ANDROIDOS_HIPPOSMS.A
Premium Service Abuser, Malicious Downloader
Android OS
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This malware is able to send an SMS to a Chinese premium number. As a result, affected users are charged without their knowledge.
To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.
![](https://documents.trendmicro.com/images/androidos_hipposms_a.jpg)
This Trojan can be downloaded from third party Android app stores and targets Chinese users. It sends an SMS to a Chinese premium number.
This malicious application lets the user send a predefined message to his/her contacts. The link points to a remote copy of the malware. It also has the capability to send this same message to the premium number.
Itl then connects to a certain URL to receive an XML configuration file. The configuration file contains another URL where an updated copy of itself can be downloaded. This is also detected by Trend Micro as ANDROIDOS_HIPPOSMS.A.
This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.
TECHNICAL DETAILS
Arrival Details
This Trojan may be downloaded by other malware/grayware/spyware from remote sites.
It may be unknowingly downloaded by a user while visiting malicious websites.
NOTES:
This Trojan can be downloaded from third party Android app stores and targets Chinese users.
This malware sends an SMS to the number 1066156686, a Chinese premium number. As a result, affected users are charged without their knowledge. It then deletes the SMS if the number it comes from begins with "10". Since China service providers use numbers that starts with "10", affected users arel not be able to verify their account balances.
This malicious application lets the user send the following predefined message to his/her contacts:
看视频,上酷6,链接 http://{BLOCKED}wn.{BLOCKED}6.cn
The link points to a remote copy of the malware. It also has the capability to send this same message to the premium number 10086.
This message translates to the following:
"Watch the video, it's on ku6, link:http://{BLOCKED}wn.{BLOCKED}6.cn".
The malware then connects to the following URL to receive an XML configuration file:
- http://{BLOCKED}fo.{BLOCKED}6.cn/{BLOCKED}Request.htm?method=update&os=android&brand=ku6&sdkversion=1.5&clientversion=2.0.0&resolution=%7bscreen resolution}&serialnumber={IMEI}
The said configuration file contains another URL where an updated copy of this malware may be downloaded. As of this writing, the URL contained in the XML is the following:
- http://{BLOCKED}ms.{BLOCKED}6.com/{BLOCKED}ersion/Android_video_201_gen_f001.apk
The downloaded file is also detected as ANDROIDOS_HIPPOSMS.A.
SOLUTION
NOTES:
Trend Micro Mobile Security Solution
Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.
Download and install the Trend Micro Mobile Security App via the Android Market.
Remove unwanted apps on your Android mobile device
To remove unwanted apps on your mobile device:
- Go to Settings > Applications > Manage Applications.
- Locate the app to be removed.
- Scroll and highlight the app to be removed, then choose Uninstall.
Did this description help? Tell us how we did.