ANDROIDOS_ANDFRASPY.HAT
THREAT SUBTYPE:
Spying Tool
PLATFORM:
AndroidOS
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:
Threat Type: Spyware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
Infection Channel:
Via app stores
This spyware may be downloaded from app stores/third party app stores.
TECHNICAL DETAILS
File Size:
166,917 bytes
File Type:
APK
Memory Resident:
Yes
Initial Samples Received Date:
26 Jan 2014
Payload:
Connects to URLs/IPs
Arrival Details
This spyware may be downloaded from app stores/third party app stores.
NOTES:
This malware can hijack the power button of an Android smartphone. After pressing the power button and the screen shutdown, it can do any of the following:
- Wait for the remote control (20150225153259.png)
- Send private messages, send SMS, and delete incoming SMS (20150225154057.png)
- Monitor or block the incoming calls, and send the record to remote server (20150225153836.png)
- Send GPS locations to remote server (20150225153655.png)
- Send the file list to remote server
- Delete and add APN
The remote server lists are:
- {BLOCKED}.{BLOCKED}.208.163:6565
- {BLOCKED}.{BLOCKED}.208.163:6365
- helloworld00.{BLOCKED}2.org:6365
- androidupdate.{BLOCKED}0.org:6565
- helloworld0*.{BLOCKED}2.org:6565
SOLUTION
Minimum Scan Engine:
9.700
Remove unwanted apps on your Android mobile device
[ Learn More ]
Did this description help? Tell us how we did.