Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.MoqHao.1.origin
File system changes:
Creates the following files:
- /data/data/####/1.jpg
- /data/data/####/app_icons.db-journal
- /data/data/####/app_stats.xml
- /data/data/####/b
- /data/data/####/b.cur.prof
- /data/data/####/com.android.launcher3.device.prefs.xml
- /data/data/####/com.android.launcher3.managedusers.prefs.xml
- /data/data/####/com.android.launcher3.prefs.xml
- /data/data/####/downgrade_schema.json
- /data/data/####/launcher.db-journal
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/widgetpreviews.db-journal
- /data/misc/####/primary.prof
- /databases/app_icons.db
- /databases/launcher.db
- /databases/widgetpreviews.db
Miscellaneous:
Loads the following dynamic libraries:
- libtjlooyj
Gets information about installed apps.
Displays its own windows over windows of other apps.
Contains hidden alternative main activities.
