Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.463.origin
Modified file system:
Creates the following files:
- /data/data/####/.m.jar
- /data/data/####/.m.prop
- /data/data/####/.x.sh
- /data/data/####/.y.jar
- /data/data/####/Test.ToolAbs.zip
- /data/data/####/Test.bbox.zip
- /data/data/####/busybox
- /data/data/####/icon.jpg
- /data/data/####/icon1.jpg
- /data/data/####/icon2.jpg
- /data/data/####/icon4.jpg
- /data/data/####/icon5.jpg
- /data/data/####/killall
- /data/data/####/libmain.so
- /data/data/####/mkad.xml
- /data/data/####/mobads.xml
- /data/data/####/r0
- /data/data/####/r1
- /data/data/####/r2
- /data/data/####/r3
- /data/data/####/r4
- /data/data/####/r5
- /data/data/####/r6
- /data/data/####/r8
- /data/data/####/su
- /data/data/####/su2
- /data/data/####/test.xml
- /data/media/####/...130
- /data/media/####/...131
- /data/media/####/...180
- /data/media/####/...181
- /data/media/####/...190
- /data/media/####/...191
- /data/media/####/._X0
- /data/media/####/._X1
- /data/media/####/.tmp_
Miscellaneous:
Executes next shell scripts:
- <Package Folder>/files/.z/r1 -C '<Package Folder>/files/.z/.x.sh'
- <Package Folder>/files/.z/r1 -auto
- <Package Folder>/files/.z/r1 <Package Folder>/files/.z/.x.sh
- <Package Folder>/files/.z/r2
- <Package Folder>/files/.z/r2 -c <Package Folder>/files/.z/.x.sh
- <Package Folder>/files/.z/r3
- <Package Folder>/files/.z/r3 -c <Package Folder>/files/.z/.x.sh
- <Package Folder>/files/.z/r4 -c <Package Folder>/files/.z/.x.sh
- <Package Folder>/files/.z/r4 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
- <Package Folder>/files/.z/r5 /system/bin/sh
- <Package Folder>/files/.z/r6 /system/bin/sh
- <Package Folder>/files/.z/r8
- <Package Folder>/files/.z/su2 HygZRm2IHTKWpp7Hll/sS0uY66xdcw== <Package Folder>/files/.z/.x.sh
- <Package Folder>/files/.z/su2 al1s7jBFNtn9faBmC0Jb9A9NslGZSg== <Package Folder>/files/.z/.x.sh
- <Package Folder>/files/.z/su2 f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== <Package Folder>/files/.z/.x.sh
- chmod 775 <Package Folder>/app_lib
- sh <Package Folder>/files/.z/r1 -auto
- sh <Package Folder>/files/.z/r3
- sh <Package Folder>/files/.z/r4 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
- sh <Package Folder>/files/.z/r5 /system/bin/sh
- sh <Package Folder>/files/.z/r6 /system/bin/sh
- sh <Package Folder>/files/.z/su2 al1s7jBFNtn9faBmC0Jb9A9NslGZSg== <Package Folder>/files/.z/.x.sh
Loads the following dynamic libraries:
- main
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES
- DES-CBC-PKCS5Padding
Gains access to information about installed applications.
