ANDROIDOS_FINSPY.D

October 18, 2012
 Analysis by: Weichao Sun
 THREAT SUBTYPE:

Spying Tool

 PLATFORM:

Android OS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet

This Android malware is designed to steal users' SMS, contact list, call log, location information, and other phone informatio. It sends all gathered information to a remote server via an active Internet connection or via SMS.

This Trojan may be manually installed by a user.

  TECHNICAL DETAILS

File Size:

137,216 bytes

File Type:

APK

Memory Resident:

Yes

Initial Samples Received Date:

18 Sep 2012

Payload:

Steals information

Arrival Details

This Trojan may be manually installed by a user.

NOTES:

This Android malware may be downloaded and installed by a user manually. It may also be automatically installed by another malware.

After installation, it does not display any icon on the user's desktop. It also registesr a receiver to receive the system event {android.intent.action.BOOT_COMPLETED}. It does this routine to enable its automatic execution each time the system is started.

This malware starts several services to do the following:

  • Intercept and read received SMS
  • Connect to remote C&C server
  • Monitor SIM card
  • Record phone calls
  • Read contact list

The recorded information is stored in the following files:

  • cLogFile
  • smFile
  • conFile
  • SconFile

The said files can be uploaded or deleted, depending on the command sent from its C&C server tiger.{BLOCKED}national.de.

This Android malware downloads its configuration file from its C&C server. The configuration file can be changed via command SMS message. The message for changing the configuration file is distinguished by the first 32 bits of the message body, which is different from a common SMS message. The fist 32 bits of the SMS is 0x00840470 or 0x00843570.

It also sends messages via SMS or via TCP connection to steal user privacy data. The message it sends are triggered by the following events, which are all registered in the file AndroidManifest.xml:

  • Low battery
  • Low device space
  • Flight mode/Airplane mode enabled
  • Change of network
  • Change of location
  • Outgoing/incoming call detected

The following phone numbers are stored in the configuration file assets/Configurations/84C.dat, where the C&C server information is also stored:

  • +{BLOCKED}90978
  • +{BLOCKED}57409

  SOLUTION

Minimum Scan Engine:

9.200

TMMS Pattern File:

1.317.00

TMMS Pattern Date:

18 Sep 2012

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn More ]

Did this description help? Tell us how we did.