Malware information: Android SMS Fake installer

• Overview
• Geeks Info
• How to remove

Name	Android SMS Fake installer
Malware type	Scam
Geo	Russia
Score	3
Date Discovered	05.11.2011
Date Added	05.11.2011

 

We have seen lately more 3^rd party Russian app stores to contain Trojans and malicious Android applications.
The last trend seen in those 3^rd party websites is requesting from the user the sending of premium SMS numbers (usually three) to install the requested application.
What those application authors forgot to tell those users is that those apps exactly can be downloaded for free from the official Android market.
Our advice to the users:
Download your applications only from trusted sources only and avoid shady 3^rd party app stores and forums.

Method of Infection	Installing an APK file
Encrypted	no
Distribution Potential	Low
In the wild	Yes
Overall Risk Rating	Low
Damage Potential	Low
Reverse info	Available
Symptoms	SMSs sent to premium numbers to start a process of application installation

Package name:
The package name of the malware is “com.depositmobi“:

 

Permissions:

The permissions requested by the malware are:

 

 

What the user’s see after installing the malware:

After the user installs the application an icon with the text ‘Install’ appear on the device:

 

 

 

Agreement:
If the user chooses to open it than he will see the following message asking him if he agree to the terms of the download:

 

 

Most of the users will press ‘Install’ at this point without knowing that the app will charge them as they are not aware it is being displayed in the ‘Rules’ button.

 

The users that press ‘Rules’ button will see a very hard to read screen with a lot of text that mention in it the payment of sending up to 3 SMS messages.

 

There’s no description about the numbers it will send SMSs or the fee that will be charged.

 

 

 

more technical details:

In the code we could find the list of all the countries with their extensions so that the SMS could be charged whether it was installed and used in Russia or in some other country:

 

 

 

Here we can see the checks in the app whether the SMSs have been sent:

 

 

Here we can see the SMSs been sent to the hard coded premium numbers:

 

 

The author of the app could tell if he need to display the texts in Russian or in English that can be understood by millions of Android users:

 

 

‘Raw’ folder in the APK file contain a file named ‘countries’ that contain examples of text in different languages:

 

 

 

AVG Mobilation Anti-Virus Free and Pro products provide protection against this threat.
In order for the protection to be activated, update your Android phone with our latest version.
Keep your device safe with AVG Mobilation Anti-Virus Free and Pro products.
Download now from http://www.avgmobilation.com/products.html

How to avoid from getting infected:
When installing new apps to your Android device, always look at the permissions an application requests to approve and make sure the list seems appropriate.

Be part of our community

• Follow us on Twitter
• Friend us in Facebook
• Read our blog

• Identify and remove viruses with one easy click
• Download apps, music and videos with confidence
• Locate, lock and wipe your device if lost or stolen

• Complete protection from SMS spam, scams and phishing attempts
• VIP support when you need it to keep you working
• No disruptions or advertising