SHA1:
- 408f0c60578fead12197620e0011fe50d0504ac0
An Android Trojan. It is a program module which is downloaded to mobile devices and launched by a malicious module Android.RemoteCode.125.origin.
Once launched, Android.Click.221.origin establishes a connection with the command and control server located at http://t.**real.com and receives tasks. The tasks contain links to websites that Trojan must load. In addition, tasks also contain a link to download a JavaScript used to automatically communicate with a target website and its items.
Once the task is received, Android.Click.221.origin opens an invisible WebView and loads inside a website and a script that are indicated in a command. After that, using @JavascriptInterface, the Trojan allows the script to perform various actions with a loaded page, including simulation of user clicking on different items, such as links and banners.
