Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- 1####.####.67
- 5####.####.56
- a####.####.com
- c####.####.cn
- c####.####.org
- g####.####.top
- h####.####.com
Запросы HTTP GET:
- 5####.####.56/core
- c####.####.cn/sfile/201705/31/all/cp_V2.8.1.txt
- c####.####.cn/upload/201706/21/img/20170621175038474.png
- c####.####.org/strategy/base
Запросы HTTP POST:
- 1####.####.67/log/interface.html
- a####.####.com/app_logs
- a####.####.com/cells/data.php
- g####.####.top/jzbdt/zjaq/bfq
- h####.####.com/h5/h5.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_30c3499d-3cec-4fd1-a59c-b6707172edba/checker.jar
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/Matrix
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/ddexe
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/debuggerd
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/fileWork
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/install-recovery.sh
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/pidof
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/su
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/supolicy
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/toolbox
- <Package Folder>/app_d144b414-d94e-4bfe-b930-2f581c2f3be5/wsroot.sh
- <Package Folder>/app_plugin_download/4a2a395f-bcd0-4804-84cf-fd0fb26ab729
- <Package Folder>/app_plugin_download/5645fe44-d4a2-455a-940b-9ef6c4ac0398
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox_download/18923946-d084-42cb-84a5-45f910622cad
- <Package Folder>/app_subox_download/7aa0ec89-c0b3-45bc-8053-f8069a5404d0
- <Package Folder>/app_subox_download/d4553068-53d0-42b8-802e-0bee1ca59882
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/ads-21542112.jar
- <Package Folder>/databases/<Package>.settings-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/dr.jar
- <Package Folder>/files/jq.jar
- <Package Folder>/files/ym.jar
- <Package Folder>/files/ze.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/MobCells.xml
- <Package Folder>/shared_prefs/MobCells.xml.bak
- <Package Folder>/shared_prefs/MobCellsCache.xml
- <Package Folder>/shared_prefs/MobCellsConfig.xml
- <Package Folder>/shared_prefs/MobCellsConfig.xml.bak
- <Package Folder>/shared_prefs/MobCellsHView.xml
- <Package Folder>/shared_prefs/MobCellsHView.xml.bak
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/shared_prefs/wv.xml.bak
- <SD-Card>/Android/####/566a133ee60cd
- <SD-Card>/Android/####/V2.8.1.txt
- <SD-Card>/Android/####/b.tmp
- <SD-Card>/Android/####/cc1c280fdd30b26b7309c829608e59f5.apk
- <SD-Card>/mbstph/246ce0ed1e801fca5eaacd180eef473a
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
