Analysis by: Kathleen Notario
 THREAT SUBTYPE:

Information Stealer, Malicious Downloader

 PLATFORM:

Android OS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This is a DroidDreamLight variant. The DroidDreamLight family is known to show notifications as part of its social engineering routine. This is to trick the user into clicking on the notifications to download new a component, or update itself.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This is Trend Micro's detection for Trojanized Android applications. While the legitimate software runs, it silently executes malicious code in the background. The malware service "SystemConfService" runs when the device is booted or when it receives or makes a call. It then gathers certain information. It sends these information to remote servers.

This Trojan may be manually installed by a user.

  TECHNICAL DETAILS

File Size: 164,504 bytes
File Type: DEX
Memory Resident: Yes
Initial Samples Received Date: 09 Nov 2011
Payload: Steals information

Arrival Details

This Trojan may be manually installed by a user.

This malware arrives via the following means:

  • via Trojanized Android applications

NOTES:

This is Trend Micro's detection for Trojanized Android applications.

It arrives using the package name com.practical.share.

While the legitimate software runs, it silently executes malicious code in the background. The malware service "SystemConfService" runs when the device is booted or when it receives or makes a call. It then gathers the following information:

  • Device model
  • Language setting
  • Country
  • IMEI
  • IMSI
  • SDK Version
  • Installed app information

It sends these information to the following remote servers:

  • http://{BLOCKED}6.info/aztc.php
  • http://{BLOCKED}u.com/jtwd.php

Note that the said servers may vary depending on the data received from the servers once it is connected.

Based on the analysis of the codes, it also has the following routines:

Show any of the following notifications that may trick the user into downloading other malware:

  • Update - update the malware package
  • Download - download a file specified by the malware server
  • Market - view a package specified by the malware server in the Android Market
  • Web - view a URL specified by the malware server

  SOLUTION

Minimum Scan Engine: 9.200
TMMS Pattern File: 1.159.00
TMMS Pattern Date: 13 Nov 2011

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn More ]

Did this description help? Tell us how we did.