Android.Hidden.2606

Android.Hidden.2606

Added to the Dr.Web virus database: 2017-04-29

Virus description added: 2017-04-29

Malicious functions:

Removes its shortcut from the home screen.

Network activity:

Connecting to:

HTTP GET requests:

Modified file system:

Creates the following files:

Sets the 'executable' attribute to the following files:

Miscellaneous:

Executes next shell scripts:

su4200 -c mount -o remount system /system
su4200 -c mv /system/app/#### /system/app/####.apk
su -c chmod 6777 /system/bin/update
/data/data/####/app_bin/daemon -p #### -s ####.GoogleServer -t 120
mount -o remount system /system;dd if=/data/data/####/files/update of=/system/bin/update;chmod 6777 /system/bin/update;
su -c mount -o remount system /system
/system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2426 --user 0
su4200 -c chmod 6777 /system/app/####
su4200 -c dd if=/data/app/####-1.apk of=/system/app/####
su -c dd if=/data/data/####/files/update of=/system/bin/update
su4200 -c dd if=/data/data/####/lib/liblocSDK6a.so of=/system/lib/liblocSDK6a.so
/system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 6777 --e
/system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2232 --user 0
sh /system/bin/am startservice --user 0 -n ####/####.GoogleServer
chmod 0755 /data/data/####/app_bin/daemon

Uses elevated priveleges.

Contains functionality to send SMS messages automatically.