Home / malwarePDF  

Trojan:AndroidOS/Fakebrows.A


First posted on 02 August 2012.
Source: Microsoft

Aliases :

Trojan:AndroidOS/Fakebrows.A is also known as Trojan-SMS.AndroidOS.FakeInst.h (Kaspersky), Android.Trojan.FakeInst.D (BitDefender), Android.SmsSend.401 (Dr.Web), Android/TrojanSMS.FakeInst.B trojan (ESET), Andr/FakeInst-A (Sophos), Android.Premiumtext (Symantec).

Explanation :



Trojan:AndroidOS/Fakebrows.A is a trojan that targets mobile devices running the Android platform. It disguises itself as a legitimate app.

This threat sends multiple SMS messages to a premium number.



Installation

Trojan:AndroidOS/Fakebrows.A disguises itself as a legitimate browser app localized for Russian language speakers. When users try to install it, it may ask for access to the following data:

  • Personal information, such as the phone's state, calendar events, emails, and contacts
  • Permission to send and receive SMS and MMS messages
  • Permission to access network communication and system level alerts


The prompt for your permission may look like the following:



We've seen this threat pretend to be the following apps:

  • Navitel Navigator
  • Opera Mini Browser:





Payload

Sends messages to premium numbers

Trojan:AndroidOS/Fakebrows.A displays a fake progress bar, so that it appears as if it is downloading an app into your mobile device:



It then displays a statement of agreement indicating the cost of the download:



This roughly translates to the following:

Initialization
Confirm agreement with the rules of loading <Android app - in this case, Navitel>. To continue the download, then click Next.

If you tap on the "Agree" button, Trojan:AndroidOS/Fakebrows.A sends multiple SMS messages to premium numbers at your expense.

The expenses are as follows:



For Russia:
Send up to 3 SMS messages on the service numbers:
7151 (MTS 33.87 rubles., Megaphone £ 35.40., Beeline £ 40.00).
9151 (MTS 101.60 rubles., Beeline 111.00 rubles., Megaphone £ 140.42).
2855 (Megaphone 200.00rub., Beeline 170.00 rubles., MTS 203.20 USD).
Send up to 2 SMS messages to the service number:
3855 (Beeline 300.00 rubles., Megaphone £ 300.00., MTS 304.79 USD).

If you tap on the "Agree" button again, you may see the following screen containing a URL supposedly where the app can be downloaded:



This roughly translates to the following:

Completed
Activation completed successfully. You will receive an SMS message with a link to <Android app>, after which the download will be available.
If the message does not come, you can download <Android app> at http://<download URL>, and then click Next to automatically reboot.



Analysis by Zarestel Ferrer

Last update 02 August 2012

 

TOP

Malware :

Family: