Technical Information
Malicious functions:
Gains root privileges
Launches itself as a daemon
Launches processes:
- sh -c getprop ro.build.display.id
- getprop ro.build.display.id
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
- /dev/socket/helperd_server.lockpid
- /proc/690/oom_adj
Creates folders:
- /socket
Creates or modifies files:
- /acct/uid/0/tasks
- /data/local/tmp/.tmpb696942502466
- /system/lib/testtemptest123
- /data/local/tmp/.tmpb691878089592
- /dev/socket/helperd_server.lock
- /dev/socket/helperd_server.lockpid
- /proc/690/oom_adj
Deletes files:
- /data/local/tmp/.tmpb696942502466"
- /data/local/tmp/.tmpb691878089592"
Locks files:
- /dev/socket/helperd_server.lock