Android.Packed.21918

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.543.origin

Network activity:

Connecting to:

p####.####.top
1####.####.67
c####.####.org
n####.se
5####.####.56
m####.####.com
c####.####.cn

HTTP GET requests:

n####.se/promote/promo_frojo.php
c####.####.org/strategy/base
c####.####.org/strategy/sul18
c####.####.org/strategy/UnknownDev
c####.####.cn/sfile/201705/17/all/cp_V2.7.8.txt
c####.####.org/strategy/symlink-adbd
c####.####.org/strategy/loss_4.3
5####.####.56/checker
c####.####.org/strategy/dev_root2
c####.####.cn/upload/201705/20/app/20170520010732548.apk
5####.####.56/core
m####.####.com/sdk-core-v40.js
c####.####.org/strategy/larger4.3
c####.####.org/strategy/dev_root
c####.####.cn/upload/201705/22/img/20170522095608430.png

HTTP POST requests:

p####.####.top/sdf/ih
p####.####.top/hadat/k/lc
p####.####.top/jzbdt/gl/unve/nrxtk
1####.####.67/log/interface.html
p####.####.top/jzbdt/sjouq/pfkq
p####.####.top/jzbdt/xgyix/v
1####.####.67/strategy/interface.html
p####.####.top/hadat/n/dtkuc

Modified file system:

Creates the following files:

<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/toolbox
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/Matrix
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/wsroot.sh
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/ddexe
<Package Folder>/shared_prefs/kr.xml.bak
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/debuggerd
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/install-recovery.sh
<Package Folder>/databases/webview.db
<Package Folder>/app_subox_download/b7ef3dd4-8ac8-4dac-8ff3-052aa9f5d9e6
<Package Folder>/databases/webviewCookiesChromiumPrivate.db
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/toolbox
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/device.db
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/pidof
<Package Folder>/app_plugin_download/33fd91e1-85f3-4b50-8f6d-97b5835cab58
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/debuggerd
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/fileWork
<Package Folder>/shared_prefs/com.frojo.virtualpet_preferences.xml
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/wsroot.sh
<Package Folder>/shared_prefs/wv.xml.bak
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/install-recovery.sh
<Package Folder>/shared_prefs/dsi.xml
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/Matrix
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/install-recovery.sh
<Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/fileWork
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/fileWork
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/toolbox
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/supolicy
<Package Folder>/app_subox_download/e6626edf-4b05-417f-ab90-d0d1f1b0f953
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/Matrix
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/Matrix
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/install-recovery.sh
<Package Folder>/cache/webviewCacheChromium/index
<Package Folder>/app_34538ba3-faf7-4f96-9fcd-65092ef9c2f6/checker.jar
<Package Folder>/shared_prefs/subox.xml
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/wsroot.sh
<Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/toolbox
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/pidof
<Package Folder>/app_subox/c61913b615fb6224701377a119081f36
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/su
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/fileWork
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/supolicy
<Package Folder>/databases/webview.db-journal
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/install-recovery.sh
<Package Folder>/app_subox_download/8dfb392a-abc6-42b5-906e-db16376cc53b
<Package Folder>/shared_prefs/sfe.xml
<Package Folder>/files/SUBOXLOG_
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/debuggerd
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/debuggerd
<Package Folder>/app_subox_download/f898518f-9b0d-49f9-8327-cb2f20bb34c7
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/wsroot.sh
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/root3
<Package Folder>/app_anonymous_files/anonymous_core.so
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/pidof
<Package Folder>/shared_prefs/wv.xml
<Package Folder>/databases/t_u.db-journal
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/ddexe
<Package Folder>/files/nd.jar
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/Matrix
<Package Folder>/shared_prefs/ab_sdk_pref.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/pidof
<Package Folder>/app_subox_download/9af8d758-d563-4971-82d3-4626eaa08eb7
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/ddexe
<Package Folder>/shared_prefs/frojopet.xml
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/su
<Package Folder>/app_subox_download/181c7b79-ab73-4cec-833e-b6fe3687d224
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/debuggerd
<Package Folder>/files/ns.jar
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/supolicy
<Package Folder>/databases/admob/localstorage/http_media.admob.com_0.localstorage-journal
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/wsroot.sh
<Package Folder>/app_4bfd1229-ec63-424a-916f-6061c0c9303f/su
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/ddexe
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/su
<Package Folder>/app_subox_download/3569b106-0c94-43f4-a704-593e438406a9
<Package Folder>/app_subox_download/7303ea72-bbcf-4d5b-8de7-9eeadac61992
<Package Folder>/cache/ads-531014260.jar
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/toolbox
<Package Folder>/app_plugin_download/50a0fa21-a650-44d8-87ed-d31d503ab518
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/supolicy
<Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/debuggerd
<Package Folder>/cache/webviewCacheChromium/f_000001
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/pidof
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/wsroot.sh
<Package Folder>/app_dbe7b381-dcad-41cd-a5cd-8317fc116187/install-recovery.sh
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/fileWork
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/Matrix
<Package Folder>/databases/webviewCookiesChromium.db
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/supolicy
<Package Folder>/app_0303de95-b921-43bb-b18b-5e75c9ea5e15/fileWork
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/pidof
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/su
<Package Folder>/app_068ecc50-91fe-4c8c-92f0-a496c3d13cd3/su
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/ddexe
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/supolicy
<Package Folder>/app_8f6bd672-b80d-4371-beea-eeff76b0b2fc/ddexe
<Package Folder>/app_bb07576e-644f-4bdc-8d2c-45b6c5e00285/toolbox
<Package Folder>/cache/webviewCacheChromium/data_3
<Package Folder>/cache/webviewCacheChromium/data_2
<Package Folder>/cache/webviewCacheChromium/data_1
<Package Folder>/cache/webviewCacheChromium/data_0

Miscellaneous:

Executes next shell scripts:

chmod 777 /storage/emulated/0/Android/data/####/files/Download/Android/azb/4d5e66fadcd2226a4b95d7cd6f8e4111.apk
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/4d5e66fadcd2226a4b95d7cd6f8e4111.apk
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
<dexopt>

Contains functionality to send SMS messages automatically.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial