ANDROIDOS_DNSTMPER.A

December 30, 2016
 Analysis by: Kenny Ye
 PLATFORM:

Android

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan guesses the password of TP-LINK router's administrator account. If it succeeds, it simulates the browser's behavior to change the router's DNS to its rogue server . Because normally Wi-Fi routers make the devices connected to it use the same DNS setting as its own, all devices in the network are effectively hijacked. with this change.

  TECHNICAL DETAILS

File Size:

1,006,255 bytes

File Type:

APK

Memory Resident:

Yes

Payload:

Changes DNS settings

NOTES:

This Trojan guesses the password of TP-LINK router's administrator account. If it succeeds, it simulates the browser's behavior to change the router's DNS to its rogue server . Because normally Wi-Fi routers make the devices connected to it use the same DNS setting as its own, all devices in the network are effectively hijacked. with this change.

The rogue DNS servers are:

  • {BLOCKED}.{BLOCKED}.147.153
  • {BLOCKED}.{BLOCKED}.13.11
  • {BLOCKED}.{BLOCKED}.249.59