tag:blogger.com,1999:blog-91374788533968220042025-05-13T23:05:26.714-04:00 Android Malware Dump <center> Security news for your Android powered device. Contains a dump zone for Android malware samples for educational purposes only.</center>Unknownnoreply@blogger.comBlogger31125tag:blogger.com,1999:blog-9137478853396822004.post-87770446681208001272016-04-13T12:14:00.002-04:002016-04-13T12:15:04.813-04:00Mobile ransomware still active, still polymorphic, and still the same.A post a Trend Micro shows a new variation of the same old mobile ransomware that has thwarted AV engines for over 2 years. This Android ransomware is server-side polymorphic and will most likely give a different variation over time and different downloads so any hash based detentions of this will be ineffective.
There are some simple common sense steps to avoid this type of malware:
Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-15573207221115219002014-02-12T17:13:00.001-05:002014-02-12T17:14:43.636-05:00Fake Flappy Birds on Android
An article at Naked Security mentions that fake versions of the popular Android game "Flappy Birds" are hiding premium SMS Trojans. A couple of examples of this can be found at the links below. Be careful as these are current live links to Android Trojans and can be harmful to your device. Always be mindful of any software coming from secondary markets.
Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-34808548152288384362013-10-25T10:51:00.004-04:002013-10-25T10:51:54.358-04:00Using Google and Scumware for samples
Here's a quick tutorial on good sources for Android malware. The site scumware.org is a great source for finding the latest threats. Use Google and put in the search box android site:scumware.org. You will get results to downloads of all kinds of Android malware.
Remember to use safe downloading techniques as links on scumware are not limited to Android and could really Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-42443470861776209692013-10-04T12:32:00.000-04:002013-10-04T12:32:30.896-04:00"Remember the 13th" Scam. While this one is a bit off topic it still pertains to basic security principles. The website promoting a huge NASA discovery that will "change the world." www.rememberthe13th.com is making its rounds on Facebook.
To catch the victims attention the site claims huge things: "SO WHATS THAT ALL ABOUT? NASA has made a historic discovery that Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-37519734843329313182013-07-30T12:56:00.000-04:002013-07-30T12:56:01.427-04:00These "Royal Apps" create a Royal Pain
Google Play still allows the most annoying of ad-ware to be distributed to Android devices. Airpush and Leadbolt are still very popular and are becoming even more aggressive then ever before in pushing ads for money. Examples like these "Royal Apps" from small unknown developers with no websites show up everyday. These apps and ones like it are Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-11792842873478188262013-06-27T12:11:00.000-04:002013-06-27T12:17:40.284-04:00NoCom malware is still spreading.
A recent blog posting from Virus Bulletin has given updated information for an Android Trojan called NotCompatible that was first noticed by Lookout in May. Not much has changed since the original samples which can currently be found on Contagio Mobile. I got a chance to take a quick look at this new version, which can be downloaded here (Password = infected) after Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-34646517397356819462013-06-06T16:52:00.001-04:002013-06-06T16:52:26.001-04:00Android Ikangoo "Porn" Trojan
Another variant of Android trojan SmsReg has been spotted in the wild, This one called Ikangoo, and is named after the website it downloads from.
"Dial/SmsReg!Android" is an application for mobile phones running Android which silently registers the victim to non-free services. It usually comes as a sexy or dating Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-44135925233491184062013-05-17T18:14:00.000-04:002013-05-17T18:14:31.419-04:00Android.RoidSec
There is a new security blog post from WebRoot about an Android malware called RoidSec. I took a quick look at this APK which can be found at:
hxxp://pan.baidu{dot}com/share/link?shareid=175821&uk=3106407483
or you can download the APK here (pasword = infected).
A quick analysis finds that while it does send data to the C&C server below, it is currently ineffective&Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-81599487160979303692013-04-25T17:43:00.002-04:002013-04-25T17:43:42.161-04:00Fake Google Market Forces Premium Sign-Up
A blog post by ThreatTrack Security showed an example of another fake Google market. This has been done so much in the past that it's easy to look past these threats. I posted about fake markets in the past here and here. However, the apps located on this one has changed up the rules a tiny bit. Instead of just sending a few premium Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-40221635149581897632013-04-22T11:56:00.003-04:002013-04-23T10:58:41.852-04:00Android BadNews
After checking out an Android malware sample listed by Lookout as Trojan:Android/BadNews, I found a lot of contention in the security community as to whether this is a Trojan or just adware gone bad. The supposed command and control server at hxxp://androways.com is linked to the Russian Android adware company hxxp://mobidisplay.net. It Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-21099680123789457932013-04-10T14:09:00.000-04:002013-04-15T12:40:35.462-04:00NVISO ApkScan
A new free APK analyzer entered the market in the last few weeks. http://apkscan.nviso.be/ does an epic job of dynamically analyzing an Android app and returning useful information for determining whether an app is safe or not.
I submitted a sample called Tank.apk (a known malware) and it came back with this:
http://apkscan.nviso.be/report/show/Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-26848489739342263562013-03-25T13:28:00.002-04:002013-04-03T17:10:46.273-04:00New Fake Gaming Apps.
A new fake gaming site, hxxp://htc-play[dot]ru, that as of this time not a single Anti-Virus has blocked or even noticed, carries premium SMS sending apps. This brand new variant of Android Malware is simple yet effective. It poses as one of the top 25 paid games on the Android Market that you can get for free then sends three premium Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-67942434792979073672013-03-11T15:41:00.000-04:002013-03-11T15:47:14.739-04:00Fake Job Offer
A post from McAfee (http://blogs.mcafee.com/mcafee-labs/android-malware-goes-bollywood) about fake job offers on Android devices got my attention. The article was short, sweet and to the point but it lacked a few points about scams like this. Scams like this have been around forever and they always involve asking you to send a little money for something of greater value.
&Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-12239926349930496802013-02-18T16:21:00.004-05:002013-02-18T16:21:38.963-05:000day Two Part Android OpFake Variant.
The other day I ran into a fake Android store through a poisoned Yandex search engine link. The fake Android market at hxxp://www.android-appss[dot]ru/ is pushing never before seen downloader apps for a newer variation of OpFake.
A downloaded APK of the popular Android game, Mass Effect: Infiltrator, and installed it. The icon (displayedUnknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-27809064004545317112013-02-07T14:59:00.000-05:002013-02-07T14:59:06.981-05:00GTA: Vice City Free Download Scam
Another new Grand Theft Auto: Vice City app on the Google Play Store was removed last week after complaints. For the scammers and spammers Grand Theft Auto has always been a big target to push malware. Just recently a fake version of GTA 3 was pushing Adware for a quick buck. This one however, while is not as mischievous, still doesn't produce the goods it promises&Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-52020584959067502912013-02-04T16:22:00.000-05:002013-02-04T16:23:25.819-05:00Talking Tom Talks You Into SMS Fraud
The Russian market is now over-run with fake Android Apps. You can search the Russian search engine Yandex for just about any Android app you can think of and put the term "apk ru" (without the quotes) at the end of the app name and you are bound to get bad search results. They will scam you with every ploy in the book to get you to download and install. Promise you free Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-16295524521641310972013-01-22T13:48:00.001-05:002013-01-22T15:03:26.627-05:00Leadbolt Adware in Fraudulent "Cracked" apps.
A good article from GFI Labs shows the danger in downloading Android apps that advertise as being Cracked. Another review by Threatpost gives more information as well. The samples that can be found at getwapi[dot]com is just one of many apps that advertise cracks for paid software. You have to be very careful downloading stuff off alternate markets as &Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-21795276955612509632013-01-16T14:42:00.003-05:002013-01-16T14:54:22.678-05:00Android.Troj.mdk AKA Android.ksappThere's a lot press and scare tactics that originated from an article at threatpost today. After reading the article and the translated article straight from China, I decided to take a look for some samples myself. After scouring the internet, I got a few samples to check out, and I found that this is nothing more then a new variation of Ksapp. Ksapp is a bot-net&Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-82810806610340308642013-01-10T16:57:00.001-05:002013-01-10T16:57:15.419-05:00Sorta Fake Anti Virus "Android Armour"A post Today on Sophos Caught my attention and I decided to take a look at this myself. So, I went to the website, http://androidarmour.com/, to invastigate further. This is one big scam and I don't think it will take too long for most to catch on. As it stands now it looks like only Sophos and Eset detect these, but I doubt it wont be long before they all do. Just like the Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-27619503569790390212012-12-14T15:43:00.000-05:002012-12-14T15:43:02.745-05:00The Jellybean Security Failure
Google's app scanner built into it's new Android Jellybean operating system has recently failed miserably during independent security testing. You can read the whole article at www.csoonline.com and see the whole independent study By Xuxian Jiang, Associate Professor, Department of Computer Science at NC State University. Remember to keep yourself safe by installing independent Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-17912961702437287232012-12-11T11:40:00.000-05:002012-12-11T11:40:42.839-05:00More Fake Google Markets
There's been a lot of news over the last year about fake Google Play markets pushing fraudulent apps onto Android devices.. According to post at GFI, another one has surface but this time it also gives a windows Trojan if you hit up the site on a PC. If you want a copy of the malware use this tutorial to get the APK download on to your phone safley from theses sites listed Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-9096207086743618142012-11-28T12:49:00.002-05:002012-11-28T12:52:08.247-05:00Angry Birds Star Wars Fraud
Just another SMS scam Android Boxer variant to watch out for. Check out the details at:
GFI Labs Blog
Computeractive
ThreatPost
You can download this sample from either of these sites but please be careful as they are direct links to the malware with no passwords.
hxxp://google-api3.com/getfile[dot]php?dtype=pp&r=8192-10
hxxp://angrybirdsstarwars-android[dotUnknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-30025091471168133212012-11-28T12:37:00.004-05:002012-12-12T11:39:35.098-05:00Safely Download Android Apps on The PCIt can be a real hassle to get the actual app or ".apk" file from your phone to your PC without a direct download link. So in a series of simple tutorials we will go over some basic techniques to safely download harmful Android files to a Windows machine. For this first one we will discuss a simple trick for making a website believe you are using an Android Powered deviceUnknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-46996410554987867722012-11-21T16:15:00.000-05:002012-12-12T11:40:05.710-05:00How bad can live wallpaper be?
So, you're surfing the net with your phone and find a site with some awesome live wallpapers on it. It looks pretty decent and even has a silly name of gama-rama.net, so you click one of the wallpapers. I clicked on a Matrix one for this example. Then you blindly click through the permissions without looking because its just the same standard garbage that all the other apps Unknownnoreply@blogger.comtag:blogger.com,1999:blog-9137478853396822004.post-9370779117289671082012-11-19T17:23:00.001-05:002012-12-12T11:40:25.782-05:00Free GTA 3 is just adware
In the Google Play Store a very misleading app is just aggressive advertising. Let's first check out the description straight out of the store:
EDIT: It looks like this was removed from the Google Play Store after complaints. This still can be side-loaded from alternate markets like 1mobile that don't police.
Description
The ultimate Grand Theft Auto fan app! If youUnknownnoreply@blogger.com