Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.893.origin
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/0D5E524541.jar
- /data/data/####/0a50e0dce415e49fd400a6c1379684ea
- /data/data/####/358734d2b0014b2d674a586bb63e89fc
- /data/data/####/ccdx
- /data/data/####/fywdl2
- /data/data/####/no_notice.mp3
- /data/data/####/otto-v60.so
- /data/data/####/share_date.xml
Miscellaneous:
Executes the following shell scripts:
- <Package Folder>/files/.temp/fywdl2 <Package Folder>/files/.temp/hello2 am startservice --user 0 -a com.google.ACTION.service -n <Package>/org.tencent.fhtr.XhkvTttega
- chmod 777 <Package Folder>/files/.temp/otto-v60.so
- sh
- sh <Package Folder>/files/.temp/fywdl2 <Package Folder>/files/.temp/hello2 am startservice --user 0 -a com.google.ACTION.service -n <Package>/org.tencent.fhtr.XhkvTttega
Loads the following dynamic libraries:
- otto-v60
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
- RSA
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Gets information about installed apps.
Displays its own windows over windows of other apps.
