Technical Information
Malicious functions:
Substitutes application name for:
- n14PwfvAq8
Performs process tracing:
- <SAMPLE>
Injects data to the following processes:
- <SAMPLE>
Launches processes:
- sh -c getprop ro.product.brand
- sh -c getprop ro.product.manufacturer
- sh -c getprop ro.product.model
- sh -c /root/kitty 0 &
- sh -c /root/kitty 360 &
Performs operations with the file system:
Modifies file access rights:
- /root/busybox
- /root/kitty
Creates or modifies files:
- /root/busybox
- /root/kitty
- /acct/uid/0/tasks
Deletes files:
- /root/busybox"
- /root/kitty"
Other:
Collects OS information