Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- c####.####.org
- 5####.####.56
- p####.####.top
- 1####.####.67
- c####.####.cn
Запросы HTTP GET:
- c####.####.org/strategy/base
- c####.####.org/strategy/sul18
- c####.####.org/strategy/UnknownDev
- c####.####.cn/sfile/201705/17/all/cp_V2.7.8.txt
- c####.####.cn/upload/201705/18/img/20170518160129023.png
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/loss_4.3
- 5####.####.56/checker
- c####.####.org/strategy/dev_root2
- c####.####.cn/upload/201705/18/app/20170518160130745.apk
- 5####.####.56/core
- c####.####.org/strategy/larger4.3
- c####.####.org/strategy/dev_root
Запросы HTTP POST:
- p####.####.top/hadat/c/aukc
- 1####.####.67/log/interface.html
- p####.####.top/hadat/zsmhz/voiwv
- p####.####.top/sdf/ctme
- p####.####.top/jzbdt/hbu/qkaz/voiw
- p####.####.top/jzbdt/e/bvog
- p####.####.top/hadat/lfvg/qjdsj
- 1####.####.67/strategy/interface.html
- p####.####.top/jzbdt/l/jc
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/wsroot.sh
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/toolbox
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/debuggerd
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/Matrix
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/supolicy
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/wsroot.sh
- <Package Folder>/app_subox_download/2ffab7c3-ee26-4b77-99f1-52061716ec75
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/pidof
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/install-recovery.sh
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/toolbox
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/fileWork
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/wsroot.sh
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/su
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/toolbox
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/fileWork
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/supolicy
- <Package Folder>/files/ls.jar
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/install-recovery.sh
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/Matrix
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/fileWork
- <Package Folder>/app_plugin_download/b1df78e2-9543-4f76-bfc0-f7d4eea79d71
- <Package Folder>/app_subox_download/94e9b777-4bd1-48b3-bb28-b9e9dd753292
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/supolicy
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/fileWork
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/Matrix
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/ddexe
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/install-recovery.sh
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/wsroot.sh
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/toolbox
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/supolicy
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/su
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/toolbox
- <Package Folder>/files/FireVeg
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/wsroot.sh
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/install-recovery.sh
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/pidof
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/supolicy
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/debuggerd
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/toolbox
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/Matrix
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/pidof
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/pidof
- <Package Folder>/app_anonymous_files/anonymous_core.so
- <Package Folder>/app_plugin_download/2dd20342-51f5-4126-b8ef-29773c82b929
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/debuggerd
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/fileWork
- <Package Folder>/files/wo.jar
- <Package Folder>/app_subox_download/a83464db-48bc-4d8e-98d3-9ba82fd7e656
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/debuggerd
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/supolicy
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/su
- <Package Folder>/app_6a20500f-8dac-4051-ae66-e4b41ee84ebc/checker.jar
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/Matrix
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/su
- <Package Folder>/app_subox_download/0ba1a2a5-7324-4e4e-8c1c-a2ba8d6b14be
- <Package Folder>/files/FireVeg1
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/root3
- <Package Folder>/app_63ae1279-8ce0-41d1-8a8b-59e1a9b5be1e/ddexe
- <Package Folder>/app_subox_download/fc9a6871-df26-47ec-97ac-8288fceed297
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/debuggerd
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/fileWork
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/Matrix
- <Package Folder>/app_subox_download/65cbb319-4828-4623-9c29-069112a271e0
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/install-recovery.sh
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/pidof
- <Package Folder>/app_2d3ac6bf-ba5b-42d5-bdf5-aa538751c444/su
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/ddexe
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/ddexe
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/debuggerd
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/su
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/wsroot.sh
- <Package Folder>/app_subox_download/77f2cfb9-e7e0-460f-9b20-e7824fa923b5
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/pidof
- <Package Folder>/app_8243fbd1-ef43-48e7-8ea9-3e9d5ecb3893/install-recovery.sh
- <Package Folder>/app_10f7a8d7-09d6-442a-b0ad-a3f341e93ff9/device.db
- <Package Folder>/app_cf7c75a8-4243-4aaa-a74b-18e285cd73cd/ddexe
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_subox_download/e6bb6dff-daff-4e57-9aca-4f2afc6cccb0
- <Package Folder>/app_104b75cd-2ac3-4535-bcf8-d664c3e1ab7f/ddexe
Другие:
Запускает следующие shell-скрипты:
- chmod 777 /storage/emulated/0/Android/data/####/files/Download/Android/azb/15ef7c9930076d3321eb5e2afd2acfc3.apk
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/15ef7c9930076d3321eb5e2afd2acfc3.apk
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- <dexopt>
Может автоматически отправлять СМС-сообщения.
