Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.397.origin
Gains access to the ITelephony private interface.
Modified file system:
Creates the following files:
- <Package Folder>/app_libs/0dBG
- <Package Folder>/app_libs/1dBG
- <Package Folder>/app_libs/dBG
- <Package Folder>/app_zip/classes.jar
- <Package Folder>/app_zip/libus.so
- <Package Folder>/files/0W
- <Package Folder>/files/1W
- <Package Folder>/files/W
- <Package Folder>/libus.lock
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/virtual/####/0.xml
- <Package Folder>/virtual/####/base.apk
- <Package Folder>/virtual/####/data@app@com.klsm.comss-1@base.ap...es.dex
- <Package Folder>/virtual/####/device-info.ini
- <Package Folder>/virtual/####/package.ini
- <Package Folder>/virtual/####/packages.ini
- <Package Folder>/virtual/####/signature.ini
- <Package Folder>/virtual/####/uid-list.ini
- <Package Folder>/virtual/####/userlist.xml
- <Package Folder>/virtual/####/wifiMacAddress
Miscellaneous:
Loads the following dynamic libraries:
- libus
- va++
Uses the following algorithms to decrypt data:
- AES
Displays its own windows over windows of other applications.
