Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsBot.604.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- pa####.####.sg:8897
- pa####.####.sg
HTTP POST requests:
- pa####.####.sg/hwSdk/sms/getSms.json
- pa####.####.sg/hwSdk/wf/getCtl.json
- pa####.####.sg:8897/hwSdk/wf/getCtl.json
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_dex/bind.dex
- /data/data/####/files/bind.dex
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 40 40 51008 /data/data/####/files/bind.dex 1493299016 892682306 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- /system/bin/dexopt --dex 27 40 40 51008 /data/data/####/files/bind.dex 1493299014 892682306 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
Contains functionality to send SMS messages automatically.
