The reason you're not seeing:
is because the botnet owners changed DNS on ycxrl.com to an invalid, private IP (192.168.9.1) ... so "stage 0" malware is running, but the pre-pwn3d malware is unable to download "stage 1" from ycxrl.com.
That is great news short-term, but they can change this back anytime they like to a real IP. I highly recommend you look at my cleanup script and at minimum perform the following steps to prevent malware from showing up again when they change ycxrl.com back to a real IP.
___________________________________________________________
Install ADB (If not already installed):
Assuming you're on Windows, to install ADB simply install Chocolatey first and install ADB using Choco:
macOS users have Homebrew to accomplish the same thing:
___________________________________________________________
Cleanup Steps:
Stage 1's 'home' folder is /data/system/Corejava -- Defeat the malware by turning /data/system/Corejava into an immutable file instead:
Additionally, the following prevents adups from running, which is an extra, unrelated layer of malware:
The X29 and A29 firmwares (If i recall correctly, it was a while ago) have some additional breakage that cause high load averages and higher temps, even at idle.
This is an Interesting find, thanks!
Code:
/data/system/shared_prefs/open_preference.xml
/data/data/com.swe.dgbluancher/files/даThat is great news short-term, but they can change this back anytime they like to a real IP. I highly recommend you look at my cleanup script and at minimum perform the following steps to prevent malware from showing up again when they change ycxrl.com back to a real IP.
___________________________________________________________
Install ADB (If not already installed):
Assuming you're on Windows, to install ADB simply install Chocolatey first and install ADB using Choco:
Code:
choco install adbmacOS users have Homebrew to accomplish the same thing:
Code:
brew install android-platform-tools___________________________________________________________
Cleanup Steps:
- Start with a factory-reset device
- Set the root switch to enabled and restart the device
- Go to Settings -> Network & Internet
- Connect to WiFi/Ethernet (preferably with a static IP and no gateway to prevent internet access)
- Get T95 IP address from WiFi/Ethernet settings, connect to the device and become root:
Code:
adb connect [T95 IP address]
-> * daemon not running; starting now at tcp:5037
-> * daemon started successfully
-> connected to 10.74.0.88:5555
adb root
-> restarting adbd as rootStage 1's 'home' folder is /data/system/Corejava -- Defeat the malware by turning /data/system/Corejava into an immutable file instead:
Code:
adb shell rm -rf /data/system/Corejava
adb shell touch /data/system/Corejava
adb shell chmod 0000 /data/system/Corejava
adb shell /vendor/bin/busybox chattr +i /data/system/CorejavaAdditionally, the following prevents adups from running, which is an extra, unrelated layer of malware:
Code:
adb shell pm uninstall --user 0 com.adups.fota
adb shell pm uninstall --user 0 com.ftest
adb shell pm uninstall --user 0 com.www.intallapp
adb shell rm -rf /data/data/com.adups.fota
adb shell touch /data/data/com.adups.fota
adb shell chmod 0000 /data/data/com.adups.fota
adb shell /vendor/bin/busybox chattr +i /data/data/com.adups.fotaThe X29 and A29 firmwares (If i recall correctly, it was a while ago) have some additional breakage that cause high load averages and higher temps, even at idle.
This is an Interesting find, thanks!
Last edited:
