Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Plague.1.origin
- Android.DownLoader.589.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) th.pen####.com:80
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) cdn.app.superma####.####.com:80
- TCP(HTTP/1.1) adf####.b0.a####.com:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(TLS/1.0) cdn.app.superma####.####.com:443
- TCP(TLS/1.0) c####.superma####.top:443
Запросы DNS:
- c####.superma####.top
- cdn.app.h####.top
- cdn.app.superma####.top
- cdn.game####.org
- cdn.img.h####.top
- mt####.go####.com
- s.pen####.com
- th.pen####.com
Запросы HTTP GET:
- adf####.b0.a####.com/1465986050709.png
- adf####.b0.a####.com/1484814498679.png
- adf####.b0.a####.com/1484814500183.jpg
- adf####.b0.a####.com/1485178467236.png
- adf####.b0.a####.com/1488270906514.png
- adf####.b0.a####.com/1488270907362.jpg
- adf####.b0.a####.com/1495772332105.png
- adf####.b0.a####.com/1499392413799.png
- adf####.b0.a####.com/1499392414953.jpg
- adf####.b0.a####.com/1502960321637.png
- adf####.b0.a####.com/1511247852630.png
- adf####.b0.a####.com/1516609995667.png
- adf####.b0.a####.com/1516609996839.jpg
- adf####.b0.a####.com/1517306073756.png
- adf####.b0.a####.com/1517536969452.apk
- adf####.b0.a####.com/1518080603121.apk
- adf####.b0.a####.com/1518354386196.apk
- adf####.b0.a####.com/1521169634003.apk
- adf####.b0.a####.com/1521184867490.apk
- cdn.app.superma####.####.com/upload/201802/6/app/20180206153530165.apk
- cdn.app.superma####.####.com/upload/201802/6/img/20180206153521627.png
- cdn.game####.org/strategy/UnknownDev
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/larger4.3
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- cdn.game####.org/strategy/symlink-adbd
Запросы HTTP POST:
- th.pen####.com/a
- th.pen####.com/b
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/Matrix
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/ddexe
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/debuggerd
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/device.db
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/fileWork
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/insta...ery.sh
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/pidof
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/root3
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/su
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/supolicy
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/toolbox
- <Package Folder>/app_01319c14-15ec-4376-96da-d65920e35833/wsroot.sh
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/Matrix
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/ddexe
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/debuggerd
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/fileWork
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/insta...ery.sh
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/pidof
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/su
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/supolicy
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/toolbox
- <Package Folder>/app_146bf8b3-02d8-4548-b555-29917b9a4b6c/wsroot.sh
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/Matrix
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/ddexe
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/debuggerd
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/fileWork
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/insta...ery.sh
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/pidof
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/su
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/supolicy
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/toolbox
- <Package Folder>/app_5607f254-59ef-4c6f-ad5b-feba5b809945/wsroot.sh
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/Matrix
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/ddexe
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/debuggerd
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/fileWork
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/insta...ery.sh
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/pidof
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/su
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/supolicy
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/toolbox
- <Package Folder>/app_7df5e20d-219f-40ff-b1df-70c3c5a79825/wsroot.sh
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/Matrix
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/ddexe
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/debuggerd
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/fileWork
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/insta...ery.sh
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/pidof
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/su
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/supolicy
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/toolbox
- <Package Folder>/app_d350d5ad-b4b2-463f-b369-1d70bac2ea6d/wsroot.sh
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/Matrix
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/ddexe
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/debuggerd
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/fileWork
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/insta...ery.sh
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/pidof
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/su
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/supolicy
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/toolbox
- <Package Folder>/app_e87f2a04-9db8-4e4d-accd-6a42cd9fe5a8/wsroot.sh
- <Package Folder>/app_f38aa484-2966-41c7-b2d5-6732f6924e2c/67fca...fa27f8
- <Package Folder>/app_f38aa484-2966-41c7-b2d5-6732f6924e2c/ddcc1...be.jar
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_subox_download/13497a15-8a4f-46da-9f60-dc403c152f4c
- <Package Folder>/app_subox_download/33832ead-781a-422a-8256-b377b46cef8d
- <Package Folder>/app_subox_download/38e1a81f-cf4d-4665-8869-23c81f4771a1
- <Package Folder>/app_subox_download/7feda2dd-5313-4aea-8979-143d6bd1be1b
- <Package Folder>/app_subox_download/90b90618-ef84-4017-8782-9ad648175b78
- <Package Folder>/app_subox_download/98b4e736-f107-42ba-a480-cd407fe5dc98
- <Package Folder>/app_subox_download/abbda0a5-b4fe-444f-a67f-52a6802feff5
- <Package Folder>/app_subox_download/dd44fc2e-f01f-4aac-801b-590d4b3abd30
- <Package Folder>/app_xcfclasses.jar
- <Package Folder>/cache/V2.9.1.txt
- <Package Folder>/databases/dbgyg-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/onbyo
- <Package Folder>/files/yq.jar
- <Package Folder>/files/ys.jar
- <Package Folder>/shared_prefs/count.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/vbz.xml
- <SD-Card>/Android/####/0f5e8ff3754d7af7d7a3999f86f8a79f.apk
- <SD-Card>/Android/####/283944181e4a5
- <SD-Card>/Android/####/b.tmp
- <SD-Card>/Download/####/1465986050709.png.dat
- <SD-Card>/Download/####/1484814498679.png.dat
- <SD-Card>/Download/####/1484814500183.jpg.dat
- <SD-Card>/Download/####/1485178467236.png.dat
- <SD-Card>/Download/####/1488270906514.png.dat
- <SD-Card>/Download/####/1488270907362.jpg.dat
- <SD-Card>/Download/####/1495772332105.png.dat
- <SD-Card>/Download/####/1499392413799.png.dat
- <SD-Card>/Download/####/1499392414953.jpg.dat
- <SD-Card>/Download/####/1502960321637.png.dat
- <SD-Card>/Download/####/1511247852630.png.dat
- <SD-Card>/Download/####/1516609995667.png.dat
- <SD-Card>/Download/####/1516609996839.jpg.dat
- <SD-Card>/Download/####/1517306073756.png.dat
- <SD-Card>/Download/####/1517536969452.apk.dat
- <SD-Card>/Download/####/1518080603121.apk.dat
- <SD-Card>/Download/####/1518354386196.apk.dat
- <SD-Card>/Download/####/1521169634003.apk.dat
- <SD-Card>/Download/####/1521184867490.apk.dat
Другие:
Запускает следующие shell-скрипты:
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/0f5e8ff3754d7af7d7a3999f86f8a79f.apk
- chmod 777 /storage/emulated/0/download/apk/1518354386196.apk.dat
- chmod 777 /storage/emulated/0/download/apk/1521169634003.apk.dat
- chmod 777 /storage/emulated/0/download/apk/1521184867490.apk.dat
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Загружает динамические библиотеки:
- thv
Использует следующие алгоритмы для шифрования данных:
- DES-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- DES
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
