Analysis by: Yang Yang
 THREAT SUBTYPE:

Information Stealer, Spying Tool

 PLATFORM:

Android

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel: Via app stores, Downloaded from the Internet

This Trojan may be unknowingly downloaded by a user while visiting malicious websites. It may be manually installed by a user. It may be downloaded from app stores/third party app stores.

  TECHNICAL DETAILS

File Size: 1,282,767 bytes
File Type: APK
Memory Resident: Yes
Initial Samples Received Date: 21 Nov 2013
Payload: Steals information

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It may be manually installed by a user.

It may be downloaded from app stores/third party app stores.

Mobile Malware Routine

This Trojan sends out the following messages:

  • Target: +79262000900
    Content: ??????
  • Target: +79037672265
    Content: bal

NOTES:

This malware requires users to set it as Android device administrator when the app is launched:

Once it is launched, it runs in the background and monitors users' input. If it is found that Google Play is launched, it displays a window on top of the Google Play window, prompting the user to enter his/her bank card details:

All the data that users enters is immediately sent out.

  SOLUTION

Minimum Scan Engine: 9.700

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn More ]

Did this description help? Tell us how we did.