Technical information
Malicious functions:
Sends SMS:
- 15804292439: <SMS Address>-><SMS Content>
- 15804292439: 拦截服务已启动,软件到期时间2999-01-01 00:00:00
- 15804292439: 短信拦截程序已安装,回复com#false关闭com#true开启, 版本18 <System Property>
Executes code of the following detected threats:
- Android.SmsSpy.7043
Removes app icon from the screen.
Intercepts incoming SMS and terminates the process of their transmission to handlers of other apps.
File system changes:
Creates the following files:
- /data/data/####/mycode.jar
Miscellaneous:
Loads the following dynamic libraries:
- StubShell
Uses the following algorithms to decrypt data:
- AES
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Parses information from SMS.
