Android - FakeJobOffer

File: com.saavn.android.apk
Size: 973303
MD5:  9E8FA23DFC817BDCAD42B2F6ADA6E658
Sample credit:  Jimmy Shah


Research: Android Malware Goes Bollywood - McAfee

Download. Email me if you need the password

SMS trojan - targeting Korean Android devices

File: sb.apk
Size: 23727
MD5:  B9CD27AAD217B412B61448AC6976C807


Research: McAfee SMS Trojan Targets South Korean Android Devices

Sample credit: Jimmy Shah

Download. Email me if you need the password

Android Tetus - Infostealer

File: com.stephbriggs5.batteryimprove-2.apk
Size: 293777
MD5:  6408DF6ABA4C7F1803C2AAC8F17C4CA3


File: 85CE55DC130F214B0567987EDFF77DC0
Size: 274999
MD5:  85CE55DC130F214B0567987EDFF77DC0


File: com.droidmojo.awesomejokes.apk
Size: 268360
MD5:  01772AEFE0230C3669E21D79FC920D2E



File: 65C75AF5DE2628BD6215BB99DD76D3AC
MD5:  65c75af5de2628bd6215bb99dd76d3ac
Size: 277644

Research: Symantec. Android Tetus

When the Trojan is executed, it registers an SMS observer to record SMS messages and send them to the following command-and-control (C&C) server:
[http://]android.tetulus.com

The Trojan may delete some SMS messages from the device.

It may also register an SMS receiver to send SMS messages without the user's consent.

The Trojan may send a list of all installed apps on the device to the following remote location:
[http://]fast.app-engines.com

Download. Email me if you need the password

Android SMSSend sample - Package Installer

com.android.packageinstaller
File: install.apk
MD5:  5d9c622b240dab5d6e883e26e9ea0fc0
Size: 261887

credit: anonymous donation

Download. Email me if you need the password

Android Armour sample

File: Scan-For-Viruses-Now.apk
MD5:  084a7b576f5df438abba3131a90af493
Size: 1427490

Sample credit: anonymous donation

Research: A chink in Android Armour - Sophos

It is not malware but a very sketchy app with poor performance and false positives,  extorting money for nothing, considering there are many reputable free AV apps like Lookout or Sophos

Download. Email me if you need the password

Android Plankton / Counterclank sample - Collage Creator

com.changedroid.picture.collage.creator.apk
Size: 9842061
MD5:  DE842DD94324492ACE8C2C8EBD350BC8
sample credit: anonymous donation

Download. Email me if you need the password

Android - Trojan!Extension.A

Update: Feb 16
Added 2nd stage file  Loaded runtime, no need to install - credit Thomas Wang

Feb 4, 2013
Research: Trustgo: Trojan!Extension.A – Complex Malware Escapes AV Detection
Sample credit: Thomas Wang


File: 6d43b3bc85770fafeb598eb5297bc341.apk
Size: 434436
MD5:  6D43B3BC85770FAFEB598EB5297BC341

Download the original (1st stage). Email me if you need the password
2nd stage download Email me if you need the password

Android/Windows Spy:Android/Ssucl - DroidCleaner and Superclean.

Research: Kaspersky: Mobile attacks  - Android with Windows malware downloads

File: smart.apps.superclean-1.apk

Size: 502441

MD5:  2529085824C55DBBAED0B86EDE7B3C60

File: smart.apps.droidcleaner-1.apk

Size: 310274
MD5:  C5A2D14BC52F109A06641C1F15E90985


File: smart.apps.droidcleaner-1.apk 
Size: 330984
MD5:  123478A70219D24A5E5A40074B8775BA


File: SuperClean-11.apk 
Size: 528630
MD5:  B0C28334373332D4677C01BD48EED431


Download 
android files listed above plus




from http://claco.hopto.org 

    Controller.exe
    svchost.exe

plus from claco.kicks-ass.org  
    Extra_Fotos.zip
    Kst.exe
    pwd.exe   

Android Opfake - DevilsCreed.full_1.8_installer.apk

File: com.alioth.imdevil_jp.DevilsCreed.full_1.8_installer.apk
Size: 746430
MD5:  DFB76FE66E90AC0B4DFDC383BB3FBFFF

Sample credit: Many thanks to Hayk

Download. Email me if you need the password

Android.Exprespam

Sample Credit: Tim Strazzere, Lookout Security
Research: Symantec: Malware Authors Create Android.Exprespam After Prosecutors Drop Case

wrehifsdkjs.apk

Download. ( email me if you need the password)

FakeGuard - SMS trojan

Meant to post it for a looong time. But better late then never.
Here is a sample of FakeGuard / sms trojan that was prevalent in Korea in December (maybe still is)

Trojan.Rus.SMS."SystemSecurity" - Toll Fraud / ConnectSMS

Santa, aka DarkK3y, brought a new present.
Please read the malware report below. If you have any comments for the author, please email me and I will send him or get him to contact you.




Download. Email me if you need the password. 
Sample and Research credit: DarkK3y




DarkK3y / dark_k3y
Trojan.Rus.SMS."SystemSecurity"  

=== Summary of the analysis ===

This malware sample was recieved by SMS message with some web link inside. Malware seems to be Toll Fraud malware (according to Lookout Mobile Security classification). Middle-user inter-action required to infect mobile device -- user need to click link and install apk-file downloaded from it. The installation package requires many security permissions to run (see Characteristics section). After installation, "System Service" (com.android.systemsecurity) appears on the device. It loads on boot and make hooks on sms receiver service (with the greatest priority). Also, it uses alarm service to schedule periodic (3 mins and more) runs. Each run (except first) the SMS to the payed service sent. On the first run, information about payed service (SMS number and code) and sms filter (which SMS should be dropped and don't be showed to user) is downloaded from CnC server; OS information, IMEI, IMSI and user contact list is uploaded to CnC server. Possibly, the user contact list phone numbers are used by cnc server for further malware spread, by sending sms'es to them. Currently, malware seems to be undetectable by Norton Mobile Antivirus and some other antimalware mobile tools. It is only detected by heuristic scan methods (possibly, because of requiring too much security priviliges).

Merry Christmas and Happy New Year!

More presents to come, pa rum pum pum pum
    rum pum pum pum, rum pum pum pum

Android.Tascudap - DDoS trojan

File: apk.apk

Size: 124568

MD5:  3CC7597A183B9A2C91127D18A04A2B26

Research Symantec : Android.Tascudap

Symantec - Android.Tascudap is a Trojan horse for Android devices that uses the compromised device in denial of service attacks.

Download: 

Email me if you need the password

SpamSoldier - SMS Botnet sample

File: kim.apk
Size: 493987
MD5:  28668EE9168E4EA28DBB34A43E54411A


Research:
Security Alert: SpamSoldier. Lookout
Android Trojan Used To Create Simple SMS Spam Botnet. Cloudmark

Sample Credit: Tim Strazzere. Lookout security

Download kim.apk and the pcap file (email me if you need the password)

Android Carberp

December 2012

File: alfasafe.apk

Size: 270797

MD5:  07D2EE88083F41482A859CD222EC7B76

File: sber.apk
Size: 225905
MD5:  F27D43DFEEDFFAC2EC7E4A069B3C9516

File: vksafe.apk

Size: 226368

MD5:  117D41E18CB3813E48DB8289A40E5350

Research: Carberp-in-the-Mobile. Securelist.

Sample credit: Pau Oliva Fora

Download. Email me if you need the password scheme

Android Uranico - infostealer

August 2012

File: uranai.apk
Size: 69970
MD5:  5C2E0C62DEFE686B09F2F9BC369677EC

Research: What Do Battery Saver, Reception Improver, and Japanese Actress Video Apps Have in Common?. Symantec

Download. Email me if you need the password scheme

Android Enesoluty - Fake Antivirus, Spyware

September 2012

5DD6C326114BAB3A1D253200C2F897A1
SafeSearchActivity


FCA3D59B8F4A982E66DDD585737E3C48
SecureVirusScan




Research: Fake Antivirus App Steals Contact Data on Mobile Devices. Symantec

Download. Password as on contagio. Email me if you need the password

Android Sun Charger - Sumzand, spam sender

September 2012

Research: Sun Charger, the Latest Android.Sumzand Variant, Continues the Massive Spam Campaign, Symantec
Sample credit: Anonymous

File: schgg.apk
Size: 100930
MD5:  60673A78686A6D0FAF2DC9545EB841CC

Download. Email me if you need the password. Same pass scheme as Contagio

Android Fakeguard

October 2012

Research: Android FakeGuard - Symantec
Sample credit: Sanjay

The Trojan may arrive as a package with the following characteristics: 

Package name: com.stech.stopphishing 
APK: 

• com.stech.stopphishing.apk
• com.stech.spamguard.apk
• com.stech.stopphishing.apk

File: com.stech.spamguard-6.apk

Size: 210418

MD5:  74089D836A3D6768F766A85422819D21

Download. Same password scheme as contagio. Email me if you need the password.



File: com.cn.smsclient-8.apk
Size: 210430
MD5:  12CBEDC185D82C61150D8C9EE38A9FCB

Download. Same password scheme as contagio. Email me if you need the password.