Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Loki.48.origin
Modified file system:
Creates the following files:
- <Package Folder>/files/####/husky.tmp
- <Package Folder>/files/####/husky_10804.jar
- <Package Folder>/files/libexec.so
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/sdk_scl_pid_config.xml
- <SD-Card>/.googlev7/.libx2coas
- <SD-Card>/.salvia/<Package>
Miscellaneous:
Executes next shell scripts:
- getprop ro.product.cpu.abi
Loads the following dynamic libraries:
- libexec
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
