Android Fakemart - SMS-Trojan

File: Fakemart.apk
Size: 247778
MD5:  D002F0581A862373AA6C6C0070EC3156

Research:
French Android Users Hit again by SMS Trojan - Webroot
Android/Fakemart's end: Author has been identified -Fortigard

Download  (email me if you need the password) 

Android.Uracto - fraud, SMS spam

Research: Symantec. Android.Uracto Used to Trick Mothers, Anime Fans, Gamers, and More
Sample credit: Sanjay Gupta



D09A1FF8A96A6633B3B285F530E2D430 NewsAndroidnocode.apk
4C937667CB23E857D42B664334E1142A NewsAndroidcode03.apk
BA73E96CAA95999321C1CDD766BDF58B NewsAndroidcode02.apk
CF45E1288B47D97326ED279F2EE41E4D NewsAndroidcode01.apk

Download. Email me if you need the password

SMS trojan - targeting Korean Android devices

File: sb.apk
Size: 23727
MD5:  B9CD27AAD217B412B61448AC6976C807


Research: McAfee SMS Trojan Targets South Korean Android Devices

Sample credit: Jimmy Shah

Download. Email me if you need the password

Android SMSSend sample - Package Installer

com.android.packageinstaller
File: install.apk
MD5:  5d9c622b240dab5d6e883e26e9ea0fc0
Size: 261887

credit: anonymous donation

Download. Email me if you need the password

SpamSoldier - SMS Botnet sample

File: kim.apk
Size: 493987
MD5:  28668EE9168E4EA28DBB34A43E54411A


Research:
Security Alert: SpamSoldier. Lookout
Android Trojan Used To Create Simple SMS Spam Botnet. Cloudmark

Sample Credit: Tim Strazzere. Lookout security

Download kim.apk and the pcap file (email me if you need the password)

Fakelash - Android SMS trojan

Research Android malware distributed by malicious SMS in France


File: FlashPlayer.apk
Size: 2620250
MD5:  BE615D9730C1BBEBF73B2205F7B7D51B


File: flashnew.apk
Size: 2744902
MD5:  7DEC1C9174D0F688667F6C34C0FA66C2

Download (email me if you need the password / use the contagio password scheme)

http://contagio.deependresearch.org/files/Mobile/7DEC1C9174D0F688667F6C34C0FA66C2_flashnew.zip

http://contagio.deependresearch.org/files/Mobile/BE615D9730C1BBEBF73B2205F7B7D51B%20FlashPlayer.zip

Android.Qicsomos - Fake CarrierIQ detector-SMS Trojan

File:             Android.Qicsomos.apk
MD5:     69B9691A8274A17CDC22E9681B3E1C74
Sample Credits:   with many thanks to Anonymous,April 17 2012
Research:   Symantec: The Day After the Year in Mobile Malware?
Symantec: Android.Qicsomos

Download  - password infected

Fake SuiConFo.apk - Foncy - Android Trojan SMS

Update: February 6, 2012
File: 56033daef6a020d8e64729acb103f818
Name: FoncySMS
MD5:  56033DAEF6A020D8E64729ACB103F818
Sample Credit:  S.Guerrero February 5, 2012
Research: The Butterfly Effect of a Boundary Check by Sergei Shevchenko



Download - Password infected


Download extracted files

• /data/data/com.android.bot/files/header01.png (ELF executable).
• /data/data/com.android.bot/files/footer01.png (ELF executable).
• /data/data/com.android.bot/files/border01.png (Android app - an APK File).

==========================================================================
Name:                    SuiConFo.apk
MD5:                     1a3fb120e5a4bd51cb999a43e2d06d88
Sample Credits:     many thanks to Ian French, December 8, 2011
Research:           Kaspersky: SMS Trojans: all around the world

Download  - password infected

Scavir -- Russian Android SMS / Fraud trojan

Name:                   Scavir
MD5:                    d20cb0bb5d87bfc8394bda0d8964d663
Sample Credits:   with many thanks to Droopy, January 6, 2012
Research:             Kaspersky Android malware: new traps for users by Denis

Download  - password infected 

RogueSPPush - SMS-Trojan

Name:                 RogueSPPush
File Name:          1314935990854.apk
MD5:                  56CD8AC9ADFC0E38496939385AA510FA
Research:           New Rogue Android App -- RogueSPPush -- Found in Alternative Android Markets By Xuxian Jiang -Aug 2011
Sample Credits:    with  many thanks to MasterMRZ , October  23, 2011

   Download  (password infected)

PJApps.A - Mediaplayer - SMS-Trojan

 
Name:                Mediaplayer (goes under different names)
MD5:                c05d4ff1a80f18ba9d8a86afd88bc05d
 Sample Credits:     many thanks to a very generous anonymous donation, October  21, 2011  

Download  (password infected)

or Download an archive with all the files donated on Oct. 21. 2011



some other related apps might be here

http://www.webgameboy.com/HTC-T5252/xiazai-14864.html

Related research: Cryptography for mobile malware obfuscation Axelle Apvrille

Jimm ICQ SMS-Trojan pushed by malicious QR codes

 Russian internet lanscape is fertile not only for windows malware but also for mobile.
There are plenty of SMS trojan variants lurking on sites offering their 'versions' of popular software. A quick search for phone freeware brought a bunch of java and apk sms senders and questionable apps.
Here is one for example http://www.virustotal.com/file-scan/report.html?id=c8263e24046f2902e9c8639a89c2f3da5bbdba4055028b5cc9291143994726e5-1317426885
 I will post all the harvested sms senders in one post after this


Name:                    Jimm ICQ for Android and other phones (jar)
File Name:   
         
File: jimm.apk
MD5:  37A46AEC9AA86831FAA3DDB6B05A05F8
 File: jimm2s.jar
MD5:  B409DB1963DE4287FEB542377B0FE3A1

Sample Credits:     many thanks to anonymous, Sept 30, 2011
Research:              Malicious QR Codes Pushing Android Malware by Denis - Kaspersky Lab

Download  (pass infected)

DogoWar / Dog Wars - SMS Trojan, courtesy of Animal Rights defenders

Name:                    AndroidDogowar.apk
File Name:             AndroidDogowar.apk
MD5:                      16521eee3e74a4186ffe731dfaa77a83
Sample Credits:     many thanks to anonymous, August 19, 2011
Research:              Animal Rights protesters use mobile means for their message -  Symantec


Download  (pass infected)

Lovetrap - SMS-Trojan

Name:                    Lovetrap-apk
File Name:             Lovetrap-apk
MD5:                     f3497516eab17c642c5ede5ad1e55a15
Sample Credits:     many thanks to anonymous, Aug 3, 2011
Research:              Android.Lovetrap - Symantec Security

Download  (pass infected)

GGTracker - SMS Trojan

Name:                    GGTracker
File Name:             com.space.sexypic.apk
MD5:                     156fdce65eb6e4287aed687a1c9c2589
Sample Credits:    thanks to Tim Strazzere Lookout Mobile Security, July 20, 2011

Name:                    GGTracker
File Name:             batterysaver.apk / t4t.power.management.apk
MD5:                     41080c6169d3e5843c0c0e4abef80e7e

Sample Credits:    thanks to Tim Strazzere Lookout Mobile Security, July 20, 2011
Research:               GGTracker Technical Tear Down - by Tim Strazzere Lookout Mobile Security
                               Security Alert: Android Trojan GGTracker Charges Premium Rate SMS Messages - Lookout Mobile Security

Download com.space.sexypic.apk (pass infected)
Download batterysaver.apk / t4t.power.management.apk (pass infected)

HippoSMS - SMS Trojan

Name:                    HippoSMS
File Name:             hippo.apk
MD5:                     f9bfec4403b573581c4d3807fb1bb3d2
Sample Credits:    thanks to anonymous, July 13, 2011
Research:              Security Alert: New Android Malware -- HippoSMS -- Found in Alternative Android Markets

Download  (pass infected)

HTC.apk - fake security patch

Name:                   HTC fake patch
File Name:             htc.apk
MD5:                    4c8f01db58987c2c3321cdbbb1a2e67a 
Sample Credits:    many thanks to William Hill CPU Media | Kinetoo.com: Android mobile malware scan July 12, 2011 
Research:              CPU Media | Kinetoo.com: Android mobile malware scan July 12, 2011
HTC.apk is a fake security patch found on circulating among Chinese users. It's a phishing attack disguised to appear as a security patch from China Mobile. The infected site is 1OO86.net (note that 10086.net is a legitimate China Mobile site).

Download  (pass infected)

GoldDream

Name:          GoldDream.A
File Name:    BloodvsZombie_com.gamelio.DrawSlasher_1_1.0.1.apk
MD5:            b87f2f3a927bf967736ed43ca2dbfb60
Name:           GoldDream.B
File Name:    v1.0_com.GoldDream.pg_1_1.0.apk
MD5:            f66ee5b8625192d0c17c0736d208b0b
Research:     Security Alert: New Android Malware -- http://www.cs.ncsu.edu/faculty/jiang/GoldDream/ -- Found in Alternative App Markets  Xuxian Jiang
Sample credits: many  thanks for the sample to oren@avg-mobilation July 6,2011

Download GoldDream.A
Download GoldDream.B

DroidKungFu2

Name:                   DroidKungFu2.A
File Name:            _com.tutusw.onekeyvpn_7_1.1.6.apk
MD5:                    F438ED38B59F772E03EB2CAB97FC7685
Name:                   DroidKungFu2.B
File Name:            _com.allen.txthej_1_1.0 F4.apk
MD5:                   54bc7a8fb184884a26e4cce74697d3a5
Sample Credits:     many  thanks for the sample to oren@avg-mobilation July 3,2011
Research:               Security Alert: New DroidKungFu Variants Found in Alternative Chinese Android Markets  

Download DroidKungFu2 -A (pass infected)
Download DroidKungFu2 -B (pass infected)

jSMSHider - Malware Targeting Custom ROMs

Name:                    jSMSHider
File Name:             jSMSHider org.expressme.love.ui.apk
MD5:                      24663299e69db8bfce2094c15dfd2325
Sample Credits:     many thanks to Tim Strazzere from Lookout Mobile Security, June 16, 2011
Research:              Lookout blog: Security Alert: Malware Found Targeting Custom ROMs (jSMSHider)

Download  (pass infected)