Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.683.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) cdn.app.xingh####.cn:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) jy####.ca####.com:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(TLS/1.0) cdn.app.superma####.top:443
- TCP(TLS/1.0) c####.superma####.top:443
DNS requests:
- c####.superma####.top
- cdn.app.superma####.top
- cdn.app.xingh####.cn
- cdn.game####.org
- jy####.ca####.com
HTTP GET requests:
- cdn.app.xingh####.cn/lupload/clo/he
- cdn.game####.org/strategy/11a3004d25017230
- cdn.game####.org/strategy/15fb6224701377a1
- cdn.game####.org/strategy/1ae9b32c6e832e41
- cdn.game####.org/strategy/240b5f1e461d069c
- cdn.game####.org/strategy/351aa6386a77d89f
- cdn.game####.org/strategy/91259b7a8e5f58ee
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/fc10be62df60ba0f
- jy####.ca####.com/gallery_free_ver
Modified file system:
Creates the following files:
- /data/data/####/102ad32edbbe15be6a852c9639e232a7
- /data/data/####/16247433229d8cccb424536e6d9bc6a4
- /data/data/####/2545a815-3729-405e-bf35-4694c83ab361
- /data/data/####/2b2b87dc-a64c-4142-97f6-1356d2b0a030
- /data/data/####/43227513780f9a53a644ee736fe98f62
- /data/data/####/4aa6334b-a185-40a0-81c3-f872414f2f41
- /data/data/####/4b61594a-185e-4c15-bbb7-74eff1c5e822
- /data/data/####/5553a0bd15ea1d729be5500dd0b434bd
- /data/data/####/82f963c3-ca5e-4d0a-a971-03eef98db783
- /data/data/####/90e31215-d9c6-49b3-847d-f7d59988fd1a.jar
- /data/data/####/9ff0b1fb-2a9a-4905-937b-90cae1b55487
- /data/data/####/Matrix
- /data/data/####/SUBOXLOG_
- /data/data/####/V2.9.4.txt
- /data/data/####/a2ad352e-63ce-4b38-92ae-509da2a1f6a9
- /data/data/####/c555f65c72344cea54472e5d056e24b3
- /data/data/####/ca.jar
- /data/data/####/ca20c539-23e9-447b-8a20-b4619b68e153
- /data/data/####/cde2b2f7-6c0c-4744-b779-1050d4490784
- /data/data/####/com.sp.smartgallery.freejblmlhktuhvtffjiyp_preferences.xml
- /data/data/####/ddexe
- /data/data/####/debuggerd
- /data/data/####/device.db
- /data/data/####/e01a6afb33753a506c45f8938a4c6fa6
- /data/data/####/fileWork
- /data/data/####/galleryx.db
- /data/data/####/galleryx.db-journal
- /data/data/####/install-recovery.sh
- /data/data/####/jh.jar
- /data/data/####/kr.xml
- /data/data/####/pidof
- /data/data/####/root3
- /data/data/####/su
- /data/data/####/supolicy
- /data/data/####/t_u.db-journal
- /data/data/####/toolbox
- /data/data/####/vbz.xml
- /data/data/####/wsroot.sh
- /data/media/####/-116483357037
- /data/media/####/-130076019421
- /data/media/####/-136650765432
- /data/media/####/-13687836031
- /data/media/####/-140512886823
- /data/media/####/-176160715633
- /data/media/####/-212172106935
- /data/media/####/.nomedia
- /data/media/####/.thumbdata3--1967290299
- /data/media/####/103370971222
- /data/media/####/103888428720
- /data/media/####/114452988625
- /data/media/####/143740825626
- /data/media/####/1530881167579.jpg
- /data/media/####/1530881167683.jpg
- /data/media/####/1530881167814.jpg
- /data/media/####/1530881167923.jpg
- /data/media/####/1530881168048.jpg
- /data/media/####/1530881168228.jpg
- /data/media/####/1530881171008.jpg
- /data/media/####/1530881171574.jpg
- /data/media/####/1530881171645.jpg
- /data/media/####/1530881171756.jpg
- /data/media/####/1530881171845.jpg
- /data/media/####/1530881171970.jpg
- /data/media/####/1530881172018.jpg
- /data/media/####/1530881172055.jpg
- /data/media/####/1530881172198.jpg
- /data/media/####/1530881172282.jpg
- /data/media/####/1530881172609.jpg
- /data/media/####/1530881173697.jpg
- /data/media/####/1530881174025.jpg
- /data/media/####/1530881174115.jpg
- /data/media/####/1530881174235.jpg
- /data/media/####/1530881174326.jpg
- /data/media/####/1530881174486.jpg
- /data/media/####/1530881175328.jpg
- /data/media/####/173428701624
- /data/media/####/177585267528
- /data/media/####/185842661039
- /data/media/####/186424157336
- /data/media/####/211342022230
- /data/media/####/36596526427
- /data/media/####/49899444829
- /data/media/####/55095905738
- /data/media/####/92784371119
- /data/media/####/95437910734
- /data/media/####/do_not_remove_this_folder
Miscellaneous:
Executes next shell scripts:
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Loads the following dynamic libraries:
- sgdata
Uses the following algorithms to decrypt data:
- DES
- DESede
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.
