Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.451.origin
Modified file system:
Creates the following files:
- /data/data/####/.platformcache/lib_main/libapmeplt.so
- /data/data/####/gameplugins/com.google.android.gms/PluginInfo/sigs/sig_0.key
- /data/data/####/.platformcache/lib/tmp.Wc2146
- /data/data/####/gameplugins/com.google.android.gsf/PluginInfo/apkInfo
- /data/data/####/gameplugins/com.google.android.gms/PluginInfo/apkInfo
- /sdcard/.####/game_res/verinfo.cfg
- /data/data/####/shared_prefs/srvtime.xml
- /data/data/####/.platformcache/lib_main/tmp.PE2177
- /data/data/####/.platformcache/lib/tmp.Ul2177
- /data/data/####/.platformcache/lib/tmp.rh2146
- /data/data/####/.platformcache/lib/tmp.wB2124
- /data/data/####/shared_prefs/platform.xml
- /data/data/####/.platformcache/lib_main/tmp.qY2177
- /data/data/####/.platformcache/lib_kxqpplatform/tmp504384716tmp
- /data/data/####/gameplugins/com.google.android.gsf.login/PluginInfo/apkInfo
- /data/data/####/.platformcache/lib_kxqpplatform/tmp45428265tmp
- /data/data/####/gameplugins/lb_packages
- /data/data/####/gameplugins/com.google.android.gsf/PluginInfo/sigs/sig_0.key
- /data/data/####/shared_prefs/platform.xml.bak
- /data/data/####/.platformcache/lib/libexecloader.so
- /data/data/####/shared_prefs/global_config.xml
- /data/data/####/.platformcache/kxqpplatform2.jar
- /data/data/####/gameplugins/lb_amcfg
- /data/data/####/gameplugins/com.google.android.gms/lib/libgames_rtmp_jni.so
- /data/data/####/.platformcache/lib_kxqpplatform/libzvmhelper.so
- /sdcard/.####/game_res/compVersion
- /data/data/####/.platformcache/lib_kxqpplatform/classes.dex
- /data/data/####/.platformcache/lib/libkxqpplatform.so
- /data/data/####/.platformcache/lib_kxqpplatform/libkxqpplatform.sinfo
- /data/data/####/gameplugins/com.google.android.gsf.login/PluginInfo/sigs/sig_0.key
- /data/data/####/.platformcache/main.jar
- /data/data/####/gameplugins/com.google.android.gms/lib/libAppDataSearch.so
- /data/data/####/.platformcache/kxqpplatform2.jar.lock
- /data/data/####/.platformcache/lib/tmp.PL2177
Sets the 'executable' attribute to the following files:
- /data/data/####/.platformcache/lib_main/libapmeplt.so
- /data/data/####/.platformcache/lib_main/tmp.PE2177
- /data/data/####/.platformcache/lib/libkxqpplatform.so
- /data/data/####/.platformcache/lib/libexecloader.so
- /data/data/####/.platformcache/main.jar
- /data/data/####/.platformcache/kxqpplatform2.jar
- /data/data/####/.platformcache/lib_kxqpplatform/libzvmhelper.so
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/.platformcache/main.jar
- chmod 755 /data/data/####/.platformcache/kxqpplatform2.jar
- /system/bin/sh -c ps
Contains functionality to send SMS messages automatically.