Home / malware

PDF

Trojan:SymbOS/Doomboot.A

First posted on 12 July 2010.
Source: SecurityHome

Aliases :

There are no other names known for Trojan:SymbOS/Doomboot.A.

Explanation :

Also known as a trojan horse program, this is a deceptive program that performs additional actions without the user's knowledge or permission. It does not replicate.

Additional Details Trojan:SymbOS/Doomboot.A drops corrupted system binaries and Worm:SymbOS/Commwarrior.B onto the infected device. The system files dropped by Doomboot.A cause the device to fail at the next reboot.

Doomboot.A is distributed in a malicious SIS file named 'Doom_2_wad_cracked_by_DFT_S60_v1.0.sis ', which is presented as being cracked versions of Doom 2 for Symbian.
If you have installed Doomboot.A, the most important thing is not to reboot the phone. If you have rebooted the phone and the phone will not start again, the phone can be recovered with hard format key code that is entered in the phone boot.

Execution
Doomboot.A installs corrupted system binaries into C:\ drive of the phone. No social engineering messages or extra icons in the phone application menu are display, and as Commwarrior.B hides its process from process list, the user has no way of noticing that phone is actually infected.
When the phone boots, this corrupted binaries will be loaded instead of the correct ones, and the phone will crash at boot.
The Commwarrior.B dropped by Doomboot will start automatically and start to spread. Bluetooth spreading of the Commwarrior.B causes battery drain and thus the phone will run quickly out of battery. In the case of Doomboot.A infection, this is problematic as the phone will not boot again after the power runs out.

Last update 12 July 2010

 

TOP