Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- o####.####.cn
- 1####.####.67
- c####.####.org
HTTP GET requests:
- c####.####.org/strategy/loss_4.3
- c####.####.org/strategy/sul18
HTTP POST requests:
- o####.####.cn/ct/ic/ga/ydil
- o####.####.cn/ct/nhap/lef
- o####.####.cn/ct/non/yfzuu
- o####.####.cn/ct/ejru/fc/o
- 1####.####.67/log/interface.html
- o####.####.cn/ct/kauo/kp
- o####.####.cn/ct/gaqtz/vot
- o####.####.cn/ct/ev/ga
- o####.####.cn/ct/w/peath
- o####.####.cn/ct/om/yd
- o####.####.cn/ct/s/i
- o####.####.cn/ct/uzhrp/o/ydjp
- o####.####.cn/ct/kpbhw/s
- 1####.####.67/strategy/interface.html
- o####.####.cn/ct/lpxiz/vd
Modified file system:
Creates the following files:
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/databases/cy_cn_client
- /data/data/####/files/fi.jar
- /data/data/####/files/SUBOXLOG_
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/wsroot.sh
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/fileWork
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/toolbox
- /data/data/####/databases/cy_cn_client-journal
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/shared_prefs/kr.xml.bak
- /sdcard/huadict/data/ChengyuZhsStandard/cy_cn
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/install-recovery.sh
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/debuggerd
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/files/cr.jar
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/su
- /data/data/####/app_c4e9f14f-58b5-44e2-a364-b49349cd7e6f/eh.jar
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/supolicy
- /data/data/####/app_subox_download/a3e98ff2-6b47-4bdb-9f53-abffd60daf9e
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/app_subox_download/86e34016-ac62-4993-959e-9301ec4b3d38
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/ri.jar
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/Matrix
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/pidof
- /sdcard/huadict/data/ChengyuZhsStandard/cy_cn-journal
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/ddexe
Sets the 'executable' attribute to the following files:
- /data/data/####/app_1eddd70b-b4b5-4c1d-93e7-8ef519effa28/Matrix
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.
