Technical information
Malicious functions:
Executes code of the following detected threats:
- Tool.Rooter.59.origin
Network activity:
Connecting to:
- c####.####.org
- l####.####.cn
- 1####.####.67
- a####.####.com
- c####.####.cn
HTTP GET requests:
- c####.####.cn/sfile/201704/19/all/cp_V2.7.1.txt
- c####.####.org/strategy/dev_root2
- c####.####.org/strategy/loss_4.3
- c####.####.org/strategy/sul18
- c####.####.org/strategy/larger4.3
HTTP POST requests:
- l####.####.cn/jzbdt/jow/w
- l####.####.cn/upgrade/k
- 1####.####.67/log/interface.html
- a####.####.com/ad-service/ad/mark
- l####.####.cn/jzbdt/h/etgk
- l####.####.cn/jzbdt/exorx/t/jr
- a####.####.com/app_logs
- l####.####.cn/jzbdt/iuo/ydxsz
- l####.####.cn/upgrade/w
- 1####.####.67/strategy/interface.html
Modified file system:
Creates the following files:
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/debuggerd
- /data/data/####/files/fm.jar
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/pidof
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/ddexe
- /data/data/####/files/SUBOXLOG_
- /data/data/####/shared_prefs/sdkstrshare.xml
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/Matrix
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/su
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/wsroot.sh
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/install-recovery.sh
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/supolicy
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/fileWork
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/supolicy
- /data/data/####/app_subox_download/d95d5b80-39ed-46e3-add9-f9d73ee5a285
- /data/data/####/files/qv.jar
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/su
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/fileWork
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/ddexe
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/shared_prefs/subox.xml
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/fileWork
- /data/data/####/shared_prefs/data.xml
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/ddexe
- /data/data/####/shared_prefs/qihoo_jiagu_crash_report.xml
- /data/data/####/files/dz.jar
- /data/data/####/shared_prefs/sfe.xml
- /data/data/####/app_subox_download/5fbb725e-a1a1-4f69-ac65-bce38f101029
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/device.db
- /data/data/####/app_466eedef-a78b-4b50-9de0-9fa9fd842bcd/eh.jar
- /data/data/####/files/bi.jar
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/debuggerd
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/Matrix
- /data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/install-recovery.sh
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/supolicy
- /sdcard/Android/data/####/files/Download/V2.7.1.txt
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/wsroot.sh
- /data/data/####/files/.imprint
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/debuggerd
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/toolbox
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/su
- /data/data/####/app_jgls/.log.lock
- /data/data/####/shared_prefs/info_url.xml
- /data/data/####/app_subox_download/2700b203-5ac5-4525-81ce-22033181ddae
- /data/data/####/shared_prefs/sfe.xml.bak
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/pidof
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/Matrix
- /data/data/####/app_92ae0060-2e86-49b1-8d9e-f594b6e10b17/toolbox
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/wsroot.sh
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/toolbox
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/app_jgls/.log.ls
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/mobclick_agent_cached_####262
- /data/data/####/app_subox_download/49cc6637-11ef-4840-bac3-f2df41bc68d5
- /data/data/####/shared_prefs/sv.xml
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/pidof
- /data/data/####/shared_prefs/wv.xml
- /data/data/####/shared_prefs/spr.xml
- /data/data/####/app_7d764772-d2f1-4221-8255-bc0aa7ada7d0/install-recovery.sh
- /data/data/####/app_3d5e9994-9927-4e39-afe3-520a6471ef69/root3
- /data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
- /data/data/####/shared_prefs/kr.xml.bak
Sets the 'executable' attribute to the following files:
- /data/data/####/.jiagu/libjiagu.so
Miscellaneous:
Executes next shell scripts:
- sh
- chmod 755 /data/data/####/.jiagu/libjiagu.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
