<\/a><\/p>\nWhat does the malware do?<\/p>\n
To summarize the malware’s goals, it fetches commands via HTTP GET from a remote C&C, and uploads information via HTTP POST. The command it recognizes are listed in the table below.<\/p>\n
0 Get Info Device<\/p>\n
1 Start Record<\/p>\n
2 Get Audio File<\/p>\n
3 Get Contact List<\/p>\n
4 Current Location<\/p>\n
5 Get Installed Apps<\/p>\n
6 Wifi Status<\/p>\n
7 Get all Pictures from Photo Library<\/p>\n
8 List a given directory<\/p>\n
9 Get a given file<\/p>\n
10 Get process list<\/p>\n
11 Get SMS<\/p>\n
The code shows a few interesting things:<\/p>\n