Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- t####.com
- 1####.####.67
- c####.####.org
- d####.####.cn
- p####.####.com
- b####.####.cn
- a####.####.com
HTTP GET requests:
- c####.####.org/strategy/sul18
- c####.####.org/strategy/symlink-adbd
- c####.####.org/strategy/dev_root2
- c####.####.org/strategy/larger4.3
- p####.####.com/attch/day_130619/20130619_1fdc3cb1047de4bbd22dNALO68NtutDD.jpg
- t####.com/mobileapp/zxhelper.php?action=####&kid=####
- c####.####.org/strategy/loss_4.3
HTTP POST requests:
- b####.####.cn/ct/wo/bswr/uoek
- 1####.####.67/log/interface.html
- t####.com/mobileapp/zxhelper.php?action=####&stype=####
- d####.####.cn/ct/g/txor
- d####.####.cn/ct/h/q
- a####.####.com/app_logs
- 1####.####.67/strategy/interface.html
Modified file system:
Creates the following files:
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/su
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/root3
- /data/data/####/app_subox_download/e06a39c3-faee-4b2f-b4f4-0147812d1e18
- /data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/wsroot.sh
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/device.db
- /data/data/####/app_subox_download/69a3c238-6877-4bb0-8005-83bf53330043
- /data/data/####/app_subox_download/cfb009f8-6731-4c92-9580-3bada2ddc29f
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/toolbox
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/pidof
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/wsroot.sh
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/pidof
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/ddexe
- /data/data/####/files/ln.jar
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/toolbox
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/files/mobclick_agent_cached_####
- /data/data/####/app_subox_download/5e0f2869-fb68-40ee-8127-0542094efe64
- /data/data/####/shared_prefs/kr.xml.bak
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/supolicy
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/fileWork
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/toolbox
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/debuggerd
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/ddexe
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/wsroot.sh
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/toolbox
- /data/data/####/files/SUBOXLOG_
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/wsroot.sh
- /data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/debuggerd
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/supolicy
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/install-recovery.sh
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/fileWork
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/ddexe
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/install-recovery.sh
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/supolicy
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/install-recovery.sh
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/debuggerd
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/install-recovery.sh
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/supolicy
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/fileWork
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/debuggerd
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/ddexe
- /data/data/####/app_subox_download/a401f67b-6c5e-4399-8e8f-bde674b3281a
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/Matrix
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/pidof
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/su
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/su
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/Matrix
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/pidof
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/app_b3137c1e-f17d-4c8d-b5ed-0b67bab8c3cc/eh.jar
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/Matrix
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/Matrix
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/su
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/fileWork
Sets the 'executable' attribute to the following files:
- /data/data/####/app_7806970d-f3b2-425a-a7eb-7ebd54134e2d/Matrix
- /data/data/####/app_45dab573-c1be-4e03-a5e9-e4952ec3432a/Matrix
- /data/data/####/app_b1774b9f-c030-42b1-b5f9-627dae21c29f/Matrix
- /data/data/####/app_484b4ac3-7e8e-4745-aacd-779eff6e47cd/Matrix
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.
