Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Droppers:
Downloaded by the following detected threats from the Web:
- Android.MobiDash.1
Modified file system:
Creates the following files:
- /data/data/####/app_app_apk/de.dat.jar
- /data/data/####/files/file
- /data/data/####/code_cache/secondary-dexes/MultiDex.lock
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/code_cache/secondary-dexes/tmp-####-1.apk.classes-1221402676.zip
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/settings.properties
- /data/data/####/shared_prefs/multidex.version.xml
Miscellaneous:
Executes next shell scripts:
- sh -c if busybox test -w /storage/emulated/legacy/Android/obb ;then exit 1;else exit 2;fi
- sh -c if busybox test -w / ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /data ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /mnt/secure ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /cache ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /system ;then exit 1;else exit 2;fi
- mount
- sh -c if busybox test -w /storage/emulated/0 ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /mnt ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /mnt/obb ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /dev ;then exit 1;else exit 2;fi
- busybox
- su -c echo 3 && exit 2
- sh -c if busybox test -w /mnt/asec ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /storage/emulated ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /storage/emulated/0/Android/obb ;then exit 1;else exit 2;fi
- sh -c if busybox test -w /storage/emulated/legacy ;then exit 1;else exit 2;fi
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
