SHA1:
- 7ba8f6d347cb1ae326881739ed925452678029b8
- f1f7a65d921596953c43c513faf1a03fd4c70042
- f1f36cc93af4d3d738bad2e9c79e5e441a0406ca
- 9613d115e147b4dd1da9d4634da9a333ce6ce341
A Trojan for Android mobile devices. After its installation, the Trojan launches when an Android smartphone is turned on and also when the device’s screen is unlocked.
Android.DownLoader.515.origin is a module loader. It downloads from command and control server ov.****base.com additional program component DynMain.jar and injects it using DexClassLoader class. Thus, the Trojan can execute an arbitrary code obtained in the Internet.
Using sockets in Android.DownLoader.515.origin, the native binary protocol is implemented in order to communicate with the server.
Also. the Trojan can be embedded into the firmware of several Android devices and located in the system folder in the form of executable ODEX files. Such files of the malicious application are detected as Android.DownLoader.2141.
