Technical information
Malicious functions:
Removes app icon from the screen.
File system changes:
Creates the following files:
- /data/data/####/Setting_Info.xml
- /data/data/####/busybox
- /data/data/####/callhistory.json
- /data/data/####/contact.json
- /data/data/####/daemon
- /data/data/####/dirtree.zip
- /data/data/####/file
- /data/data/####/sms.json
- /data/data/####/xtech
- /data/data/####/xtech_app
Miscellaneous:
Executes the following shell scripts:
- chmod 777 <Package Folder>/files/busybox
- chmod 777 <Package Folder>/files/daemon
- chmod 777 <Package Folder>/files/xtech_app
- mount
- su -c id
Loads the following dynamic libraries:
- fstree
Uses elevated priveleges.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Gets information about incoming/outgoing calls.
Gets information about sent/received SMS.
Gets information about phone contacts.
