Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.589.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.589.origin
Network activity:
Connecting to:
- 1####.####.67
- 5####.####.56
- c####.####.cn
- c####.####.org
- c####.####.top
- g####.####.top
HTTP GET requests:
- 5####.####.56/core
- c####.####.cn/sfile/201705/31/all/cp_V2.8.1.txt
- c####.####.org/strategy/UnknownDev
- c####.####.top/upload/201706/5/app/20170605115942974.apk
HTTP POST requests:
- 1####.####.67/strategy/interface.html
- g####.####.top/jzbdt/ibd/rf/howac
Modified file system:
Creates the following files:
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/Matrix
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/ddexe
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/debuggerd
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/fileWork
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/install-recovery.sh
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/pidof
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/su
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/supolicy
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/toolbox
- <Package Folder>/app_3e99057b-969f-48d5-8c95-08b906151433/wsroot.sh
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/Matrix
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/ddexe
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/debuggerd
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/fileWork
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/install-recovery.sh
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/pidof
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/su
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/supolicy
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/toolbox
- <Package Folder>/app_61370a83-7b38-49c1-a79f-ccf11b081162/wsroot.sh
- <Package Folder>/app_661e7c58-12bc-4d09-955c-5d32f08ebd7e/checker.jar
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/Matrix
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/ddexe
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/debuggerd
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/fileWork
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/install-recovery.sh
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/pidof
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/su
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/supolicy
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/toolbox
- <Package Folder>/app_759e19b7-6130-40af-8a51-d3a9e4588edb/wsroot.sh
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/Matrix
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/ddexe
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/debuggerd
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/device.db
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/fileWork
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/install-recovery.sh
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/pidof
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/root3
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/su
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/supolicy
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/toolbox
- <Package Folder>/app_9370a534-a8de-434b-8332-10fd84f15d3a/wsroot.sh
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/Matrix
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/ddexe
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/debuggerd
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/fileWork
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/install-recovery.sh
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/pidof
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/su
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/supolicy
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/toolbox
- <Package Folder>/app_bcef6bc6-f94f-438f-bfb8-699c0166b71b/wsroot.sh
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/Matrix
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/ddexe
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/debuggerd
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/fileWork
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/install-recovery.sh
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/pidof
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/su
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/supolicy
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/toolbox
- <Package Folder>/app_fc49d024-8d62-443e-b804-0b120e4b46ff/wsroot.sh
- <Package Folder>/app_plugin_download/80744ede-e477-46d4-8d54-e04c7dcf8581
- <Package Folder>/app_plugin_download/8cf8bc3c-56ef-4b59-8280-ea4c8cd313e5
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_subox_download/1e04a55c-8b7e-4f6b-8cab-a3817ac7490c
- <Package Folder>/app_subox_download/3b9abd02-62df-4dfe-b674-ddc6fdb3ef69
- <Package Folder>/app_subox_download/656f832a-f828-4129-8c11-3bc3e4d361f9
- <Package Folder>/app_subox_download/9ecee560-c6d5-4a4a-93fc-b838554336c0
- <Package Folder>/app_subox_download/a99be361-93c3-4ef5-91bf-6a29c79a64c5
- <Package Folder>/app_subox_download/b8bc2e25-26fd-404d-9f72-b043c315b583
- <Package Folder>/app_subox_download/e0452661-7f6b-4c86-bdb2-bfe4d5624946
- <Package Folder>/app_subox_download/f1739dbd-35ef-4c74-af0a-dce78c2e56ba
- <Package Folder>/databases/ba_tr.db
- <Package Folder>/databases/ba_tr.db-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/gaClientId
- <Package Folder>/files/im.jar
- <Package Folder>/files/sw.jar
- <Package Folder>/shared_prefs/<Package>.appirater.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/bastion_kv.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/shared_prefs/wv.xml.bak
- <SD-Card>/Android/####/620af6b667da3
- <SD-Card>/Android/####/78d10be7831efbcd1e62a93023a126bc.apk
- <SD-Card>/Android/####/V2.8.1.txt
- <SD-Card>/Android/####/b.tmp
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/78d10be7831efbcd1e62a93023a126bc.apk
- chmod 777 /storage/emulated/0/Android/data/com.fengkuanggifbianjiq.hfdg/files/Download/Android/azb/78d10be7831efbcd1e62a93023a126bc.apk
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh