ANDROIDOS_SPAMSOLDIER.A

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

It uses common file icons to trick a user into thinking that the files are legitimate.

Arrival Details

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor uses common file icons to trick a user into thinking that the files are legitimate.

It searches for the following folders where it can drop/create files:

• /sdcard/duplicate.apk

Autostart Technique

This backdoor adds and runs the following services:

• com.example.smsmessaging.TestService

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}ldierz.com/

NOTES:

This Android malware does the following:

• Blocks response message from premium phone numbers
• Grabs target premium phone number and message text from the URL http://{BLOCKED}0ldierz.com/command.php?action=recv
• Sends SMS to target premium phone number