Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.CaPson.1.origin
File system changes:
Creates the following files:
- /data/data/####/11
- /data/data/####/data@data@com.UWSRTiNwd.cWsLXCFuD@files@res@yy1...es.dex
- /data/data/####/data@data@com.UWSRTiNwd.cWsLXCFuD@files@seed_ap...es.dex
- /data/data/####/exec_history_v2.db
- /data/data/####/first.xml
- /data/data/####/greenbean
- /data/data/####/honeybee
- /data/data/####/kymjs_music_db-journal
- /data/data/####/logo.jpg
- /data/data/####/s2
- /data/data/####/seed.jar
- /data/data/####/seed_app.dex
- /data/data/####/seed_app.jar
- /data/data/####/seedapp.lck
- /data/data/####/setting.xml
- /data/data/####/tmp
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/user_info.db
- /data/data/####/yy1
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh
- app_process <Package Folder>/files com.core.seed.App FilesDir=<Package Folder>/files DataDir=<Package Folder> PackageName=<Package> Tag=ShKangLTPNN01_S9_CT PackageCodePath=/data/app/<Package>-1.apk CacheDir=<Package Folder>/cache
- app_process <Package Folder>/files com.tj.yy.App <Package Folder>/files <Package Folder>/files/res/logo.jpg --setup 1 ShKangLTPNN01_S9_CT
- getprop
- ls -l /dev/
Loads the following dynamic libraries:
- 11
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
