Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.613.origin
Accesses the ITelephony private interface.
File system changes:
Creates the following files:
- /data/data/####/.fb
- /data/data/####/.fb-journal
- /data/data/####/onib_clz.jar
- /data/data/####/pz_sharedpre_cmreaderlogininfo.xml
Miscellaneous:
Executes the following shell scripts:
- cat /sys/class/net/wlan0/address
Gets information about location.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about sent/received SMS.
