Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.205.origin
- Android.DownLoader.456.origin
File system changes:
Creates the following files:
- /data/data/####/10043u0_a43.jar
- /data/data/####/29e7612017dcf694e.zip
- /data/data/####/a10043u0_a43.apk
- /data/data/####/aab.db
- /data/data/####/aab.db-journal
- /data/data/####/aabn.db
- /data/data/####/aabn.db-journal
- /data/data/####/abb.db
- /data/data/####/abb.db-journal
- /data/data/####/abbn.db
- /data/data/####/abbn.db-journal
- /data/data/####/admlib.xml
- /data/data/####/admlibn.xml
- /data/data/####/ash.db
- /data/data/####/ash.db-journal
- /data/data/####/comsh11.xml
- /data/data/####/liblocalcom.jds.test.so
- /data/data/####/liblocalcom.jds.test.so (deleted)
- /data/data/####/libtestpro.so
- /data/media/####/com.jds.test.ini
- /data/media/####/config.ini
- /data/media/####/journal
- /data/media/####/journal.tmp
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /system/build.prop
Loads the following dynamic libraries:
- libtestpro
Uses the following algorithms to encrypt data:
- DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
