The Trojan for Android mobile devices. Cybercriminals can incorporate this malware into modified popular programs as well as distribute it as a separate application. The key function of Android.Backdoor.159.origin is to install and remove applications without the user's knowledge.
The Trojan communicates with two command and control servers:
http://aps.[xxx]oge.net/
http://[xxxxx]wan.comWhen launched for the first time, Android.Backdoor.159.origin collects the following information about the infected device:
- IMEI
- IMSI
- Installed SD card
- Information about the device's total and free amount of internal and external memory
- The list of installed applications
Then, using the POST request, it sends the information to the server http://aps.[xxx]oge.net/. Every 24 hours, such data is updated and re-loaded onto the server.
In return, from the remote command center the malicious program gets controlling commands in JSON format (JavaScript Object Notation), that specify the list of installed applications to be removed (using the pm uninstall console command) as well as programs that must be installed (using the pm install -r console command).
