SHA1 hashes:
- e2d7ed06169d254d9a26d298d8902b14181efa17
- ea6ffa539538b86b42344fb70e9476cda5dfbd94
Description
A trojan software designed to work on Android devices. Its main functionality is to covertly download and run other applications without user notice and consent.
Operating routine
Android.Mixi.36.origin can be located in the system partition of the Android operating system where it is installed by other malware or implanted by cyber criminal groups during the device manufacturing process. For example, one of the samples was found in the /system/priv-app/xzsdk.apk.
To covertly run the downloaded apps, the trojan calls the com.newcomb.ap.plink.GoPathMgr class and uses the Tool.SilentInstaller.7.origin tool that creates a virtual environment. In this environment, the applications can be launched without their installation and user notice.
