Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.76.origin
Downloads the following detected threats from the Web:
- Android.HiddenAds.76.origin
Modified file system:
Creates the following files:
- /data/kingoRoot
- <Package Folder>/app_lddex/dekuyo.dex
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/logs.db
- <Package Folder>/databases/logs.db-journal
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/databases/sklead.dataBase
- <Package Folder>/databases/sklead.dataBase-journal
- <Package Folder>/databases/whitelist.sqlite
- <Package Folder>/databases/whitelist.sqlite-journal
- <Package Folder>/files/config
- <Package Folder>/files/gaClientId
- <Package Folder>/files/mylog
- <Package Folder>/files/supersu.cfg
- <Package Folder>/shared_prefs/KingoAnalyticsSharedPreferences.xml
- <Package Folder>/shared_prefs/KingoAnalyticsSharedPreferences.xml.bak (deleted)
- <Package Folder>/shared_prefs/SSPPrefe.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml (deleted)
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak (deleted)
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <SD-Card>/zxcvbn/dekuyo.jar
- <SD-Card>/zxcvbn/kohuyo.jar
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- <su-internal:request>
- <su-internal:result>
- chmod 600 <Package Folder>/files/supersu.cfg
- chmod 755 <Package Folder>/files/config
- chown 0.0 <Package Folder>/files/supersu.cfg
- chown 0:0 <Package Folder>/files/supersu.cfg
- chown root.root <Package Folder>/files/supersu.cfg
- chown root:root <Package Folder>/files/supersu.cfg
- rm -r /data/kingoRoot
- sh
- su
- sync
Uses elevated priveleges.
