Technical information
Malicious functions:
Sends SMS:
- 1101037597: Canary Apple Red:看看这是我整理出来的往日开心留念照 http://uee.me/aFFm4 【请珍藏】
- 1306278323: Bowler:看看这是我整理出来的往日开心留念照 http://uee.me/aFFm4 【请珍藏】
- 1457327443: Houston Rocket:看看这是我整理出来的往日开心留念照 http://uee.me/aFFm4 【请珍藏】
- 1564041011: Lope Lope:看看这是我整理出来的往日开心留念照 http://uee.me/aFFm4 【请珍藏】
- 1654517810: Flint Cast-Iron:看看这是我整理出来的往日开心留念照 http://uee.me/aFFm4 【请珍藏】
- 1743626668: Steel Cut Toe:看看这是我整理出来的往日开心留念照 http://uee.me/aFFm4 【请珍藏】
- 1756436145: Roadblock:看看这是我整理出来的往日开心留念照 http://uee.me/aFFm4 【请珍藏】
Intercepts incoming SMS and terminates the process of their transmission to handlers of other apps.
File system changes:
Creates the following files:
- /data/data/####/configurations_data.xml
- /data/data/####/libexec.so
Miscellaneous:
Executes the following shell scripts:
- getprop ro.product.cpu.abi
Loads the following dynamic libraries:
- libexec
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Parses information from SMS.
