Technical information
Malicious functions:
Removes its shortcut from the home screen.
Modified file system:
Creates the following files:
- <Package Folder>/files/busybox
- <Package Folder>/files/daemon
- <Package Folder>/files/scandir
- <Package Folder>/files/scandir_pie
- <Package Folder>/files/xtech
- <Package Folder>/files/xtech_app
- <Package Folder>/shared_prefs/Setting_Info.xml
Miscellaneous:
Executes next shell scripts:
- chmod 777 <Package Folder>/files/busybox
- chmod 777 <Package Folder>/files/daemon
- chmod 777 <Package Folder>/files/scandir
- chmod 777 <Package Folder>/files/scandir_pie
- chmod 777 <Package Folder>/files/xtech_app
- id
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 39 -p1w 45 -p2r 48 -p2w 50
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 39 -p1w 46 -p2r 48 -p2w 49
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 39 -p1w 46 -p2r 48 -p2w 50
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 41 -p1w 43 -p2r 46 -p2w 47
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 42 -p1w 44 -p2r 47 -p2w 48
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 43 -p1w 45 -p2r 47 -p2w 48
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 44 -p1w 45 -p2r 46 -p2w 47
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 45 -p1w 46 -p2r 47 -p2w 48
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 45 -p1w 47 -p2r 48 -p2w 49
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 46 -p1w 47 -p2r 48 -p2w 49
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 46 -p1w 47 -p2r 48 -p2w 50
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 46 -p1w 48 -p2r 49 -p2w 50
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 47 -p1w 48 -p2r 49 -p2w 50
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 47 -p1w 49 -p2r 50 -p2w 51
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 48 -p1w 49 -p2r 50 -p2w 51
- sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 52 -p1w 53 -p2r 54 -p2w 55
- su -c id
Loads the following dynamic libraries:
- daemon_api20
Uses elevated priveleges.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
