Technical information
Malicious functions:
Removes its shortcut from the home screen.
Modified file system:
Creates the following files:
- <Package Folder>/app_bin/su
- <Package Folder>/app_asset/busybox_g1
- <Package Folder>/files/droid1.png
- <Package Folder>/app_asset/splash64
- <Package Folder>/app_asset/droid1.png
- <Package Folder>/app_asset/splash
- <Package Folder>/app_bin/toor.sh
- <Package Folder>/shared_prefs/preferences.xml
- <Package Folder>/databases/android_tool.db-journal
- <Package Folder>/app_asset/logo.png
- <Package Folder>/files/daemon.sh
- <Package Folder>/app_asset/help4.png
- <Package Folder>/app_bin/busybox_g1
- <Package Folder>/shared_prefs/preferences.xml.bak
- <Package Folder>/app_bin/logo.png
- <Package Folder>/files/daemon.r
- <Package Folder>/app_asset/help4.png64
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/files/daemon.sh
- ps
- sh -c chmod 755 /data/data/####/app_bin/busybox_g1;chmod 755 /data/data/####/app_bin/toor.sh
- sh -c echo -n > /data/data/####/files/daemon.r;chmod 755 /data/data/####/files/daemon.sh;/data/data/####/files/daemon.sh &
- getprop ro.build.version.release
- sh -c chmod 777 <Package Folder>/app_bin/logo.png;<Package Folder>/app_bin/logo.png zPvKqEBtJGYU9RUdLNe1UxbpMe+y3w== /system/bin/sh <Package Folder>/app_bin/toor.sh
- chmod 755 <Package Folder>/app_bin/busybox_g1
- chmod 755 <Package Folder>/app_bin/toor.sh
- sh -c echo -n > <Package Folder>/files/daemon.r;chmod 755 <Package Folder>/files/daemon.sh;<Package Folder>/files/daemon.sh &
- sh -c chmod 755 <Package Folder>/app_bin/busybox_g1;chmod 755 <Package Folder>/app_bin/toor.sh
- sh -c chmod 777 /data/data/####/app_bin/logo.png;/data/data/####/app_bin/logo.png zPvKqEBtJGYU9RUdLNe1UxbpMe+y3w== /system/bin/sh /data/data/####/app_bin/toor.sh
- /system/bin/sh <Package Folder>/files/daemon.sh
- chmod 777 <Package Folder>/app_bin/logo.png
- <dexopt>
Contains functionality to send SMS messages automatically.
