ANDROIDOS_PJAP.A

This Android malware arrives bundled with modified applications that can be downloaded from unofficial Android Market websites.

This backdoor is capable of sending SMS, downloading other applications, adding bookmarks, and visiting URLs. It also gathers certain device information and sends it to a remote URL.

It saves a log of its activities in a file. It sends device information to a certain URL:

The malware receives commands from a certain URL. It receives and executes backdoor commands for the malicious user.

This malware automatically adds certain URLs to the phone's book marks. More URLs can be received and added by the malware when commanded.

The malware may also send SMS to premium numbers.

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

NOTES:
This Android malware arrives bundled with modified applications that can be downloaded from unofficial Android Market websites. This backdoor is capable of sending SMS, downloading other applications, adding bookmarks, and visiting URLs. It also gathers the following device information and sends it to a remote URL:

• IMEI
• IMSI
• Phone Number
• ICCID
• SIM serial number

• /sdcard/androidh.log

• log.{BLOCKED}d188.com:9033/window.log?id={paramaters}

• xml.{BLOCKED}d188.com:8118/push/androidxml/{paramaters}

• execMark - Add a bookmark
• execPush - send spam SMS, contents of message are controlled by the remote user.
• execSoft - install a new application
• execTanc - unknown command
• execXbox - visit a URL

• http://{BLOCKED}d.paojiao.cn
• http://{BLOCKED}2.{BLOCKED}o.cn
• http://{BLOCKED}g3.cn

• 10086
• 10010