arrow_back
search
close

ANDROIDOS_FAKENOTIFY.A

February 06, 2012
 ALIASES:

Trojan:AndroidOS/FakeNotify.A (Microsoft); Trojan:Android/FakeNotify.A!mfb (Fsecure); Andr/FakeNtfy-A (Sophos)

 THREAT SUBTYPE:

Premium Service Abuser

 PLATFORM:

Android OS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW


This Trojan targets the Android platform and lures users into downloading apps from a fake Android Market.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

Upon execution, this Trojan displays text in Russian that translates to "Do you agree with the terms of the download WhatsApp Messenger. To continue the download, then click Next."

Note that the application WhatsApp Messenger is the application downloaded from the malicious site. The application name may vary depending on the application downloaded by the user

This Trojan may be manually installed by a user.

  TECHNICAL DETAILS

File Size:

40,276 bytes

File Type:

DEX

Memory Resident:

No

Initial Samples Received Date:

10 Jan 2012

Payload:

Sends messages

Arrival Details

This Trojan may be downloaded from the following remote sites:

  • http://{BLOCKED}dxmarket.net

It may be manually installed by a user.

NOTES:

Below is a screenshot of the fake Android Market.

Upon execution, it displays the following:

The text displayed is in Russian and translates as "Do you agree with the terms of the download WhatsApp Messenger. To continue the download, then click Next."

Note that the application WhatsApp Messenger is the application downloaded from the malicious site. The application name may vary depending on the application downloaded by the user. If users click Next, the following is displayed:

The text translates as "Thank you for activation! Link to your file: http://{BLOCKED}d-market-mobile.com/download/index.php"

The following is then displayed, which is a list of other applications that can be downloaded:

While running, it sends text messages to any of the following premium-rate numbers which may result to unnecessary high phone charges:

  • 5014
  • 7781
  • 9013
  • 9014
  • 1121
  • 0900666266
  • 9684
  • 9685
  • 9683
  • 4129
  • 4128
  • 4127
  • 4126
  • 7151
  • 9151
  • 2855
  • 3858
  • 19998866
  • 6566
  • 1916
  • 9090150
  • 9090199
  • 80888
  • 1945
  • 17011
  • 17012
  • 17013
  • 17010
  • 5339
  • 81015
  • 81221
  • 69067
  • 79067
  • 8014
  • 57977
  • 4157
  • 4156
  • 4153
  • 4152
  • 4545
  • 1381
  • 1391
  • 1635
  • 1645
  • 1871
  • 1872
  • 1873
  • 1874
  • 5040
  • 2322
  • 79866
  • 92525
  • 69991
  • 68305
  • 83111
  • 55886
  • 1161
  • 1171

  SOLUTION

Minimum Scan Engine:

9.200

TMMS Pattern File:

1.177.00

TMMS Pattern Date:

10 Jan 2012

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn More ]

Did this description help? Tell us how we did.