Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.7062
Removes app icon from the screen.
File system changes:
Creates the following files:
- /data/data/####/Preferences.xml
- /data/data/####/dexprotector.so
- /data/data/####/new.apk
- /data/media/####/.nomedia
Miscellaneous:
Loads the following dynamic libraries:
- dexprotector
Uses administrator priveleges.
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Parses information from SMS.
