Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- UDP 17497a####.im####.net:10801
DNS requests:
- 17497a####.im####.net
- mt####.go####.com
Modified file system:
Creates the following files:
- /data/system/adapi.ro
- <Package Folder>/databases/Phantom.db
- <Package Folder>/databases/Phantom.db-journal
- <Package Folder>/files/####/camera.CameraService_camera,screen_5_0.jar
- <Package Folder>/files/####/contact.ContactService_addList,msg,..._0.jar
- <Package Folder>/files/####/file.FileService_file,search_4_0.jar
- <Package Folder>/files/####/keyboard.MemoryCleanService_keybord_1_0.jar
- <Package Folder>/files/####/location.LocationService_locat,conL..._0.jar
- <Package Folder>/files/####/online.OnlineService_ask_2_1.jar
- <Package Folder>/files/####/radio.RadioService_record_1_0.jar
- <Package Folder>/files/####/task.TaskService,task.db.TaskConten..._1.jar
- <Package Folder>/files/####/update.UpdateService_plugins,redire..._0.jar
- <Package Folder>/files/####/wifi.WifiService_wifi,soft,progress..._0.jar
- <Package Folder>/shared_prefs/CorePublic.xml
- <Package Folder>/shared_prefs/onlineConfig.xml
- <SD-Card>/.log_api/core
- <SD-Card>/.log_api/task
- <SD-Card>/AndroidMedia/####/CorePublic
Miscellaneous:
Executes next shell scripts:
- su
Loads the following dynamic libraries:
- daemon_api20
Uses elevated priveleges.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
