Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- c####.####.org
- i####.####.cn
- 1####.####.67
- c####.####.cn
HTTP GET requests:
- c####.####.org/strategy/sul18
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/dev_root2
- c####.####.cn/upload/201703/10/app/20170310114012863.apk
- c####.####.org/strategy/larger4.3
- c####.####.org/strategy/loss_4.3
- c####.####.cn/upload/201703/10/img/20170310113957576.png
HTTP POST requests:
- i####.####.cn/shuju/n/wjtt
- 1####.####.67/log/interface.html
- i####.####.cn/code/all
- i####.####.cn/ct/zfswf/fgp
- i####.####.cn/ct/ak/txwzr/harj
- i####.####.cn/shuju/wh/fxvne
- 1####.####.67/strategy/interface.html
- i####.####.cn/ct/sxgm/mrdrb
Modified file system:
Creates the following files:
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/pidof
- /data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/debuggerd
- /data/data/####/files/jo.jar
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/wsroot.sh
- /data/data/####/app_subox_download/ece92717-248c-48c0-8771-e5dd7c5ccabe
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/Matrix
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/fileWork
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/pidof
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/wsroot.sh
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/root3
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/debuggerd
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/wsroot.sh
- /data/data/####/app_subox_download/e649a323-cc34-4789-8af2-3e91b0409be4
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/debuggerd
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/fileWork
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/su
- /data/data/####/shared_prefs/kr.xml
- /sdcard/Android/tp/a.tmp
- /data/data/####/shared_prefs/kr.xml.bak
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/install-recovery.sh
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/install-recovery.sh
- /sdcard/Android/tp/6c3717d164db0.tmp
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/Matrix
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/wsroot.sh
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/install-recovery.sh
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/toolbox
- /data/data/####/files/SUBOXLOG_
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/pidof
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/su
- /data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/toolbox
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/ddexe
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/supolicy
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/Matrix
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/su
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/fileWork
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/install-recovery.sh
- /sdcard/Android/tp/6c3717d164db0
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/pidof
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/supolicy
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/ddexe
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/ddexe
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/su
- /data/data/####/app_subox_download/9dd979bf-9490-41ed-9cee-147075f479e5
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/ddexe
- /sdcard/Android/azb/b.tmp
- /data/data/####/app_subox_download/a3dd8fff-ddde-4785-85bf-46f1c6fba0ab
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/toolbox
- /data/data/####/app_67214fbc-18b4-481f-96d6-71ce31b18e37/eh.jar
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/device.db
- /data/data/####/shared_prefs/wv.xml
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/toolbox
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/supolicy
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/fileWork
- /data/data/####/app_subox_download/6219d759-003d-4222-bf58-c5a249519a66
- /data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/Matrix
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/debuggerd
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/supolicy
Sets the 'executable' attribute to the following files:
- /data/data/####/app_6375b889-f263-47b4-afcb-58a2438f6521/Matrix
- /data/data/####/app_35957b1a-8a82-4c4b-8454-2f4a7b3494e1/Matrix
- /data/data/####/app_6000d925-e3d2-4bb5-99e3-0258d1b5fbec/Matrix
- /data/data/####/app_d0cc5e87-5079-4ef7-926e-5a52ee26c7e6/Matrix
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.
