Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.397.origin
Modified file system:
Creates the following files:
- <Package Folder>/app_libs/0df
- <Package Folder>/app_libs/1df
- <Package Folder>/app_libs/df
- <Package Folder>/app_zip/classes.jar
- <Package Folder>/app_zip/libus.so
- <Package Folder>/files/0UE
- <Package Folder>/files/1UE
- <Package Folder>/files/UE
- <Package Folder>/libus.lock
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/virtual/####/0.xml
- <Package Folder>/virtual/####/base.apk
- <Package Folder>/virtual/####/device-info.ini
- <Package Folder>/virtual/####/package.ini
- <Package Folder>/virtual/####/packages.ini
- <Package Folder>/virtual/####/signature.ini
- <Package Folder>/virtual/####/uid-list.ini
- <Package Folder>/virtual/####/userlist.xml
- <Package Folder>/virtual/####/wifiMacAddress
Miscellaneous:
Loads the following dynamic libraries:
- dalvikhack
- libus
- va-native
Uses the following algorithms to decrypt data:
- AES
Displays its own windows over windows of other applications.
