Technical Information
Malicious functions:
Substitutes application name for:
- n14PwfvAq8
Performs process tracing:
- <SAMPLE>
Injects data to the following processes:
- <SAMPLE>
Launches processes:
- /root/kingo sh -c getprop ro.product.brand
- /root/kingo sh -c getprop ro.product.manufacturer
- /root/kingo sh -c getprop ro.product.model
Performs operations with the file system:
Modifies file access rights:
- /root/busybox
- /root/kitty
Creates or modifies files:
- /root/busybox
- /root/kitty
- /acct/uid/0/tasks
Deletes files:
- /root/busybox
- /root/kitty
Other:
Collects OS information