ANDROIDOS_BGSERV.A

This Android OS backdoor has the increased potential for damage, propagation, or both, that it possesses. Specifically, it is a Trojanized version of the official Android Market Security Tool for Google, which is capable of manipulating SMS and connecting to a remote URL to send and receive information.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor is capable of gathering device information and monitoring SMS and calls. It may also download other files that could possibly be malicious.

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://www.{BLOCKED}g.com:81/Coop/request3.php

NOTES:

Other Details

Based on the analysis of its code, this backdoor has the following capabilities:

• Intercepts/monitors sent and received SMS
• Blocks SMS based on filters set by the remote attacker
• Sends SMS
• Intercepts calls
• Modifies call logs
• Downloads files
• Finds internet connections and status
• Changes network connectivity status
• Modifies Access Point Name
• Downloads videos from the following links:
  • http://{BLOCKED}1.{BLOCKED}6.165.53/adapted/choose.jsp?dest=all&chooseUrl=QQQwlQQQrmw1sQQQpp66.jsp
  • http://{BLOCKED}1.{BLOCKED}6.165.53/wl/rmw1s/pp66.jsp
• Gathers the following information about the infected device:
  • International Mobile Equipment Identity(IMEI)
  • Version
  • SMS center number
  • Phone number
  • Mobile Country Code
  • Mobile Network Code
  • Access Point Name
  • Internet connection status
• Keeps a log of the following about itself, which are then sent to a remote URL:
  • First run time
  • Install Time
  • Process ID
  • Server
  • Connection time
  • SMS and Call times
  • Video download links
  • Video download time
  • Video download count
  • Intercepted SMS
  • SMS block time
  • SMS block key
  • SMS block port
  • SMS count
  • Download URL

It is a Trojanized version of Google's Android Market Security Tool. The said tool is designed to clean the effects of another Trojanized application, which Trend Micro detects as ANDROIDOS_LOTOOR.A. The said tool is also capable of gathering device information and monitoring SMS and calls. It may also be used by remote attackers to intercept messages from the China Mobile hotline, 10086.