Technical Information
Malicious functions:
Gains root privileges
Launches itself as a daemon
Launches processes:
- sh -c getprop ro.build.display.id
- getprop ro.build.display.id
Performs operations with the file system:
Modifies file access rights:
- /dev/socket/helperd_server.lockpid
- /proc/687/oom_adj
Creates folders:
- /socket
Creates or modifies files:
- /acct/uid/0/tasks
- /data/local/tmp/.tmpb911168570864
- /system/lib/testtemptest123
- /data/local/tmp/.tmpb913211203376
- /dev/socket/helperd_server.lock
- /dev/socket/helperd_server.lockpid
- /proc/687/oom_adj
Deletes files:
- /data/local/tmp/.tmpb911168570864
- /data/local/tmp/.tmpb913211203376
Locks files:
- /dev/socket/helperd_server.lock