Technical information
Malicious functions:
Sends SMS:
- 13157121643: ении https://sberbank.ru/sms/
- 13157121643: 提示：设备已安装，等待激活
- 13157121643: 收到号码:<SMS Address>，短信内容:<SMS Content>
- 13157121643: 收到号码:<SMS Address>，短信内容:Баланс по карте ЕСМС9942: 9688.13р Подробнее в прилож
Executes code of the following detected threats:
- Android.SmsSpy.580.origin
Intercepts incoming SMS and terminates the process of their transmission to handlers of other apps.
File system changes:
Creates the following files:
- /data/data/####/.md5
- /data/data/####/.sec_version
- /data/data/####/classes.dex
- /data/data/####/classes.jar
- /data/data/####/container.apk
- /data/data/####/container.dex
- /data/data/####/container.pre_global_config
- /data/data/####/device_id.xml.xml
- /data/data/####/libsecexe.x86.so
- /data/data/####/libsecmain.x86.so
- /data/data/####/wi.rie.rnduieid.renjforodkddawn16431226bb1
- /data/data/####/wi.rie.rnduieid.renjforodkddawn16431226bb1.art
- /data/data/####/wi.rie.rnduieid.renjforodkddawn16431226bb1_preferences.xml
Miscellaneous:
Executes the following shell scripts:
- <Package> <Package> -1829491528 0 /data/app/<Package>-1.apk 41 <Package> 43 44
- <Package> <Package> -1829491528 0 /data/app/<Package>-1.apk 41 <Package> 46 47
- <Package> <Package> -1829491528 0 /data/app/<Package>-1.apk 41 <Package> 50 51
- <Package> <Package> -1829491528 0 /data/app/<Package>-1.apk 45 <Package> 54 55
- <Package> <Package> -1829491528 0 /data/app/<Package>-1.apk 46 <Package> 55 56
- <Package> <Package> -1836815176 0 /data/app/<Package>-1.apk 45 <Package> 54 55
- chmod 755 <Package Folder>/.cache/<Package>
- chmod 755 <Package Folder>/.cache/<Package>.art
- getprop ro.product.cpu.abi
Loads the following dynamic libraries:
- libsecexe.x86
Uses administrator priveleges.
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Displays its own windows over windows of other apps.
