Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 1####.####.82:7080
- 1####.####.82
HTTP POST requests:
- 1####.####.82:7080/active.do?type=####
- 1####.####.82/active.do?type=####&token=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/data.jar
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/setting.prop
Miscellaneous:
Executes next shell scripts:
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket1841 --user 0
- /system/bin/dexopt --dex 27 40 40 1168588 /data/data/####/files/data.jar 1250654801 -504919055 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- su
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
