Android.Packed.19485

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.511.origin

Network activity:

Connecting to:

b####.####.cn
c####.####.org
d####.####.cn
1####.####.67
a####.####.com

HTTP GET requests:

c####.####.org/strategy/sul18
c####.####.org/strategy/symlink-adbd
c####.####.org/strategy/dev_root
c####.####.org/strategy/dev_root2
c####.####.org/strategy/larger4.3
c####.####.org/strategy/UnknownDev
a####.####.com/dev_html5/req?screen=####&mcc=####&accel=####&mnc=####&device_id=####&key=####&ip=####&dev_type=####&
c####.####.org/strategy/loss_4.3

HTTP POST requests:

d####.####.cn/ct/f/axhn/or
b####.####.cn/ct/qad/uae
1####.####.67/log/interface.html
a####.####.com/devpush/get_json_link
a####.####.com/dev/auth
d####.####.cn/ct/e/qvdg/jotz
b####.####.cn/ct/bplgo/rjjuf
b####.####.cn/ct/jc/ougv
d####.####.cn/ct/o/x
1####.####.67/strategy/interface.html

Modified file system:

Creates the following files:

/data/data/####/app_subox_download/770369f1-0396-4758-8def-f9481ee4bee0
/data/data/####/shared_prefs/2017018.xml
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/toolbox
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/Matrix
/data/data/####/shared_prefs/20161213.xml
/data/data/####/shared_prefs/20161217.xml
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/wsroot.sh
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/ddexe
/data/data/####/shared_prefs/2017019.xml
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/debuggerd
/data/data/####/app_5c5c4143-4a25-4f0a-8547-513d9f3b89c2/eh.jar
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/debuggerd
/data/data/####/shared_prefs/20161229.xml
/data/data/####/files/fv.jar
/data/data/####/app_9f5cbece-21ac-495c-8d8b-3f94507292e8/install-recovery.sh
/data/data/####/app_subox_download/6cbe5fd1-1feb-4884-ab25-cf052defb07f
/data/data/####/shared_prefs/20170114.xml
/data/data/####/shared_prefs/20170113.xml
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/ddexe
/data/data/####/shared_prefs/20161215.xml
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/ddexe
/data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
/data/data/####/databases/t_u.db-journal
/data/data/####/app_9f5cbece-21ac-495c-8d8b-3f94507292e8/toolbox
/data/data/####/shared_prefs/2016124.xml
/data/data/####/app_9f5cbece-21ac-495c-8d8b-3f94507292e8/supolicy
/data/data/####/shared_prefs/2016121.xml
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/kr.xml
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/fileWork
/data/data/####/shared_prefs/2017016.xml
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/pidof
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/supolicy
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/pidof
/data/data/####/shared_prefs/20170126.xml
/data/data/####/app_5049470c-0248-449e-abae-04c1e59940eb/eh.jar
/data/data/####/app_9f5cbece-21ac-495c-8d8b-3f94507292e8/debuggerd
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/fileWork
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/supolicy
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/fileWork
/data/data/####/app_9f5cbece-21ac-495c-8d8b-3f94507292e8/su
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/debuggerd
/data/data/####/app_9f5cbece-21ac-495c-8d8b-3f94507292e8/pidof
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/su
/data/data/####/shared_prefs/2017017.xml
/data/data/####/shared_prefs/67ab3995eeb8efd913e9ce408c745a68804df01d.xml
/data/data/####/shared_prefs/20170130.xml
/data/data/####/shared_prefs/2017013.xml
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/su
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/wsroot.sh
/data/data/####/shared_prefs/20170111.xml
/data/data/####/shared_prefs/20170129.xml
/data/data/####/shared_prefs/alo_AdLocusUtil.xml.bak
/data/data/####/shared_prefs/20161224.xml
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/Matrix
/data/data/####/files/hw.jar
/data/data/####/shared_prefs/20161220.xml
/data/data/####/shared_prefs/dsi.xml
/data/data/####/shared_prefs/20170112.xml
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/supolicy
/data/data/####/shared_prefs/20170116.xml
/data/data/####/shared_prefs/2016129.xml
/data/data/####/app_subox_download/1c243161-1cc7-4a3c-a3a4-5e360ca7d8d3
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/install-recovery.sh
/data/data/####/shared_prefs/com.adlocus.push.v.xml
/data/data/####/shared_prefs/20161210.xml
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/toolbox
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/su
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/wsroot.sh
/data/data/####/shared_prefs/20170127.xml
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/su
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/debuggerd
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/install-recovery.sh
/data/data/####/shared_prefs/2016127.xml
/data/data/####/shared_prefs/20170124.xml
/data/data/####/shared_prefs/20161214.xml
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/fileWork
/data/data/####/shared_prefs/2017012.xml
/data/data/####/shared_prefs/20161225.xml
/data/data/####/app_subox_download/f44d9dee-ae3b-4d35-a5fc-654095a4669a
/data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/shared_prefs/20161219.xml
/data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/app_subox_download/1b1c5eb0-cfd9-44af-b24c-62de6a6ff903
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/Matrix
/data/data/####/shared_prefs/20161218.xml
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/wsroot.sh
/data/data/####/shared_prefs/alo_AdLocusUtil.xml
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/pidof
/data/data/####/shared_prefs/com.adlocus.push.v.xml.bak
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/su
/data/data/####/shared_prefs/20161223.xml
/data/data/####/app_subox/b18a021d11a3004d25017230b681476b
/data/data/####/shared_prefs/20170119.xml
/data/data/####/shared_prefs/20170131.xml
/data/data/####/app_9f5cbece-21ac-495c-8d8b-3f94507292e8/ddexe
/data/data/####/shared_prefs/2016125.xml
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/pidof
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/Matrix
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/debuggerd
/data/data/####/shared_prefs/20170117.xml
/data/data/####/shared_prefs/20161222.xml
/data/data/####/app_subox/c61913b615fb6224701377a119081f36
/data/data/####/shared_prefs/2016123.xml
/data/data/####/shared_prefs/20170128.xml
/data/data/####/shared_prefs/20161230.xml
/data/data/####/files/SUBOXLOG_
/data/data/####/app_subox_download/5bfec236-5dce-4419-93b0-2bca3c7f5da1
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/Matrix
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/toolbox
/data/data/####/shared_prefs/2016122.xml
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/install-recovery.sh
/data/data/####/shared_prefs/2016126.xml
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/ddexe
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/install-recovery.sh
/data/data/####/shared_prefs/20161211.xml
/data/data/####/shared_prefs/2017015.xml
/data/data/####/shared_prefs/20161216.xml
/data/data/####/shared_prefs/2016128.xml
/data/data/####/app_subox_download/afa3d825-2ff7-4849-a829-8ccf7f3c09e4
/data/data/####/shared_prefs/20170121.xml
/data/data/####/shared_prefs/20161212.xml
/data/data/####/shared_prefs/20161231.xml
/data/data/####/shared_prefs/20170120.xml
/data/data/####/shared_prefs/20161226.xml
/data/data/####/shared_prefs/20170125.xml
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/fileWork
/data/data/####/shared_prefs/20170115.xml
/data/data/####/app_anonymous_files/anonymous_core.so
/data/data/####/shared_prefs/20161221.xml
/data/data/####/shared_prefs/alarm.xml
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/wsroot.sh
/data/data/####/shared_prefs/20170123.xml
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/supolicy
/data/data/####/shared_prefs/20161228.xml
/data/data/####/shared_prefs/2017011.xml
/data/data/####/shared_prefs/kr.xml.bak
/data/data/####/shared_prefs/20161227.xml
/data/data/####/shared_prefs/background.xml
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/toolbox
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/toolbox
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/supolicy
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/pidof
/data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/shared_prefs/20170118.xml
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/install-recovery.sh
/data/data/####/shared_prefs/2017014.xml
/data/data/####/shared_prefs/default.xml
/data/data/####/shared_prefs/.xml
/data/data/####/app_subox_download/b6f42d82-0b71-4905-bc66-775e2e3083ab
/data/data/####/shared_prefs/20170110.xml
/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/ddexe
/data/data/####/shared_prefs/20170122.xml

Sets the 'executable' attribute to the following files:

/data/data/####/app_79097fa7-d051-4f7b-af3e-a705fa5aa5bd/Matrix
/data/data/####/app_45b0d665-ea53-4aed-9149-6e6d5cfdc7fe/Matrix
/data/data/####/app_e15ba3f2-a8f1-4955-abee-ead93859b27f/Matrix
/data/data/####/app_25c0afa6-b851-49a5-adad-c25bbf292dd1/Matrix
/data/data/####/app_6894b654-883f-4ad5-8a00-8e17880bf787/Matrix

Miscellaneous:

Executes next shell scripts:

Contains functionality to send SMS messages automatically.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial