ANDROIDOS_HIPPOSMS.A

This malware is able to send an SMS to a Chinese premium number. As a result, affected users are charged without their knowledge.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan can be downloaded from third party Android app stores and targets Chinese users. It sends an SMS to a Chinese premium number.

This malicious application lets the user send a predefined message to his/her contacts. The link points to a remote copy of the malware. It also has the capability to send this same message to the premium number.

Itl then connects to a certain URL to receive an XML configuration file. The configuration file contains another URL where an updated copy of itself can be downloaded. This is also detected by Trend Micro as ANDROIDOS_HIPPOSMS.A.

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

NOTES:

This Trojan can be downloaded from third party Android app stores and targets Chinese users.

This malware sends an SMS to the number 1066156686, a Chinese premium number. As a result, affected users are charged without their knowledge. It then deletes the SMS if the number it comes from begins with "10". Since China service providers use numbers that starts with "10", affected users arel not be able to verify their account balances.

This malicious application lets the user send the following predefined message to his/her contacts:

看视频，上酷6，链接 http://{BLOCKED}wn.{BLOCKED}6.cn

The link points to a remote copy of the malware. It also has the capability to send this same message to the premium number 10086.

This message translates to the following:

"Watch the video, it's on ku6, link:http://{BLOCKED}wn.{BLOCKED}6.cn".

The malware then connects to the following URL to receive an XML configuration file:

• http://{BLOCKED}fo.{BLOCKED}6.cn/{BLOCKED}Request.htm?method=update&os=android&brand=ku6&sdkversion=1.5&clientversion=2.0.0&resolution=%7bscreen resolution}&serialnumber={IMEI}

The said configuration file contains another URL where an updated copy of this malware may be downloaded. As of this writing, the URL contained in the XML is the following:

• http://{BLOCKED}ms.{BLOCKED}6.com/{BLOCKED}ersion/Android_video_201_gen_f001.apk

The downloaded file is also detected as ANDROIDOS_HIPPOSMS.A.