Skip to content

Threat Encyclopedia
Export page to PDF
ANDROIDOS_FAKEAPP.SM
Aliases: Android/Adware.AirPush.A (NOD32)
Malware type: Trojan
Threat sub-type: Information Stealer, Click Fraud
Destructive: No
Platform: Android OS
Encrypted: No
In the wild: Yes

Overview


Infection Channel: Via app stores

This Android malware arrives as a fan-made application that tricks users into thinking that it is the same as the original. It displays advertisements upon installation.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This malware arrives as a Trojanized Android application. Upon execution, it creates shortcuts pointing to ads sites on the device's home page. It does this by downloading details about its intended ads on certain sites.

This Trojan may be manually installed by a user.

Technical Details


File size: Varies
File type: APK
Initial samples received date: 20 Feb 2012
Payload: Displays ads

Arrival Details

This Trojan may be manually installed by a user.

NOTES:

This malware arrives as a Trojanized Android application.

Upon execution, it creates shortcuts pointing to ads sites on the device's home page. It does this by downloading details about its intended ads on the following sites:

  • www.{BLOCKED}dsettings.com
  • ad.{BLOCKED}boltapps.net

Below is an example of the created shortcuts:

Aside from home page shortcuts, it also displays advertisements via notifications:

It then reports infection by uploading information to the following C&C server:

  • http://api.{BLOCKED}push.com/v2/api.php

Sent information includes the following:

  • IMEI
  • Carrier
  • Network operator
  • Phone model
  • API Key
  • App Id
  • Token
  • Infection timestamp
  • Package name and version
  • Wifi information
  • User agent
  • Android ID

After executing its payload, it then displays the following fake notification to the user:

Solution


Minimum scan engine: 9.200
Trend Micro Mobile Security Pattern Version: 1.193.00
Trend Micro Mobile Security Pattern Release Date: 28 Feb 2012

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn more ]

Did this description help? Tell us how we did.
Analysis By: Roland Marco Dela Paz

Connect with us on