Analysis by: Maria Emreen Viray
 PLATFORM:

AndroidOS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  TECHNICAL DETAILS

File Size: 3,247 bytes
File Type: MP4
Memory Resident: No
Initial Samples Received Date: 17 Feb 2022

Other Details

This Trojan takes advantage of the following exploit(s):

  • CVE-2015-1538 is the Stagefright library vulnerability which was reported at 2015-02-06. This is an integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before

Mobile Malware Routine

This Trojan is capable of doing the following:

  • This is MP4 file. The file can be used to trigger the Android vulnerability CVE-2015-1538. Some Apps use such file to exploit user Android system, which allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication.
  • Attackers can trigger the vulnerability by sending MMS or WEB pages containing specially crafted media files such as MP4 file. The expected result of the exploit is to allow attacker to take pictures or listen to the microphone remotely without exploiting additional vulnerabilities.

NOTES:

Android MSDK Light Pattern version: 2.309.00

Date: 2022-02-25

  SOLUTION

Minimum Scan Engine: 9.800

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android and iOS smartphones and tablets from malicious and Trojanized applications. It blocks access to malicious websites, increase device performance, and protects your mobile data. You may download the Trend Micro Mobile Security apps from the following sites:


Did this description help? Tell us how we did.