Technical information
Malicious functions:
Removes its shortcut from the home screen.
Modified file system:
Creates the following files:
- /data/data/####/databases/x1
- /data/data/####/shared_prefs/PREF_NAME.xml
- /data/data/####/databases/x1-journal
Miscellaneous:
Executes next shell scripts:
- rm /system/app/SuperSU/SuperSU.apk
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
- chmod 755 /system/app/SuperSU/SuperSU.apk
- chmod 755 /system/app/SuperSU
- su
- sh
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2027 --user 0
- chmod 644 /system/app/####.apk
- mount -o remount,rw /system
- chmod 755 /system/app
- id
Uses elevated priveleges.
Uses administrator priveleges.
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
