{"id":72524,"date":"2011-08-03T11:18:22","date_gmt":"2011-08-03T11:18:22","guid":{"rendered":"https:\/\/localhost\/wordpress\/?p=72524"},"modified":"2011-08-03T11:18:22","modified_gmt":"2011-08-03T11:18:22","slug":"conversation-spying-android-trojan","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/conversation-spying-android-trojan\/","title":{"rendered":"Conversation spying Android Trojan"},"content":{"rendered":"
It seems that Android malware is improving day by day. We have received an interesting malware which can store call logs, record whole conversations and even send them to remote computers owned by malicious controllers.<\/p>\n

Most of the previous Android malware we have seen has either sent text messages or made calls to various premium service numbers in order to make some easy money.<\/p>\n

This particular Trojan records conversations in AMR format, as allowed by the permissions the user has approved.<\/p>\n

When the program is installed it requests permissions to allow it to perform the following actions:<\/p>\n

Access Cell-ID and WiFi location\"\"
\nAccess Cell-ID and WiFi updates
\nAccess GPS location
\nAccess information about WiFi networks
\nAllow low-level access to power management
\nAllow read only access to phone state
\nAllow the use of PowerManager WakeLocks to keep the processor from sleeping or the screen from dimming
\nInitiate a phone call without going through the dialer user interface (so that the user is unaware of any outgoing calls made by the Trojan)
\nMonitor, modify or abort outgoing calls
\nOpen network sockets
\nRead SMS messages
\nRead the user’s contacts data
\nRecord audio
\nSend SMS messages
\nWrite (but not read) the user’s contacts data
\nWrite SMS messages
\nWrite to external storage<\/p>\n

When the Trojan is executed it programs itself to initiate whenever the device starts by waiting for the following command:
\nandroid.permission.ACTION_BOOT_COMPLETED<\/strong><\/p>\n

It may then start any of the following services:<\/p>\n

GpsService
\nMainService
\nRecordService
\nSocketService
\nXM_SmsListener
\nXM_CallListener
\nXM_CallRecordService<\/p>\n

The program then sends an SMS containing the IMEI of the device to the following phone number:
\n15859268161<\/strong><\/p>\n

It then records the following information:<\/p>\n

All phone call content
\nGPS infomation
\nReceived SMS messages
\nSent SMS messages<\/p>\n

The above information is written to the SD card in the following location:
\n\/sdcard\/shangzhou\/callrecord\/<\/strong><\/p>\n

The gathered information is then sent to the following location on port 2018:
\njin.56mo.com<\/strong><\/p>\n

The best defense against this sort of malware is to pay attention to the permissions that an application is asking for. Ask yourself – does this app really need all these capabilities? If in doubt, say no!<\/p>\n

Those who have missed our earlier post, we have released our product for Andriod phones. Quick Heal Mobile Security for Android detects the file as Android.Nickispy.A.<\/strong><\/p>\n

To avail the introductory 50% discount offer please visit our Quick Heal Mobile Security page here<\/span><\/a>.<\/p>\n

To download the free trial version for your Android device please visit the Android Market after clicking on the following link:<\/p>\n


\n\"\"
\n<\/a><\/div>\n

<\/h3>\n","protected":false},"excerpt":{"rendered":"

It seems that Android malware is improving day by day. We have received an interesting malware which can store call logs, record whole conversations and even send them to remote computers owned by malicious controllers. Most of the previous Android malware we have seen has either sent text messages or made calls to various premium […]<\/p>\n","protected":false},"author":22,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,24,60],"tags":[56,57,59,61,67,40],"class_list":["post-72524","post","type-post","status-publish","format-standard","hentry","category-android","category-malware","category-smartphone","tag-android-security","tag-droid-defense","tag-mobile-devices","tag-smartphone-security","tag-third-party-apps","tag-trojan"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72524"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=72524"}],"version-history":[{"count":0,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72524\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=72524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=72524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=72524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}