Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 79####.####.la:11737
HTTP POST requests:
- 79####.####.la:11737/?!!!DSYB####
Modified file system:
Creates the following files:
- /data/data/####/contacts2.db
- /data/data/####/mmssms.db
- <Package Folder>/files/####/config.txt
- <Package Folder>/files/####/res.db-journal
- <Package Folder>/shared_prefs/<Package>.xml
Miscellaneous:
Executes next shell scripts:
- <su-internal:request>
- <su-internal:result>
- chmod 777 /data/data/com.lge.clock/files/app01
- chmod 777 /data/data/com.lge.clock/files/app02
- chmod 777 /data/data/com.lge.clock/files/app05
- chmod 777 /data/data/com.lge.clock/files/app05/SingleGps
- chmod 777 /data/data/com.lge.clock/files/ims
- chmod 777 <Package Folder>/files/app01
- chmod 777 <Package Folder>/files/app02
- chmod 777 <Package Folder>/files/app05
- chmod 777 <Package Folder>/files/app05/SingleGps
- chmod 777 <Package Folder>/files/ims
- logcat
- ls -l /data/data
- sh
- sqlite3 /data/data/com.android.providers.contacts/databases/contacts2.db select _id,number,duration,date,type from calls
- sqlite3 /data/data/com.android.providers.telephony/databases/mmssms.db select _id,address,date,type,replace(body,x'0a','') from sms order by date desc
- sqlite3 /data/data/com.android.providers.telephony/databases/mmssms.db select _id,address,date,type,replace(body,x'0a','') from sms
- su
Uses elevated priveleges.
