Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MulDrop.1256
File system changes:
Creates the following files:
- /data/data/####/0pJhOLEili3Qqzge7ZiLKgu8PLnc86SD.dex
- /data/data/####/WL7OOKr6y832pdasbnc1gu9TDwDqQIl0.dex
- /data/data/####/ۦۖ۫
- /data/data/####/ۦۖ۫.
Miscellaneous:
Executes the following shell scripts:
- /system/bin/su
- rm -r/data/user/0/<Package>/app_ded/0pJhOLEili3Qqzge7ZiLKgu8PLnc86SD.dex
- rm -r/data/user/0/<Package>/app_ded/WL7OOKr6y832pdasbnc1gu9TDwDqQIl0.dex
Loads the following dynamic libraries:
- libnp_protect_res
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
