Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- 1####.####.67
- 5####.####.56
- c####.####.cn
- c####.####.org
- g####.####.top
Запросы HTTP GET:
- 5####.####.56/core
- c####.####.cn/upload/201706/21/app/20170621175057341.apk
- c####.####.cn/upload/201706/21/img/20170621175038474.png
- c####.####.org/strategy/larger4.3
Запросы HTTP POST:
- 1####.####.67/strategy/interface.html
- g####.####.top/jzbdt/k/i
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_323f28b2-39d3-4122-aab7-48c1969ad4d1/checker.jar
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/Matrix
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/ddexe
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/debuggerd
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/fileWork
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/install-recovery.sh
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/pidof
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/su
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/supolicy
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/toolbox
- <Package Folder>/app_384a52e1-5837-4758-8ec7-fee3ccff9e1c/wsroot.sh
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/Matrix
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/ddexe
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/debuggerd
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/fileWork
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/install-recovery.sh
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/pidof
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/su
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/supolicy
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/toolbox
- <Package Folder>/app_4f31ee72-e7f7-4141-9aff-bc5ee1d999e8/wsroot.sh
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/Matrix
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/ddexe
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/debuggerd
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/fileWork
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/install-recovery.sh
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/pidof
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/su
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/supolicy
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/toolbox
- <Package Folder>/app_5908d674-1f21-4820-96a3-91ec9184f5c5/wsroot.sh
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/Matrix
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/ddexe
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/debuggerd
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/fileWork
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/install-recovery.sh
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/pidof
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/su
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/supolicy
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/toolbox
- <Package Folder>/app_6490fff7-33e2-472b-9df2-5c6865d01d1e/wsroot.sh
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/Matrix
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/ddexe
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/debuggerd
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/device.db
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/fileWork
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/install-recovery.sh
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/pidof
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/root3
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/su
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/supolicy
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/toolbox
- <Package Folder>/app_81d5a170-b08a-4037-903d-fc56811ab3c4/wsroot.sh
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/Matrix
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/ddexe
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/debuggerd
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/fileWork
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/install-recovery.sh
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/pidof
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/su
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/supolicy
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/toolbox
- <Package Folder>/app_86806b54-bc72-4f7f-8ef1-8236f4eb201f/wsroot.sh
- <Package Folder>/app_plugin_download/8ce8dc6c-09f2-43a1-8a2a-be0f8c1b616f
- <Package Folder>/app_plugin_download/da533936-5dc3-43bc-8b80-0c73ca81dddc
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_subox_download/2c69a4fd-dbde-4ac6-9a46-854f737ef555
- <Package Folder>/app_subox_download/420014bd-bc8f-4b66-8030-998c25e98eb3
- <Package Folder>/app_subox_download/5c1ad0c8-0ca7-45aa-bd04-0c20d3299686
- <Package Folder>/app_subox_download/6a904ef9-bd77-4afa-965d-0c891e0939fe
- <Package Folder>/app_subox_download/6ac9dd18-8d5e-4041-9c5c-4f68c1e6ed67
- <Package Folder>/app_subox_download/948004d7-05ba-44c7-ad70-599043fac1b6
- <Package Folder>/app_subox_download/e49875bd-0d7b-4065-8db8-e1e416e188b0
- <Package Folder>/app_subox_download/f9d7530a-cb9a-4556-800c-e4a8b2d8ea50
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ads1653414428.jar
- <Package Folder>/databases/google_analytics_v2.db-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/gaClientId
- <Package Folder>/files/im.jar
- <Package Folder>/files/wb.jar
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/shared_prefs/wv.xml.bak
- <SD-Card>/Android/####/566a133ee60cd
- <SD-Card>/Android/####/90837d9bca2db
- <SD-Card>/Android/####/V2.8.1.txt
- <SD-Card>/Android/####/b.tmp
- <SD-Card>/Android/####/cc1c280fdd30b26b7309c829608e59f5.apk
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
