Fakemart D002F0581A862373AA6C6C0070EC3156
Fakemart 27CFDF25ECAE75342A21230D19151939
Fakemart 6A0E9CE340164AF6F37A946DF650B458
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-081217-1428-99&tabid=2
The Trojan may perform the following actions:
Clear the XMBPSP.xml contents in shared preference
Configure the XMBPSP.xml file to send SMS to 81211 or 81308
Set the device to silent mode
Delete SMS received from 81211
Open network connections
Block incoming SMS, encode the body of the message, and post them to the above URLs
Send SMS to 81211 or 81308 if the first ten incoming SMS contain the strings "BD MULTIMEDIA" or "code"
Download. Email me if you need the password.
Fakemart 27CFDF25ECAE75342A21230D19151939
Fakemart 6A0E9CE340164AF6F37A946DF650B458
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-081217-1428-99&tabid=2
The Trojan may perform the following actions:
Clear the XMBPSP.xml contents in shared preference
Configure the XMBPSP.xml file to send SMS to 81211 or 81308
Set the device to silent mode
Delete SMS received from 81211
Open network connections
Block incoming SMS, encode the body of the message, and post them to the above URLs
Send SMS to 81211 or 81308 if the first ten incoming SMS contain the strings "BD MULTIMEDIA" or "code"
Download. Email me if you need the password.