Android.Backdoor.2160

Added to the Dr.Web virus database: 2019-03-03

Virus description added: 2019-03-03

Malicious functions:

Executes code of the following detected threats:

Accesses the ITelephony private interface.

Network activity:

Connects to:

DNS requests:

HTTP POST requests:

File system changes:

Creates the following files:

Miscellaneous:

Executes the following shell scripts:

<Package> <Package> -1829573864 0 /data/app/<Package>-1.apk 39 <Package> 46 47 1 0
<Package> <Package> -1829573864 0 /data/app/<Package>-1.apk 41 <Package> 43 44 1 0
<Package> <Package> -1829573864 0 /data/app/<Package>-1.apk 41 <Package> 46 47 1 0
<Package> <Package> -1829573864 0 /data/app/<Package>-1.apk 41 <Package> 52 53 1 0
<Package> <Package> -1829573864 0 /data/app/<Package>-1.apk 41 <Package> 53 54 1 0
<Package> <Package> -1829573864 0 /data/app/<Package>-1.apk 45 <Package> 57 58 1 0
<Package> <Package> -1829573864 0 /data/app/<Package>-1.apk 46 <Package> 58 59 1 0
<Package> <Package> -1836963048 0 /data/app/<Package>-1.apk 41 <Package> 46 47 1 0
chmod 755 <Package Folder>/.cache/<Package>
chmod 755 <Package Folder>/.cache/<Package>.art
chmod 755 <Package Folder>/.cache/<Package>.art.20
getprop ro.product.cpu.abi

Loads the following dynamic libraries:

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Parses information from SMS.