Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.218.origin
- Android.Triada.219.origin
Modified file system:
Creates the following files:
- /data/data/####/files/khagdo.so
- /data/data/####/files/1493731159605.apk
- /data/data/####/files/libs_data
- /data/data/####/shared_prefs/share_cache.pref.xml
- /data/data/####/files/1493731159606.apk
- /data/data/####/files/1493731159579.apk
- /data/data/####/files/awnvmi.apk
- /data/data/####/databases/su.sqlite
- /data/data/####/files/core_service
- /data/data/####/databases/su.sqlite-journal
- /sdcard/PluginLog/CrashLog/CrashLog_20170502131921_2092.log
- /data/data/####/files/1493731159583.apk
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 41 40 319848 /data/data/####/files/1493731159605.apk 1252625302 2112811678 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 41 40 319848 /data/data/####/files/1493731159583.apk 1252625302 2112811678 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 40 40 14036 /data/data/####/files/awnvmi.apk 1252625297 1558381525 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
- /system/bin/dexopt --dex 27 41 40 319848 /data/data/####/files/1493731159606.apk 1252625302 2112811678 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 41 40 319848 /data/data/####/files/1493731159579.apk 1252625302 2112811678 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
Contains functionality to send SMS messages automatically.
