56/core
- c####.####.cn/sfile/201706/22/all/cp_V2.7.8.txt
- c####.####.org/strategy/sul18
HTTP POST requests:
- 1####.####.67/strategy/interface.html
- p####.####.top/sdf/ze
Modified file system:
Creates the following files:
- <Package Folder>/app_09b794e1-a274-4e30-b99b-5dbfa8388873/checker.jar
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/Matrix
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/ddexe
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/debuggerd
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/fileWork
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/install-recovery.sh
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/pidof
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/su
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/supolicy
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/toolbox
- <Package Folder>/app_bc6b79ee-a0e0-4c67-85cc-14ea287a0370/wsroot.sh
- <Package Folder>/app_plugin_download/ca637503-3ff6-4706-9419-e496bf7d9eb9
- <Package Folder>/app_plugin_download/f73edf96-07df-4968-84ed-4d1f43d6ff67
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox_download/18956891-9ee5-403d-80e3-28d6415c52a1
- <Package Folder>/app_subox_download/66d32e04-ed63-40f1-bada-ddd180831277
- <Package Folder>/app_subox_download/8a071a69-8507-4cca-9731-3191a83528be
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1460683162801.dex
- <Package Folder>/cache/1460683162801.jar
- <Package Folder>/cache/1460683162801.tmp
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/jc.jar
- <Package Folder>/files/jo.jar
- <Package Folder>/files/wb.jar
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/shared_prefs/wv.xml.bak
- <SD-Card>/Android/####/V2.7.8.txt
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
