Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.564.origin
File system changes:
Creates the following files:
- /data/data/####/ijiami_sp_decrypt
- /data/data/####/ijm_ifr.xml
- /data/data/####/libexec.so
- /data/data/####/libexecmain.so
- /data/data/####/multidex.version.xml
- /data/media/####/.nomedia
Miscellaneous:
Executes the following shell scripts:
- getprop ro.product.cpu.abi
- sh -c cat /proc/2168/wchan
- sh -c cat /proc/2258/wchan
- sh -c cat /proc/2355/wchan
- sh -c cat /proc/2438/wchan
- sh -c cat /proc/2522/wchan
- sh -c cat /proc/2616/wchan
- sh -c cat /proc/2700/wchan
- sh -c cat /proc/2763/wchan
- sh -c cat /proc/2826/wchan
- sh -c cat /proc/2899/wchan
- sh -c cat /proc/2984/wchan
- sh -c cat /proc/3076/wchan
- sh -c cat /proc/3161/wchan
- sh -c cat /proc/3234/wchan
- sh -c cat /proc/3306/wchan
- sh -c cat /proc/3392/wchan
- sh -c cat /proc/3484/wchan
- sh -c cat /proc/3557/wchan
- sh -c cat /proc/3649/wchan
- sh -c cat /proc/3742/wchan
- sh -c cat /proc/3825/wchan
- sh -c cat /proc/3888/wchan
- sh -c cat /proc/3953/wchan
- sh -c cat /proc/4016/wchan
- sh -c cat /proc/4108/wchan
- sh -c cat /proc/4203/wchan
- sh -c cat /proc/4275/wchan
Loads the following dynamic libraries:
- ijmDataDecryption
- libexec
- libexecmain
Uses special library to hide executable bytecode.
