Android.Hidden.3077

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Modified file system:

Creates the following files:

<Package Folder>/files/busybox
<Package Folder>/files/daemon
<Package Folder>/files/scandir
<Package Folder>/files/scandir_pie
<Package Folder>/files/xtech
<Package Folder>/files/xtech_app
<Package Folder>/shared_prefs/Setting_Info.xml
<Package Folder>/shared_prefs/Setting_Info.xml.bak

Miscellaneous:

Executes next shell scripts:

<error:2>
<su-internal:request>
<su-internal:result>
chmod 777 /data/data/com.assistant.system/files/busybox
chmod 777 /data/data/com.assistant.system/files/daemon
chmod 777 /data/data/com.assistant.system/files/scandir
chmod 777 /data/data/com.assistant.system/files/scandir_pie
chmod 777 /data/data/com.assistant.system/files/xtech_app
chmod 777 <Package Folder>/files/busybox
chmod 777 <Package Folder>/files/daemon
chmod 777 <Package Folder>/files/scandir
chmod 777 <Package Folder>/files/scandir_pie
chmod 777 <Package Folder>/files/xtech_app
id
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 39 -p1w 44 -p2r 47 -p2w 49
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 39 -p1w 45 -p2r 48 -p2w 50
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 39 -p1w 46 -p2r 48 -p2w 50
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 39 -p1w 53 -p2r 54 -p2w 55
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 40 -p1w 43 -p2r 45 -p2w 46
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 41 -p1w 43 -p2r 46 -p2w 47
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 41 -p1w 44 -p2r 46 -p2w 47
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 44 -p1w 45 -p2r 46 -p2w 47
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 44 -p1w 47 -p2r 49 -p2w 51
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 45 -p1w 46 -p2r 47 -p2w 48
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 45 -p1w 47 -p2r 48 -p2w 49
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 45 -p1w 47 -p2r 49 -p2w 50
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 46 -p1w 47 -p2r 48 -p2w 49
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 46 -p1w 48 -p2r 49 -p2w 50
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 47 -p1w 48 -p2r 49 -p2w 50
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 47 -p1w 49 -p2r 50 -p2w 51
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 48 -p1w 49 -p2r 50 -p2w 51
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 51 -p1w 52 -p2r 53 -p2w 54
sh <Package Folder>/files/daemon -p <Package> -s com.android.telephone.system.service.Service2 -p1r 52 -p1w 53 -p2r 54 -p2w 55
su -c id