Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- c####.####.org
- d####.####.cn
- ip####.com
- 1####.####.67
HTTP GET requests:
- c####.####.org/strategy/dev_root2
- ip####.com/xml/
- c####.####.org/strategy/loss_4.3
- c####.####.org/strategy/sul18
HTTP POST requests:
- 1####.####.67/log/interface.html
- d####.####.cn/ct/witq/gswht
- d####.####.cn/ct/hda/pjme
- 1####.####.67/strategy/interface.html
- d####.####.cn/ct/vy/ezry/fnmil
Modified file system:
Creates the following files:
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/files/SUBOXLOG_
- /data/data/####/app_subox_download/3fcb1266-8624-442e-a961-d20448a04b9d
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/Matrix
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/debuggerd
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/Temp/.record.wav
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/toolbox
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/supolicy
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/su
- /data/data/####/shared_prefs/FBAdPrefs.xml
- /data/data/####/app_subox_download/d6d4d167-6432-49e8-83ab-aa1f99b529e7
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/fileWork
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/ddexe
- /data/data/####/databases/t_u.db-journal
- /data/data/####/shared_prefs/SDKIDFA.xml
- /data/data/####/cache/1460683162801.jar
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/####.xml
- /data/data/####/cache/1460683162801.tmp
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/wsroot.sh
- /data/data/####/app_4405d456-9e54-43a3-ba8f-97a3aa3a0b1f/eh.jar
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/install-recovery.sh
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/pidof
- /data/data/####/cache/ApplicationCache.db-journal
- /data/data/####/files/jl.jar
- /data/data/####/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- /data/data/####/shared_prefs/kr.xml.bak
Sets the 'executable' attribute to the following files:
- /data/data/####/app_045c6920-b3de-481c-8476-e7d119f2d6b5/Matrix
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.
