Technical information
Malicious functions:
Sets a lock screen password.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) 1####.217.17.78:443
DNS requests:
- ksn####.kaspers####.com
- ksn-cry####.kaspers####.com
- ksn-cry####.kaspers####.com
- ksn-cry####.kaspers####.com
- ksn-cry####.kaspers####.com
- ksn-cry####.kaspers####.com
- ksn-msk####.kaspers####.com
File system changes:
Creates the following files:
- /data/data/####/AndroidManifest.xml
- /data/data/####/Description.xml
- /data/data/####/android.kdc
- /data/data/####/android_x86.kdc
- /data/data/####/bases_index_file.dat.tmp
- /data/data/####/certificate.crt
- /data/data/####/customization_config.xml
- /data/data/####/customization_config_signature
- /data/data/####/eka_lock_KSN
- /data/data/####/events.dat
- /data/data/####/gaClientId
- /data/data/####/general.tmp
- /data/data/####/google_analytics_v2.db-journal
- /data/data/####/httpsca.jks
- /data/data/####/index
- /data/data/####/jquery-1.8.0.min.js
- /data/data/####/kms90.avc
- /data/data/####/ksn_client2.xms
- /data/data/####/ksn_helper.xms
- /data/data/####/ksn_uuid.dat
- /data/data/####/ksncliwin32keys.dat
- /data/data/####/ksnpstor.xml
- /data/data/####/libapk.so
- /data/data/####/libapk_x86.so
- /data/data/####/libdvm.so
- /data/data/####/libdvm_x86.so
- /data/data/####/libkavheur.kdl.so
- /data/data/####/libkavheur_x86.kdl.so
- /data/data/####/libkavsdk.so
- /data/data/####/libkavsdk_x86.so
- /data/data/####/libnh.so
- /data/data/####/libnh_x86.so
- /data/data/####/libpdm.so
- /data/data/####/libpdm_x86.so
- /data/data/####/mmh001.kdc
- /data/data/####/mmh001_x86.kdc
- /data/data/####/mmh002.kdc
- /data/data/####/mmh002_x86.kdc
- /data/data/####/mmheur.mft
- /data/data/####/mmheur_x86.mft
- /data/data/####/mmhlnk01.kdc
- /data/data/####/mmhlnk01_x86.kdc
- /data/data/####/newprefs.dat
- /data/data/####/pdm.cfg
- /data/data/####/pdm.jar
- /data/data/####/pdm.mft
- /data/data/####/pdm00.kdc
- /data/data/####/pdm00_x86.kdc
- /data/data/####/pdm_x86.cfg
- /data/data/####/pdm_x86.jar
- /data/data/####/pdm_x86.mft
- /data/data/####/pdme.cfg
- /data/data/####/pdme_x86.cfg
- /data/data/####/pw.j
- /data/data/####/pw_x86.j
- /data/data/####/rootdetector.jar
- /data/data/####/smh001.kdc
- /data/data/####/smh001_x86.kdc
- /data/data/####/smheur.mft
- /data/data/####/smheur_x86.mft
- /data/data/####/smm.dat
- /data/data/####/verdicts.ini
- /data/data/####/webview.db-journal
Miscellaneous:
Executes the following shell scripts:
- /data/app-lib/<Package>-1/libwd.so <Package Folder>/files/wd watchdog_started com.avsdk.LAUNCH 18
- app_process /system/bin com.android.commands.am.Am broadcast --user -3 -a watchdog_started -f 32
- chmod 775 /data/app-lib/<Package>-1/libwd.so
- logcat -c
- logcat -v brief
Loads the following dynamic libraries:
- app_services
- gnustl_shared
- kl_uuid
Uses the following algorithms to decrypt data:
- RSA
Uses administrator priveleges.
Accesses the ITelephony private interface.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about incoming/outgoing calls.
Gets information about sent/received SMS.