Analysis by: Lorin Wu

 PLATFORM:

Android

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from the Internet

This XLoader variant poses as a security app for Android devices, and uses a malicious iOS profile to affect iPhone and iPad devices.

This Trojan may be downloaded by other malware/grayware from remote sites. It may be hosted on a website and run when a user accesses the said website.

It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

  TECHNICAL DETAILS

Payload: Connects to URLs/IPs

Arrival Details

This Trojan may be downloaded by the following malware/grayware from remote sites:

  • {BLOCKED}omo-qae.com
  • {BLOCKED}omo-qaq.com
  • {BLOCKED}omo-qar.com
  • {BLOCKED}omo-qat.com
  • {BLOCKED}omo-qaw.com

It may be hosted on a website and run when a user accesses the said website.

Information Theft

This Trojan attempts to steal information from the following banks and/or other financial institutions:

  • Japan Banks
  • Korea Banks

Mobile Malware Routine

This Trojan receives commands from the following C&C server(s):

  • {BLOCKED}.{BLOCKED}.{BLOCKED}5.70:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}2.193:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}0.17:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.59:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.173:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}56.217:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}56.217:28832
  • {BLOCKED}.{BLOCKED}.{BLOCKED}56.160:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}7.127:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}6.73:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}5.234:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}0.64:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}6.248:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}0.134:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.240:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}16.165:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}76.103:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}78.217:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}31.220:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}35.148:28833
  • {BLOCKED}.{BLOCKED}.{BLOCKED}14.60:28833

  SOLUTION

Minimum Scan Engine: 9.850

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android and iOS smartphones and tablets from malicious and Trojanized applications. It blocks access to malicious websites, increase device performance, and protects your mobile data. You may download the Trend Micro Mobile Security apps from the following sites:


Did this description help? Tell us how we did.