Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.589.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 52.52.2####.56:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) go.hotw####.top:80
- TCP(HTTP/1.1) cdn.app.kac####.####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) cdn.game####.org:80
Запросы DNS:
- a####.u####.com
- api.l####.ren
- cdn.app.kac####.cn
- cdn.game####.org
- cdn.img.h####.top
- go.hotw####.top
- log.api.l####.ren
Запросы HTTP GET:
- cdn.app.kac####.####.com/sfile/201711/16/all/cp_V2.8.5.txt
- cdn.app.kac####.####.com/upload/201802/6/img/20180206153521627.png
- cdn.game####.org/strategy/UnknownDev
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/larger4.3
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- cdn.game####.org/strategy/symlink-adbd
Запросы HTTP POST:
- a####.u####.com/app_logs
- go.hotw####.top/cpgg/k/vl
- go.hotw####.top/cpgg/qkvc/nsaia/wfz
- go.hotw####.top/sdf/te
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/Matrix
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/ddexe
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/debuggerd
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/fileWork
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/insta...ery.sh
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/pidof
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/su
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/supolicy
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/toolbox
- <Package Folder>/app_09123b98-7bf4-42ea-96b7-f3861a9361c5/wsroot.sh
- <Package Folder>/app_31e7c9d9-6a0a-4f98-8297-68755a623a43/checker.jar
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/Matrix
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/ddexe
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/debuggerd
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/fileWork
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/insta...ery.sh
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/pidof
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/su
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/supolicy
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/toolbox
- <Package Folder>/app_5a4ec11c-fbf8-4ac3-8d63-70023a305fcb/wsroot.sh
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/Matrix
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/ddexe
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/debuggerd
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/fileWork
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/insta...ery.sh
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/pidof
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/su
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/supolicy
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/toolbox
- <Package Folder>/app_7dcc95ae-eabb-4b21-9b5a-a32a4097a8c4/wsroot.sh
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/Matrix
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/ddexe
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/debuggerd
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/fileWork
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/insta...ery.sh
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/pidof
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/su
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/supolicy
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/toolbox
- <Package Folder>/app_837e25ee-15a4-4eb1-be65-e6b2bab36cf7/wsroot.sh
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/Matrix
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/ddexe
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/debuggerd
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/fileWork
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/insta...ery.sh
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/pidof
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/su
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/supolicy
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/toolbox
- <Package Folder>/app_a7d3560c-fe65-4dea-8d17-ec51b18d89f7/wsroot.sh
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/Matrix
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/ddexe
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/debuggerd
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/device.db
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/fileWork
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/insta...ery.sh
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/pidof
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/root3
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/su
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/supolicy
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/toolbox
- <Package Folder>/app_f1fb1d62-fbdc-45a0-9921-a7b15822380a/wsroot.sh
- <Package Folder>/app_plugin_download/071c793e-92c2-4ce2-b968-779f3f1d1c95
- <Package Folder>/app_plugin_download/33dec29b-c43e-4271-9fa0-8a152eda06ab
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_subox_download/03aaa9a5-145e-400a-89b7-3aa29da7cc44
- <Package Folder>/app_subox_download/1bb0f2e7-0131-44eb-9808-3b1621bde774
- <Package Folder>/app_subox_download/33cf4d34-d682-4d54-9c32-e6fab1fae4fa
- <Package Folder>/app_subox_download/35f85ec4-09dc-47ab-bcc1-60aa4659000b
- <Package Folder>/app_subox_download/780558a5-f3df-4825-827e-e7e621fe8522
- <Package Folder>/app_subox_download/7e7c5a4e-4adc-42da-b122-7b560c03e075
- <Package Folder>/app_subox_download/89326d0e-5e70-41cb-9621-c92abdb133b0
- <Package Folder>/app_subox_download/d90611b7-a1d9-4cf2-9101-75cf99ecd88a
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/files/####/0969d585-379b-41cd-a13b-1c28050f45bd_0.tp
- <Package Folder>/files/####/0f2a0e99-aadd-483a-b5f9-e662c9600088_0.tp
- <Package Folder>/files/####/14c8f6d2-ca2b-4180-a18a-dc111c3ad0c8_0.tp
- <Package Folder>/files/####/17898c05-1e34-4b34-8147-0bd367eb35a2_0.tp
- <Package Folder>/files/####/18944182-ea1b-4ea9-a602-ce3bb10c554d_0.tp
- <Package Folder>/files/####/192f3e51-f250-42ce-8927-64b8556b4287_0.tp
- <Package Folder>/files/####/19e5ee73-f22b-41ea-a914-07a3c7743910_0.tp
- <Package Folder>/files/####/1f784f8b-ad16-45cb-beae-a1e05e276dc4_0.tp
- <Package Folder>/files/####/224d2a81-8654-4086-bf6e-b0c129e50fa5_0.tp
- <Package Folder>/files/####/230d7a51-3c59-4a79-b9e5-e3654e330f1b_0.tp
- <Package Folder>/files/####/296133b7-0f7b-4af8-b7a4-5232b0727fb7_0.tp
- <Package Folder>/files/####/2ca17555-e371-47a2-a3bb-1208c3de03b0_0.tp
- <Package Folder>/files/####/35203269-775a-47b0-9c38-75b736947429_0.tp
- <Package Folder>/files/####/3f1fe1d0-4644-4c07-ae9d-59879ec481fe_0.tp
- <Package Folder>/files/####/5edbddbc-3fb3-4adf-8030-4731b4e18785_0.tp
- <Package Folder>/files/####/64d59ed1-56b6-472d-86a0-cf88dce4a829_0.tp
- <Package Folder>/files/####/719f34ee-a056-4473-a9d4-0a6138f153b4_0.tp
- <Package Folder>/files/####/7eead885-107c-44e1-be1e-2b7537ad31fa_0.tp
- <Package Folder>/files/####/83d0d5e9-0fb3-454d-b730-c8981c72ca51_0.tp
- <Package Folder>/files/####/84ad42e2-e2bc-41e5-b3cd-d2acee00b744_0.tp
- <Package Folder>/files/####/8624509c-fce1-485a-b54d-37e02d64058f_0.tp
- <Package Folder>/files/####/94a04a79-55c4-4b14-a7e9-f6a8110a0b9a_0.tp
- <Package Folder>/files/####/94f6890c-04d9-445a-83ac-fa1bbe00fc07_0.log
- <Package Folder>/files/####/a210bf51-7d23-4a46-bb41-31db799ec4c5_0.tp
- <Package Folder>/files/####/b6bc897d-e759-4b2c-8825-83617cb9b049_0.tp
- <Package Folder>/files/####/be033551-cfb6-447f-b173-eae6257e49b9_0.tp
- <Package Folder>/files/####/c3cb74db-ed6c-42fe-9e91-d562fdb050bd_0.tp
- <Package Folder>/files/####/c4a7e6b2-804b-45ba-902b-eb2091d784ab_0.tp
- <Package Folder>/files/####/cad0971e-52f1-4b2b-87e3-ddcfdf4aaa49_0.tp
- <Package Folder>/files/####/d18a1408-c5c1-4262-96d6-4b0dd613e717_0.tp
- <Package Folder>/files/####/da35098b-f0ea-4763-b275-dae796c43205_0.tp
- <Package Folder>/files/####/e9f34435-af14-466a-8750-d5ceab655d94_0.tp
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/fa779eb9-76df-43b0-a715-b0d8c0aa1698_0.tp
- <Package Folder>/files/.imprint
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/exid.dat
- <Package Folder>/files/mt.jar
- <Package Folder>/files/rp.jar
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/lt_pref.xml
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/wv.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/Android/####/283944181e4a5
- <SD-Card>/Android/####/V2.8.5.txt
Другие:
Запускает следующие shell-скрипты:
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Загружает динамические библиотеки:
- _ux655
- ring
- up
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- DES
Осуществляет доступ к интерфейсу камеры.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
