Analysis by: Kenny Ye
 THREAT SUBTYPE:

Information Stealer, Click Fraud, Spying Tool

 PLATFORM:

AndroidOS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan Spy

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

This Trojan Spy arrives via SMS messages.

  TECHNICAL DETAILS

File Size: 2377972 bytes
File Type: APK
Memory Resident: Yes
Initial Samples Received Date: 18 Mar 2019

Arrival Details

This Trojan Spy arrives via SMS messages.

NOTES:

FakeSpy is capable of stealing text messages, as well as account information, contacts, and call records stored in the infected device. FakeSpy can also serve as a vector for a banking trojan.

Once launched, FakeSpy will start monitoring for text messages that the affected device receives. These SMS messages are stolen and uploaded to the server. To send commands via JavaScript, FakeSpy also abuses JavaScript bridge (JavaScriptInterface) to invoke the app’s internal functions by downloading then running JavaScript from a remote website. FakeSpy’s commands include adding contacts to the device, setting it to mute, resetting the device, stealing stored SMS messages and device information, and updating its own configurations.

Apart from information theft, FakeSpy can also check for banking-related applications installed in the device. If they match FakeSpy’s apps of interest, they are replaced with counterfeit/repackaged versions that imitate the user interfaces (UI) of their legitimate counterparts. It phishes for the users’ accounts by ironically notifying users that they need to key in their credentials due to upgrades made on the app to address information leaks. It also warns users that their account will be locked. The stolen information is sent to the server once the users click on the login button. Besides online banking apps, it also checks for apps used for digital currencies trading and e-commerce.

  SOLUTION

Minimum Scan Engine: 9.850

Step 1

Remove unwanted apps on your Android mobile device

[ Learn More ]

Step 2

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android and iOS smartphones and tablets from malicious and Trojanized applications. It blocks access to malicious websites, increase device performance, and protects your mobile data. You may download the Trend Micro Mobile Security apps from the following sites:


Did this description help? Tell us how we did.