Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.683.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(TLS/1.0) pe.winin####.top:443
- TCP(TLS/1.0) cdn.app.pin####.top:443
DNS requests:
- cdn.app.pin####.top
- cdn.game####.org
- pe.winin####.top
HTTP GET requests:
- cdn.game####.org/strategy/UnknownDev
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/larger4.3
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- cdn.game####.org/strategy/symlink-adbd
Modified file system:
Creates the following files:
- /data/data/####/0d0751f2-baa7-4069-9fc1-3b07144a6b1f
- /data/data/####/10b2efab-67da-41a9-8cea-a904aa6507d8
- /data/data/####/1470286953684.jar
- /data/data/####/1470286953684.tmp
- /data/data/####/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/2a1ebc43-3020-4412-97cd-a3b478294d26
- /data/data/####/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/46e479d8-75f5-4834-8823-666deb01f039
- /data/data/####/84863946-85d6-4b38-a67a-86874e0bbd52
- /data/data/####/8b6f263391259b7a8e5f58ee71852ca8
- /data/data/####/9ca02ea9-4ef9-4fae-a617-fc739d2b40e4
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/Matrix
- /data/data/####/SUBOXLOG_
- /data/data/####/V2.8.9.txt
- /data/data/####/b0141e478b25af7c40a8cca8de6c4708
- /data/data/####/b18a021d11a3004d25017230b681476b
- /data/data/####/c61913b615fb6224701377a119081f36
- /data/data/####/cd50f165-c89a-4ea4-8050-486c5da375ee
- /data/data/####/com.jiangpeng.android.photoslideshowgdjuie_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/ddexe
- /data/data/####/debuggerd
- /data/data/####/device.db
- /data/data/####/e6fa519f-ce72-4273-94a2-fa72b10d0aa2
- /data/data/####/ee6e7f6a-0167-4984-88c4-75a6c0d6aba4
- /data/data/####/fe4b44ba-8843-4e29-be39-f3f137bac1ae.jar
- /data/data/####/fileWork
- /data/data/####/fl.jar
- /data/data/####/index
- /data/data/####/install-recovery.sh
- /data/data/####/jv.jar
- /data/data/####/kr.xml
- /data/data/####/pidof
- /data/data/####/root3
- /data/data/####/su
- /data/data/####/supolicy
- /data/data/####/t_u.db-journal
- /data/data/####/toolbox
- /data/data/####/vbz.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/wsroot.sh
- /data/media/####/.thumbdata3--1967290299
- /data/media/####/1529502106828.jpg
- /data/media/####/1529502107071.jpg
- /data/media/####/1529502159020.jpg
- /data/media/####/1529502159248.jpg
Miscellaneous:
Executes next shell scripts:
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.