Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.125
- Android.DownLoader.554.origin
Gains access to the ITelephony private interface.
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- <Package Folder>/app_dex/app_test.dex (deleted)
- <Package Folder>/app_dex/cjl.dex
- <Package Folder>/app_dex/iyup.dex
- <Package Folder>/app_dex/wo.dex
- <Package Folder>/files/####/aa
- <Package Folder>/files/####/msdcsuto.jar
- <Package Folder>/files/app_test.apk
- <Package Folder>/files/cjl.jar
- <Package Folder>/files/cnm.apk
- <Package Folder>/files/fjlo
- <Package Folder>/files/iyup.jar
- <Package Folder>/files/lamr
- <Package Folder>/files/lkie
- <Package Folder>/files/nhl.jar
- <Package Folder>/files/qwcs
- <Package Folder>/files/wo.jar
- <Package Folder>/shared_prefs/cds.xml
- <Package Folder>/shared_prefs/isPower.xml
- <SD-Card>/unfox/####/log.txt
Miscellaneous:
Loads the following dynamic libraries:
- cocos2dcpp
- frog
Gains access to geolocation.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
