Technical information
Malicious functions:
Removes its shortcut from the home screen.
Modified file system:
Creates the following files:
- /data/data/####/files/libnesec.so
- /data/data/####/.cache/version
- /data/data/####/shared_prefs/####.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_push_lib/plugin-deploy.jar
- /sdcard/androidsystem.Log
- /data/data/####/databases/####
- /data/data/####/shared_prefs/####.push_sync.xml
- /data/data/####/shared_prefs/pst.xml
- /data/data/####/databases/####-journal
- /data/data/####/files/sec.lck
- /system/bin/zlsu
- /data/data/####/zlsu
- /data/data/####/app_push_lib/plugin-deploy.key
Sets the 'executable' attribute to the following files:
- /system/bin/zlsu
Miscellaneous:
Executes next shell scripts:
- toolbox cp /data/data/####/zlsu /system/bin/zlsu
- zlsu -c exit
- chmod 4755 /system/bin/zlsu
- chown 0:0 /system/bin/zlsu
- /system/bin/dexopt --dex 27 50 40 454092 /data/data/####/app_push_lib/plugin-deploy.jar 1193512231 1160669913 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system
- su
- mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
- sh
- busybox cp /data/data/####/zlsu /system/bin/zlsu
- chmod 777 /system/bin
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2251 --user 0
- sh /system/bin/zlsu -c exit
- cp /data/data/####/zlsu /system/bin/zlsu
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
