Android.Packed.20276

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.511.origin

Prompts to install third-party applications.

Network activity:

Connecting to:

c####.####.org
q####.####.cn
1####.####.67
c####.####.cn
w####.####.cn

HTTP GET requests:

c####.####.org/strategy/sul18
c####.####.org/strategy/symlink-adbd
c####.####.org/strategy/dev_root
c####.####.org/strategy/dev_root2
c####.####.cn/upload/201704/1/img/20170401155810066.png
c####.####.cn/upload/201704/1/app/20170401155820980.apk
c####.####.org/strategy/larger4.3
c####.####.org/strategy/loss_4.3

HTTP POST requests:

q####.####.cn/shuju/z/iq
1####.####.67/log/interface.html
q####.####.cn/ct/vo/xfkn/q
w####.####.cn/ct/dtye/aur
w####.####.cn/shuju/sdypd/ky
1####.####.67/strategy/interface.html
w####.####.cn/ct/e/fc
w####.####.cn/shuju/va/nzhv

Modified file system:

Creates the following files:

/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/wsroot.sh
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/supolicy
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/install-recovery.sh
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/debuggerd
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/wsroot.sh
/data/data/####/app_subox_download/b450eced-837a-45e4-b2cc-c49579044dea
/data/data/####/databases/songsdata
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/pidof
/data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
/data/data/####/databases/songsdata-journal
/data/data/####/databases/t_u.db-journal
/data/data/####/databases/webview.db-journal
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/Matrix
/sdcard/tmdv/io/af38eca655690.tmp
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/toolbox
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/su
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/wsroot.sh
/data/data/####/app_subox_download/bf202e08-f80e-4696-945d-5b235a7ebfb5
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/su
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/toolbox
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/pidof
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/su
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/root3
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/su
/data/data/####/files/SUBOXLOG_
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/Matrix
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/ddexe
/data/data/####/shared_prefs/dsi.xml
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/ddexe
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/fileWork
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/fileWork
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/supolicy
/data/data/####/app_subox_download/99d7b145-5146-4442-8c9f-81b6ad109294
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/toolbox
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/debuggerd
/data/data/####/shared_prefs/SETTING.xml
/data/data/####/app_anonymous_files/anonymous_core.so
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/fileWork
/data/data/####/files/jl.jar
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/toolbox
/data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/Matrix
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/pidof
/data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/su
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/toolbox
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/ddexe
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/Matrix
/data/data/####/app_subox/b18a021d11a3004d25017230b681476b
/data/data/####/shared_prefs/kr.xml
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/fileWork
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/install-recovery.sh
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/supolicy
/data/data/####/app_858e1374-c6c2-4e31-a31e-999a12dcce0b/eh.jar
/sdcard/tmdv/io/af38eca655690
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/install-recovery.sh
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/install-recovery.sh
/data/data/####/app_subox_download/d9a04dc5-7440-4bfd-9af0-daef0e819303
/data/data/####/app_subox_download/991a365f-70c4-43e0-8f09-b3ca1d5070be
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/install-recovery.sh
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/debuggerd
/data/data/####/cache/ads-1221402676.jar
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/pidof
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/supolicy
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/ddexe
/sdcard/tmdv/io/f7aeabdb8e4591071880b5db672dd0f7.apk
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/debuggerd
/data/data/####/shared_prefs/kr.xml.bak
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/device.db
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/wsroot.sh
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/fileWork
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/wsroot.sh
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/ddexe
/data/data/####/app_subox_download/197933c6-38a3-4102-bdf9-3d690b72a2d2
/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/supolicy
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/Matrix
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/pidof
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/debuggerd
/data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/cache/ApplicationCache.db-journal

Sets the 'executable' attribute to the following files:

/data/data/####/app_8a84df59-27ba-4d11-b133-2ed86a3f3503/Matrix
/data/data/####/app_525165b2-9e41-4738-be86-ed5881c8da8b/Matrix
/data/data/####/app_4298bd60-8c99-461b-9203-61f5767350c8/Matrix
/data/data/####/app_d973cdcb-59dd-4692-94c2-312faf6f863c/Matrix
/data/data/####/app_c865dfcc-8d69-49df-8d83-0511492e34ec/Matrix

Miscellaneous:

Executes next shell scripts:

Contains functionality to send SMS messages automatically.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial