Technical information
Malicious functions:
Removes its shortcut from the home screen.
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml
Miscellaneous:
Executes next shell scripts:
- grep system
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2187 --user 0
- cp /data/app/<Package>-1.apk /system/app/<Package>-1.apk
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
- find /data/app -name <Package>*
- mount -o remount,rw -t yaffs2 /dev/block/sda1 /system
- <error:2>
- mount
- mount -o remount,ro -t yaffs2 /dev/block/sda1 /system
- ls -l /system/xbin/
- find /system/app -name <Package>*
- su
- cp <Package Folder>/lib/libkmcallrecorder.so /system/lib/
- sh
- ls -l /system/sbin/
- ls <Package Folder>/lib/
- chmod 644 /system/app/<Package>-1.apk
- rm /data/app/<Package>-1.apk
- chmod 644 /system/lib/libkmcallrecorder.so
- ls -l /system/bin/
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
