Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.371.origin
Gains access to the ITelephony private interface.
Modified file system:
Creates the following files:
- <Package Folder>/app_debug/googlej.jpg
- <Package Folder>/app_debug/googles.jpg
- <Package Folder>/app_dll/dynamic_dex.jar
- <Package Folder>/app_dll/libgoogleapi.so
- <Package Folder>/app_rel/dll.zip
- <Package Folder>/app_rel/google.jpg
- <Package Folder>/shared_prefs/android.xml
- <SD-Card>/baidu/.cuid
Miscellaneous:
Loads the following dynamic libraries:
- libgoogleapi
Gains access to geolocation.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Parses information from SMS messages.
