So, there is new piece of Android malware which steals incoming SMS messages and uploads them to the remote server. All these domains were found in our ZeuS C&C database. For example, favoritopi*****.com, akteriak*****.com, basepol*****.com or justdongwf3*****.info. you will find out that there are more domains which were registered back in 2011 using the same fake data. Yes, it’s fake data but if you continue to google for e.g. But here is what you get when you whois the last C&C domain: If you try to ‘whois’ the first 5 domains you won’t find a lot of interesting or useful information. We found 6 different C&Cs in these APK files. But there was a feeling that there was something more behind these files.
Let’s be honest, such functionality (the ability to receive and execute commands and the ability to steal SMS messages) is not that new for mobile (Android) malware. It is also important to mention that these malicious apps are able to receive commands for uninstalling themselves, stealing system information and enabling/disabling the malicious applications. If the application is launched it will show a generated ‘activation code’: So there are at least 6 files which pretend to be ‘Android Security Suite Premium’ but in fact were created only for stealing incoming SMS messages.Īfter the infection there is a blue shield icon in the menu with the name ‘Android Security Suite Premium’: We found 3 more APK files with exactly the same functionality on 8th, 13th and 14th of June. SMS messages will be uploaded to a remote server whose URL is encrypted and stored inside the body of the Trojan. All these applications are malicious and were created to steal incoming SMS messages from infected devices. Premium Unlocked – You can use all the premium features of the app completely free.On the 4th of June 2012 we found 3 APK files of ~207 kb in size each heuristically detected by our engine as HEUR. The MOD version of Kaspersky Security comes with the following feature: It is to ensure that your data is never exposed to the internet with your real IP. It also has the kill switch feature that turns off the internet for all apps whenever VPN disconnects, reconnects or you change VPN servers. You can use them to hide your real IP address, secure your online activities, and access geo-restricted content. It also has a built-in VPN that includes 70+ different location servers. You can set it to try to fix the infected file, send it in the quarantine or delete it. Additionally, you can set the action the app will take on virus detection. With it on, it will automatically scan the new files & apps. Also, you can turn on real-time protection for more protection against viruses. Using the folder scan mode, you can scan only a certain folder. Quick scan mode scans all the installed apps in your device and full scan mode scans your entire device for malware & viruses. It comes with three scan modes – Quick Scan, Full Scan, and Folder Scan.
0 kommentar(er)
