Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.236.origin
Modified file system:
Creates the following files:
- /data/data/####/CYCLE_PAY_PREF_NAME.xml
- /data/data/####/Plugin2.apk
- /data/data/####/cyclesdk.apk
- /data/data/####/lang_encrypt_dex.dex
Miscellaneous:
Loads the following dynamic libraries:
- bawan
- jilin
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Gains access to information about sent/received SMS messages.
