More on Yxe

So what else have we found out about Yxe.e, which we discovered yesterday? It spreads via MMS, but attaches a skull and crossbones image to the message, rather than its body. The message includes a link – http://tran******.com – and suggests the recipient has the opportunity to view private information about a Chinese actress called Zhang Zii.

Following the link from a victim device results in an offer to download and install a file called LanPackage.sisx, which is 57573 bytes in size. But following the link from a browser installed on a computer simply results in a 404:

In other words, the server’s checking whether the request to connect to the site is coming from a mobile device browser.Once LanPackage.sisx is run, this message is shown:

And the certificate looks like this:

If the user says they want to install, the following files get copied to the device:

• C:sysbinInstaller_SV.exe
• C:sysbinLanPackage.exe – the worm executable
• C:private101f875aimport[20028B98].rsc

Once installed, the worm starts harvesting data about the smart phone; uploading the data to the cybercriminal server; sending SMS messages containing a link to itself to all contacts in the address book; attempting to terminate AppMngr, TaskSpy, Y-Tasks, ActiveFile, TaskMan; and blocking access to Software Manager in order to prevent itself from being deleted. It also tries to connect to a Chinese social networking site, “Happy Net” and download yet another file, but at the time of writing, the file wasn’t accessible.

It looks as though Worm.SymbOS.Yxe is now on a par with malware such as Cabir and Comwar. Cabir was the first Bluetooth worm, and the first malware for mobile platforms; Comwar was the first malware to spread via MMS; Yxe was the first in-the-wild malicious program with a valid certificate. A number of variants of Cabir and Comwar spread at intervals in the years following their first appearance. Worm.SymbOX.Yxe is over a year old now and looks as though it’s not planning to stop its evolution or its spread any time soon.

More on Yxe

Your email address will not be published. Required fields are marked *


Subscribe to our weekly e-mails

The hottest research right in your inbox