SHA1: 01ac95ebeafc6cda9d385dcf775b81de5a2326f6
The component of the Android.CoinMine.15 worm designed to mine the Monero (XMR) cryptocurrency on an infected Android device. The Trojan is implemented as the invoke.sh script, which contains functions for installation to the autorun of a malicious program.
It deletes other malicious files:
clear_badguys() {
rm -rf $CUR_PATH/1.bin
rm -rf $CUR_PATH/7.bin
rm -rf $CUR_PATH/ak.bin
rm -rf $CUR_PATH/ip.dat
rm -rf $CUR_PATH/Test.apk
pm uninstall com.example.test
}It then remounts the “/”, “/data”, “/system” folders with read/write permissions. Following this, it modifies the files with its own scripts:
/system/bin/install-recovery.sh
/system/bin/ddexe
/system/bin/debuggerd
/system/bin/debuggerd64
The Trojan saves the original file adding the prefix “_real” to the file name for all the files except for install_recovery.sh. The script then installs and launches droidbot.apk, after which it clears the temporary folder. The script launched from the /system/bin/ folder tracks the status of the droidbot process and runs it in case it is not running. It also installs malicious apk again if the application was uninstalled.