Analysis by: Weichao Sun


Information Stealer


Android OS


  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes


Infection Channel: Via app stores

This malware disguises itself as an app named Find and Call. It is a malicious app that uploads a user's phone book to a remote server and sends spammed SMS to the user's contact list.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This malware may arrive as a normal app from Google Play or the App Store.

This malware has the following capabilities:

  • Steal contacts data

  • Collect location information by default

  • Sends spammed SMS to the user's contact list

This malware has a brother build on iOS as well.


File Size: 519,168 bytes
File Type: APK
Initial Samples Received Date: 09 Jul 2012
Payload: Steals information


This malware may arrive as a normal app from Google Play or the App Store.

It may be manually installed by a user. After installation, it displays an icon as an app named Find & Call.

Upon installation, it asks for the following permissions:

It then asks for users' email addresses and passwords to search through the users' contacts. The Find friends in a phone book instruction on the app leads the malware to upload the users' phone numbers and email addresses. The email addresses and passwords are then sent to the remote server as plain text. This may be sniffed by attackers.

Click for larger view

The user's location information is also uploaded by default.

The app can be used normally, however, it uploads users' contact data to a server, http://{BLOCKED}

The information above is used to send spammed SMS by the remote server.


Minimum Scan Engine: 9.200
TMMS Pattern File: 1.275.00
TMMS Pattern Date: 13 Jul 2012

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn More ]

Did this description help? Tell us how we did.

Related Blog Entries

Related Malware