SHA1:
45e17cab5ea9d1c2865526d7ee8a692f70eb7456
A malicious program targeting Android devices. It is distributed in originally harmless games and applications modified by cybercriminals. The Trojan is a modification of Android.Backdoor.176.origin.
Once launched for the first time, Android.Backdoor.196.origin gathers information about the infected device and sends it to the command and control server. Then it starts monitoring a number of system events—for example, booting of the OS (BOOT_COMPLETED), unlocking of the screen, and so on.
When the device it turned on for the first time after it got infected, Android.Backdoor.196.origin tries to get root privileges using a modified version of Root Master. Then via a root terminal, the Trojan sets the “immutable” attribute for its own APK file. As a result, even if the user uninstalls the Trojan, once the system is rebooted, the malicious program will be reinstalled, and the mobile device will stay infected.
After that, using DexClassLoader, Android.Backdoor.196.origin launches its second component, detected as Adware.Xinyin.1.origin. Depending on the modification of the Trojan, this second component is either downloaded from a remote server or extracted from the Trojan’s body and then decrypted.
Once Adware.Xinyin.1.origin takes over control, it becomes responsible for performing all malicious activities. In particular, it can download and install various programs, send text messages, monitor incoming and outgoing calls and messages, and display advertisements. Moreover, it periodically checks for its own updates.
To receive commands and send various data to cybercriminals, the Trojan and its malicious module use several command and control servers.
The following servers are used to send data to cybercriminals:
- http://api.****.net;
- http://rs.****.net;
- http://rs.201****.com;
- http://rs.*****.com;
- http://rs.*****pk.com.
The following servers are used to receive text message parameters:
- http://pay.fast*****.com;
- http://base.fast*****.com.
The following servers are used to receive advertisement parameters:
- http://msg.aol****.com;
- http://msg.zol****.com.