English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Android Security Suite Premium = New ZitMo

Denis
Kaspersky Lab Expert
Posted June 18, 12:30  GMT
Tags: Mobile Malware, ZeuS, Google Android
0.3
 

On the 4th of June 2012 we found 3 APK files of ~207 kb in size each heuristically detected by our engine as HEUR:Trojan-Spy.AndroidOS.Zitmo.a. All these applications are malicious and were created to steal incoming SMS messages from infected devices. SMS messages will be uploaded to a remote server whose URL is encrypted and stored inside the body of the Trojan. We found 3 more APK files with exactly the same functionality on 8th, 13th and 14th of June. So there are at least 6 files which pretend to be ‘Android Security Suite Premium’ but in fact were created only for stealing incoming SMS messages.

After the infection there is a blue shield icon in the menu with the name ‘Android Security Suite Premium’:

If the application is launched it will show a generated ‘activation code’:

It is also important to mention that these malicious apps are able to receive commands for uninstalling themselves, stealing system information and enabling/disabling the malicious applications. Let’s be honest, such functionality (the ability to receive and execute commands and the ability to steal SMS messages) is not that new for mobile (Android) malware. But there was a feeling that there was something more behind these files.

We found 6 different C&Cs in these APK files. Here is the list of them:

  • android*****.com
  • android2u*****.com
  • androidve*****.net
  • android-s*****.net
  • soft2u*****.com
  • updatean*****.biz

If you try to ‘whois’ the first 5 domains you won’t find a lot of interesting or useful information. But here is what you get when you whois the last C&C domain:

Yes, it’s fake data but if you continue to google for e.g. simonich@inbox.ru you will find out that there are more domains which were registered back in 2011 using the same fake data. For example, favoritopi*****.com, akteriak*****.com, basepol*****.com or justdongwf3*****.info. All these domains were found in our ZeuS C&C database.

So, there is new piece of Android malware which steals incoming SMS messages and uploads them to the remote server. One of the remote server domains was registered using the same fake data which was used for registering ZeuS C&Cs back in 2011. And the malware’s functionality is almost the same as in old ZitMo samples. Therefore ‘Android Security Suite Premium’ = New ZitMo.

Thanks to my colleagues Igor Soumenkov and Dmitry Tarakanov for their help.


4 comments

Oldest first
Threaded view
 

rino19ny

2012 Jun 18, 18:25
0
 

3rd party?

i assume it came from 3rd party markets and not from Android Market.

Reply    

wmdaricthompson

2012 Jun 26, 21:37
0
 

Re: 3rd party?

Actually, it probably came from neither. Typically when I hear of ZeuS in the Mobile infections, I see them offered via ZeuS web injects, hosted on the same C C it's reporting to in all likelihood.

Reply    

veronica0987

2012 Jun 22, 18:18
-1
 

my classmate's ex-wife got paid $19476 past month. she been working on the laptop and bought a $546400 home. All she did was get blessed and profit by the directions uncovered on this link lazycash41.comONLY

Reply    

clubjustin

2013 Jul 01, 07:19
0
 

Re:

stop spamming!

Reply    
If you would like to comment on this article you must first
login


Bookmark and Share
Share

Related Links

Analysis

Blog