Malware descriptions

Android Security Suite Premium = New ZitMo

On the 4th of June 2012 we found 3 APK files of ~207 kb in size each heuristically detected by our engine as HEUR:Trojan-Spy.AndroidOS.Zitmo.a. All these applications are malicious and were created to steal incoming SMS messages from infected devices. SMS messages will be uploaded to a remote server whose URL is encrypted and stored inside the body of the Trojan. We found 3 more APK files with exactly the same functionality on 8th, 13th and 14th of June. So there are at least 6 files which pretend to be ‘Android Security Suite Premium’ but in fact were created only for stealing incoming SMS messages.

After the infection there is a blue shield icon in the menu with the name ‘Android Security Suite Premium’:

If the application is launched it will show a generated ‘activation code’:

It is also important to mention that these malicious apps are able to receive commands for uninstalling themselves, stealing system information and enabling/disabling the malicious applications. Let’s be honest, such functionality (the ability to receive and execute commands and the ability to steal SMS messages) is not that new for mobile (Android) malware. But there was a feeling that there was something more behind these files.

We found 6 different C&Cs in these APK files. Here is the list of them:

  • android*****.com
  • android2u*****.com
  • androidve*****.net
  • android-s*****.net
  • soft2u*****.com
  • updatean*****.biz

If you try to ‘whois’ the first 5 domains you won’t find a lot of interesting or useful information. But here is what you get when you whois the last C&C domain:

Yes, it’s fake data but if you continue to google for e.g. simonich@inbox.ru you will find out that there are more domains which were registered back in 2011 using the same fake data. For example, favoritopi*****.com, akteriak*****.com, basepol*****.com or justdongwf3*****.info. All these domains were found in our ZeuS C&C database.

So, there is new piece of Android malware which steals incoming SMS messages and uploads them to the remote server. One of the remote server domains was registered using the same fake data which was used for registering ZeuS C&Cs back in 2011. And the malware’s functionality is almost the same as in old ZitMo samples. Therefore ‘Android Security Suite Premium’ = New ZitMo.

Thanks to my colleagues Igor Soumenkov and Dmitry Tarakanov for their help.

Android Security Suite Premium = New ZitMo

Your email address will not be published. Required fields are marked *

 

Reports

Lyceum group reborn

According to older public researches, Lyceum conducted operations against organizations in the energy and telecommunications sectors across the Middle East. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.

GhostEmperor: From ProxyLogon to kernel mode

While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

Subscribe to our weekly e-mails

The hottest research right in your inbox