Analysis by: V.E.O Zhang
 THREAT SUBTYPE:

Information Stealer, Click Fraud, Spying Tool

 PLATFORM:

Android OS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  TECHNICAL DETAILS

File Size: 230246 bytes
File Type: APK
Memory Resident: Yes
Initial Samples Received Date: 18 Mar 2013
Payload: Steals information

NOTES:

This malware was available on Google Play, but it has since been taken down. It may also be downloaded from third-party app stores such as hxxp://{BLOCKED}e.com/my-hrmis--jpa-demo-692186.html. However, as of this writing, the site is inaccessible.

This malware disguises itself as a shortcut app named My HRMIS & JPA Demo. Once installed, it allows users to connect to the following URLs:

  • http://www.eghrmis.gov.my/
  • http://www.bheuu.gov.my/puspanita/
  • http://www.mampu.gov.my/web/guest
  • http://www.jpa.gov.my/

The four URLs are all sites associated with Malaysian government.

This malware steals details, including the names of senders and recipients, of SMS messagesstored in the user’s inbox. It then sends the information to 0187109971.

  SOLUTION

Minimum Scan Engine: 9.300
TMMS Pattern File: 1.435.00
TMMS Pattern Date: 22 Mar 2013

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.


Did this description help? Tell us how we did.