Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- c####.####.org
- q####.####.cn
- 1####.####.67
- a####.####.com
- w####.####.cn
HTTP GET requests:
- c####.####.org/strategy/dev_root2
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/loss_4.3
- c####.####.org/strategy/sul18
- c####.####.org/strategy/larger4.3
HTTP POST requests:
- q####.####.cn/ct/fq/y
- w####.####.cn/ct/nsar/qm/mdkew
- 1####.####.67/log/interface.html
- q####.####.cn/ct/dw/fnzd
- a####.####.com/app_logs
- 1####.####.67/strategy/interface.html
Modified file system:
Creates the following files:
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/ddexe
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/pidof
- /data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/install-recovery.sh
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/supolicy
- /data/data/####/files/SUBOXLOG_
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/device.db
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/debuggerd
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/wsroot.sh
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/fileWork
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/ddexe
- /data/data/####/app_subox_download/34f4c116-12b2-4273-ba9e-e6b949bf96c6
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/pidof
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/toolbox
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/fileWork
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/supolicy
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/su
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/ddexe
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/Matrix
- /data/data/####/files/wa.jar
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/pidof
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/install-recovery.sh
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/supolicy
- /data/data/####/shared_prefs/kr.xml.bak
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/toolbox
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/su
- /data/data/####/databases/lock-journal
- /data/data/####/files/.imprint
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/supolicy
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/toolbox
- /data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/fileWork
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/su
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/Matrix
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/fileWork
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/root3
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/su
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/pidof
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/wsroot.sh
- /data/data/####/app_subox_download/d1d8058c-ff23-417f-9d0f-5cf5353ec363
- /data/data/####/app_subox_download/9ba25fcf-a4c2-47d8-869f-1d0a9bf08c1f
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/install-recovery.sh
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/toolbox
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/debuggerd
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/ddexe
- /data/data/####/app_subox_download/e6a84146-27b5-4912-a5e3-6cc780ea428e
- /data/data/####/files/umeng_it.cache
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/debuggerd
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/Matrix
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/install-recovery.sh
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/wsroot.sh
- /data/data/####/app_subox_download/b62d8484-b53c-4860-8a0d-33184150ffb0
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/Matrix
- /data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/debuggerd
- /data/data/####/app_abcfc847-b29f-4736-ae3e-6409d3beae2e/eh.jar
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/wsroot.sh
Sets the 'executable' attribute to the following files:
- /data/data/####/app_d58b0091-a807-4513-8d37-f94d8c693bd6/Matrix
- /data/data/####/app_bbf1900d-0454-431a-aa0b-496b65e709c5/Matrix
- /data/data/####/app_c6fb4c90-5507-4f7a-b348-27ae0153eb16/Matrix
- /data/data/####/app_a42b34ba-c7ff-4f6a-918b-cea08582c300/Matrix
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.
