arrow_back
search
close

ANDROIDOS_SMSREP.B

October 09, 2012
 Analysis by: KervinA
 THREAT SUBTYPE:

Information Stealer

 PLATFORM:

Android

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This Trojan may be manually installed by a user.

It steals certain information from the system and/or the user.

  TECHNICAL DETAILS

File Size:

19,865 bytes

File Type:

DEX

Memory Resident:

Yes

Arrival Details

This Trojan may be manually installed by a user.

Information Theft

This Trojan steals the following information:

  • Text message received
  • Sender's Phone Number
  • IMEI

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

  • http://{BLOCKED}rifty.com/security.jsp

NOTES:
Once installed, this malicious app is triggered when an infected phone receives a text message.

If a message is received, it then gets the following info from the message:

  • IMEI
  • message body
  • sender's phone number

It then sends the info to the following link:

  • http://{BLOCKED}rifty.com/security.jsp

It then blocks the received message so that the user will not be able to read it.

If the app is used it will display the following screen:

  SOLUTION

Minimum Scan Engine:

8.900

TMMS Pattern File:

1.105.00

TMMS Pattern Date:

13 Jun 2011

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn More ]

Did this description help? Tell us how we did.