Skip to content

Threat Encyclopedia
Export page to PDF
ANDROIDOS_FAKENOTIFY.A
Aliases: Trojan:AndroidOS/FakeNotify.A (Microsoft); Trojan:Android/FakeNotify.A!mfb (Fsecure); Andr/FakeNtfy-A (Sophos)
Malware type: Trojan
Threat sub-type: Premium Service Abuser
Destructive: No
Platform: Android OS
Encrypted: No
In the wild: Yes

Overview


This Trojan targets the Android platform and lures users into downloading apps from a fake Android Market.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

Upon execution, this Trojan displays text in Russian that translates to "Do you agree with the terms of the download WhatsApp Messenger. To continue the download, then click Next."

Note that the application WhatsApp Messenger is the application downloaded from the malicious site. The application name may vary depending on the application downloaded by the user

This Trojan may be manually installed by a user.

Technical Details


File size: 40,276 bytes
File type: DEX
Memory resident: No
Initial samples received date: 10 Jan 2012
Payload: Sends messages

Arrival Details

This Trojan may be downloaded from the following remote sites:

  • http://{BLOCKED}dxmarket.net

It may be manually installed by a user.

NOTES:

Below is a screenshot of the fake Android Market.

Upon execution, it displays the following:

The text displayed is in Russian and translates as "Do you agree with the terms of the download WhatsApp Messenger. To continue the download, then click Next."

Note that the application WhatsApp Messenger is the application downloaded from the malicious site. The application name may vary depending on the application downloaded by the user. If users click Next, the following is displayed:

The text translates as "Thank you for activation! Link to your file: http://{BLOCKED}d-market-mobile.com/download/index.php"

The following is then displayed, which is a list of other applications that can be downloaded:

While running, it sends text messages to any of the following premium-rate numbers which may result to unnecessary high phone charges:

  • 5014
  • 7781
  • 9013
  • 9014
  • 1121
  • 0900666266
  • 9684
  • 9685
  • 9683
  • 4129
  • 4128
  • 4127
  • 4126
  • 7151
  • 9151
  • 2855
  • 3858
  • 19998866
  • 6566
  • 1916
  • 9090150
  • 9090199
  • 80888
  • 1945
  • 17011
  • 17012
  • 17013
  • 17010
  • 5339
  • 81015
  • 81221
  • 69067
  • 79067
  • 8014
  • 57977
  • 4157
  • 4156
  • 4153
  • 4152
  • 4545
  • 1381
  • 1391
  • 1635
  • 1645
  • 1871
  • 1872
  • 1873
  • 1874
  • 5040
  • 2322
  • 79866
  • 92525
  • 69991
  • 68305
  • 83111
  • 55886
  • 1161
  • 1171

Solution


Minimum scan engine: 9.200
Trend Micro Mobile Security Pattern Version: 1.177.00
Trend Micro Mobile Security Pattern Release Date: 10 Jan 2012

Step 1

Trend Micro Mobile Security Solution

Trend Micro Mobile Security Personal Edition protects Android smartphones and tablets from malicious and Trojanized applications. The App Scanner is free and detects malicious and Trojanized apps as they are downloaded, while SmartSurfing blocks malicious websites using your device's Android browser.

Download and install the Trend Micro Mobile Security App via Google Play.

Step 2

Remove unwanted apps on your Android mobile device

[ Learn more ]

Did this description help? Tell us how we did.

Connect with us on