A Trojan for Android implemented as an advertising SDK (Software Development Kit) platform. It is incorporated into software that can be distributed via various app stores including Google Play.
Once such-like program is launched, Android.Spy.305.origin connects to the http://client.api-*******.com server and sends the following request:
The server replies with URL needed to download an additional component (Android.Spy.306.origin) which is responsible for the Trojan’s main malicious activity that Android.Spy.305.origin performs using the DexClassLoader class.
Then the Trojan sends the following data to the command and control server:
- Email address connected to Google user account
- List of installed applications
- Current system language
- By the device’s manufacturer
- Mobile device model
- IMEI identifier
- OS version
- Screen resolution
- Mobile network operator
- Name of the application containing the Trojan
- Developer’s ID
- SDK platform’s version
Android.Spy.305.origin can display advertisements on top of running applications and the operation system’s interface. It can also shows ads in the status bar.