Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.240.origin
Modified file system:
Creates the following files:
- /data/data/####/app_cache/mycode.jar
Miscellaneous:
Executes next shell scripts:
- mv /data/app/####-2.apk /system/app/
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2026 --user 0
- chmod 644 /system/app/####-1.apk
- rm /data/app/####-2.apk
- mount -o rw,remount /systemmount -o rw,remount /system/apprm /data/app/####-1.apk
- su
- sh
- chmod 644 /system/app/####-2.apk
- mount -o remount,ro -t yaffs2 /dev/block/mtdblock3 /system
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
- /system/bin/dexopt --dex 27 44 40 44936 /data/data/####/app_cache/mycode.jar 1244339159 1352087331 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
