Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- p####.####.top
- 1####.####.67
- c####.####.org
- google-####.com
- 5####.####.56
- c####.####.cn
Запросы HTTP GET:
- c####.####.org/strategy/base
- c####.####.org/strategy/sul18
- c####.####.org/strategy/UnknownDev
- c####.####.cn/sfile/201705/17/all/cp_V2.7.8.txt
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/loss_4.3
- 5####.####.56/checker
- c####.####.org/strategy/dev_root2
- c####.####.cn/upload/201705/22/img/20170522095608430.png
- 5####.####.56/core
- google-####.com/__utm.gif?utmwv=####&utmn=####&utmcs=####&utmsr=####&utm...
- c####.####.org/strategy/larger4.3
- c####.####.org/strategy/dev_root
- c####.####.cn/upload/201705/20/app/20170520010732548.apk
Запросы HTTP POST:
- p####.####.top/jzbdt/xi/mgnfi
- p####.####.top/hadat/wkhg/dlfpm
- 1####.####.67/log/interface.html
- p####.####.top/jzbdt/grw/sz/iq
- p####.####.top/sdf/di
- p####.####.top/jzbdt/pxcvz/go
- p####.####.top/hadat/gcit/hj
- 1####.####.67/strategy/interface.html
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/toolbox
- <Package Folder>/databases/google_analytics.db
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/files/uz.jar
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/supolicy
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/pidof
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/su
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/debuggerd
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/su
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/su
- <Package Folder>/databases/google_analytics.db-journal
- <Package Folder>/app_subox_download/e4e9c3c9-2441-4f18-a7b3-5666c6d22c25
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/su
- <Package Folder>/app_subox_download/c2b11c72-5d97-422e-853b-2042f7b2683a
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/toolbox
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/pidof
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/toolbox
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/wsroot.sh
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/pidof
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/fileWork
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/root3
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/supolicy
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/supolicy
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/install-recovery.sh
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/install-recovery.sh
- <Package Folder>/app_plugin_download/c6499b25-10b0-4241-a881-7ec6258ab7d4
- <Package Folder>/shared_prefs/ApplicationPrefs.xml
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/fileWork
- <Package Folder>/app_subox_download/cea16767-dc6a-4d0c-8ed3-c5301d3b5ca5
- <Package Folder>/app_subox_download/c0a1e5f3-7741-4156-a239-3cfa93808f80
- <Package Folder>/files/ka.jar
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/Matrix
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/wsroot.sh
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/install-recovery.sh
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/pidof
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/Matrix
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/Matrix
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/toolbox
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/pidof
- <Package Folder>/app_subox_download/1b94785b-b2f5-4c93-ac1a-2371e3116f62
- <Package Folder>/app_94f4bf94-a0d5-4aa8-9506-5b40423f17b5/checker.jar
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/ddexe
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/ddexe
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/Matrix
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/Matrix
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/supolicy
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/fileWork
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/pidof
- <Package Folder>/app_subox_download/7025bef0-7491-4238-83ee-3a4f424b25e9
- <Package Folder>/app_plugin_download/95d78210-9772-4d6a-8634-b57d1e4f2442
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/ddexe
- <Package Folder>/app_anonymous_files/anonymous_core.so
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/wsroot.sh
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/fileWork
- <Package Folder>/app_subox_download/b990d9d5-42ee-4bd9-bd30-ae29f8d8afd6
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/ddexe
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/debuggerd
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/wsroot.sh
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/app_subox_download/024dc8b6-bd04-49fa-ac55-4c4b02333131
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/install-recovery.sh
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/debuggerd
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/fileWork
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/device.db
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/supolicy
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/install-recovery.sh
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/wsroot.sh
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/su
- <Package Folder>/app_53f655ef-bb1c-418f-8e20-52cc26d01084/debuggerd
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/ddexe
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/install-recovery.sh
- <Package Folder>/app_da8e9372-5dc9-446b-81e2-a20756d988be/toolbox
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/supolicy
- <Package Folder>/app_18fa0bb3-a73c-4f05-9d27-703878b01685/debuggerd
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/ddexe
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/Matrix
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/su
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/toolbox
- <Package Folder>/app_ca3a9cf0-b9df-4b45-9016-4616c75b2da5/wsroot.sh
- <Package Folder>/app_d8752ce7-9b5f-499f-beaf-738a80e986a1/fileWork
- <Package Folder>/app_1e7d903c-57e4-4369-a6eb-f818770daf6d/debuggerd
Другие:
Запускает следующие shell-скрипты:
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
- <dexopt>
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
Может автоматически отправлять СМС-сообщения.
