Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- c####.####.org
- q####.####.cn
- 1####.####.67
- h####.####.cn
HTTP GET requests:
- c####.####.org/strategy/dev_root2
- c####.####.org/strategy/loss_4.3
- c####.####.org/strategy/sul18
HTTP POST requests:
- 1####.####.67/log/interface.html
- h####.####.cn/ct/ezp/lfyq
- 1####.####.67/strategy/interface.html
- q####.####.cn/ct/fk/wbeul/hb
- q####.####.cn/ct/nypvy/izl
Modified file system:
Creates the following files:
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/files/SUBOXLOG_
- /data/data/####/app_subox_download/b8985a0d-208e-467c-9022-bfba98ea10b9
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/wsroot.sh
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/ddexe
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/shared_prefs/kr.xml.bak
- /data/data/####/app_subox_download/754ec7b1-0cad-425f-9dcc-5fd646c7a214
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/Matrix
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/pidof
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/fileWork
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_f001fbde-15dd-4a08-a891-009256e484ca/eh.jar
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/install-recovery.sh
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/kn.jar
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/su
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/debuggerd
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/cache/ads-107741789.jar
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/supolicy
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/toolbox
- /data/data/####/cache/ApplicationCache.db-journal
- /data/data/####/cache/webviewCacheChromium/index
Sets the 'executable' attribute to the following files:
- /data/data/####/app_d766e439-cec9-4a81-a1a7-d1c5e7050a42/Matrix
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.
