ANDROIDOS_EXPLOITSIGN.ISO

The malware exploits the Android Master Key vulnerability to install a backdoor.

This Trojan may be manually installed by a user.

Arrival Details

This Trojan may be manually installed by a user.

NOTES:

The malware may be downloaded from several unofficial app stores.

This application contains two .DEX files and AndroidManifest files to modify a normal application’s behavior without breaking its signature.

This malware launches automatically after device boot. After launching, this application gathers backdoor configuration information from the host {BLOCKED}.180.178:8088, then sends SMS message to several predefined phone number.

A service starts and runs in the backed to receive remote commands by SMS. The SMS message contains commands that are shown to the user.

According to the received commands, the malware uploads IMSI/IMEI/phone number to host {BLOCKED}.180.178 or send SMS message to the command sender.

This malware attempts to terminate antivirus service processes from “qihoo360” and “LBE”.

It reads contact list, which it uses to send a message downloaded from remote server. The said message prompts recipients to download and install another .APK file from http://{BLOCKED}.152.221/app/moji_3_0_3.apk.

It uploads the contact list to remote server.