Analysis by: KervinA
 THREAT SUBTYPE:

Information Stealer

 PLATFORM:

Android OS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This backdoor may be manually installed by a user.

It connects to a website to send and receive information.

  TECHNICAL DETAILS

File Size: 510,779 bytes
File Type: DEX
Memory Resident: Yes
Initial Samples Received Date: 16 May 2011
Payload: Compromises system security, Connects to URLs/IPs, Drops files

Arrival Details

This backdoor may be manually installed by a user.

Installation

This backdoor drops and executes the following files:

  • /data/data/app.BatteryMonitor/files/testnew.apk - install SMSHider

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

  • http://{BLOCKED}r.{BLOCKED}v.com
  • http://{BLOCKED}1.{BLOCKED}v.com
  • http://{BLOCKED}0.{BLOCKED}.0.122:80

Other Details

This backdoor drops the following file(s)/component(s):

  • /data/data/j.SMSHider/databases/commands
  • /data/data/j.SMSHider/shared_prefs/MainServicePrefs.xml

NOTES:
Once connected, This Trojan steals the following information:

  • Phone number
  • IMEI
  • IMSI
  • Phone Model
  • Phone's SDK version
  • Malware's version number
A remote user can remotely send commands which can exhibit the following behaviors:
  • Send text messsages including Premium Numbers
  • Delete message responses from phone numbers which starts at 106, an indication that it targets China Mobile users
  • Start its service
  • Install other packages
  • update its copy

  SOLUTION

Minimum Scan Engine: 8.900
TMMS Pattern File: 1.105.00
TMMS Pattern Date: 13 Jun 2011

NOTES:

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via the Android Market.

Remove unwanted apps on your Android mobile device

To remove unwanted apps on your mobile device:

  1. Go to Settings > Applications > Manage Applications.
  2. Locate the app to be removed.
  3. Scroll and highlight the app to be removed, then choose Uninstall.


Did this description help? Tell us how we did.