Alias/esAndroid.Smspacem (Symantec) | ||||||||||||
Detection Availability
| ||||||||||||
Visible Symptoms
| ||||||||||||
Detailed AnalysisAndroid/Smspacem.A!tr targets mobile phone running Android 2.1 or greater. It trojans a legitimate but controversial application called the Holy F***ing Bible. When the mobile phone is infected with Android/Smspacem.A!tr, the application is functional, but in background, the malware runs its malicious tasks. They consist in:
Technical DetailsThe malware is usually packaged as holycolbert10.apk (of course, it is possible it propagates under other names). The malicious classes are located in a path named com.YahwehOrNoWay, which is separate from the "legitimate" classes of the Holy F* Bible application. The malware consists of a service named 'theword'. At startup, it retrieves the phone's phone number and operator name. Then, it schedules all its tasks to run, after a delay of 1 minute, every 33 minutes. Every 33 minutes, the service gets the current date and formats it MMddyyyy. It tries to open a database /data/data/com.AmazingBullshit.HolyFuckingBible/databases/mydb.dband check the last entry in the myTable table of that database is 'endoftheworld'. This database acts as an infection marker of the device. If it is not present, the malware creates the database, creates the myTable table and inserts the value. The malware initializes a SOAP request to a malicious C&C center: http://[REMOVED].no-ip.biz/talktome.asmxThe SOAP object consists of two properties:
If the device's date is May 21, 2011, the malware sends an SMS to all contacts with a text randomly chosen among: Cannot talk right now, the world is about to end Jebus is way over due for a come back Its the Raptures,praise Jebus Prepare to meet thy maker,make sure to hedge your bet just in case the Muslims’ were right Just saw the four horsemen of the apocalypse and man did they have the worst case of road rage Es el fin del mundoIt also changes the wallpaper to an image of Stephen Colbert. If the device's date is May 22nd, 2011, the malware sends again another SMS to all contacts with the text "Looks like Jebus is a no show, maybe Judaism was on to something". If the command "formula401" is sent by the web service, the malware sends SMS messages to all contacts with one of the following links: http://turbobit.net/3qijra41byed.html http://turbobit.net/9fzlltk2eptu.html http://turbobit.net/9c19sk0tcg8z.htmlThose links are not active any longer. It also changes the wallpaper to an image named hammer.jpg. If the command "pacem" is sent by the web service, the malware sends the victim's email to the following link: http://[REMOVED]central.com/global/feeds/entertainment/media/submit_entry.jhtml?collectionID=96&email=EMAIL&format=json&jsoncallback=? Another malicious class, named SMSsmack.class, implements a message receiver. If the infected device receives a SMS message containing the body "health", it replies to the sender with an SMS with a text randomly chosen among: Cannot talk right now, the world is about to end Jebus is way over due for a come back Its the Raptures,praise Jebus Prepare to meet thy maker, make sure to hedge your bet just in case the Muslims were right Just saw the four horsemen of the apocalypse and man did they have the worst case of road rage Es el fin del mundo I am infected and alive ver 1.00This functionality is probably used by the attacker to test if a given device is still properly infecting or not. | ||||||||||||
Recommended Action
|
