Technical information
Malicious functions:
Removes its shortcut from the home screen.
Modified file system:
Creates the following files:
- /data/data/####/daemon
- /data/data/####/webConfig.xml
- /data/media/####/debug
- /data/media/####/fuckyou
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/sh
- <Package Folder>/app_bin/daemon <Package> <Package>.SpyService 60000
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/<Package>.SpyService
- cat /sys/class/net/wlan0/address
- chmod 755 <Package Folder>/app_bin/daemon
- sh
- su
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Uses elevated priveleges.
Gains access to interfaces of audio/video data writing.
Writes audio/video data.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
