Fake Flappy Birds on Android

An article at Naked Security mentions that fake versions of the popular Android game "Flappy Birds" are hiding premium SMS Trojans. A couple of examples of this can be found at the links below. Be careful as these are current live links to Android Trojans and can be harmful to your device. Always be mindful of any software coming from secondary markets.

• hxxp://mfile[dot]me/upload/bookmark/2014/0208/choingaygame/1391825505/flappy-bird[dot]apk
• Virus Total Analysis
• hxxp://mfile[dot]me/upload/apk/zenthang/20140206/com.dotgears.flappybird[dot]apk
• Virus Total Analysis

Stay safe out there
-R`/4N

Fake Google Market Forces Premium Sign-Up

     A blog post by ThreatTrack Security showed an example of another fake Google market.  This has been done so much in the past that it's easy to look past these threats.  I posted about fake markets in the past here and here. However, the apps located on this one has changed up the rules a tiny bit.  Instead of just sending a few premium SMS texts and being done with it, these sign you up to a daily service fee of 9.99 rubles a day. That's about 32 cents a day in U.S.dollar.  Over the course of a month or a year this will add up, especially if going unnoticed.

   As always the end user only receives apps that he or she would have received for free on the real Play Market or the Amazon App Market. Of course even Google can't keep all malware of it's market.  With the recent release of the BadNews Trojan on Google Play, even after all of the safeguards where put into place,  it shows that it is good practice to keep an updated Anti-Virus app installed.

The Fake Google Market can be found at: hxxp://play-android-markt.com/. (Live Link to Malware)

A bad app download Example (Live Malware):  hxxp://app.play-android-markt.com/files/get?filename=it.android.demi.elettronica&scheme=app&projectId=5585&namespace=wapcash&applicationName=ElectroDroid&url=http://androsportal.com&image=http://play-android-markt.com/play-android-markt.com/0/ru/images/icon_9010550421218012627_2.png&icon=http://play-android-markt.com/play-android-markt.com/0/ru/images/icon_9010550421218012627_1.png&size=509&theme=

The VirusTotal of the example can be found: here.

Stay safe out there
 -R`/4N

Talking Tom Talks You Into SMS Fraud

The Russian market is now over-run with fake Android Apps. You can search the Russian search engine Yandex for just about any Android app you can think of and put the term "apk ru" (without the quotes) at the end of the app name and you are bound to get bad search results. They will scam you with every ploy in the book to get you to download and install. Promise you free versions of paid software, better versions of free software, security updates, software updates or even offer extra benefits with download.

This example a site claims to host a Russian language version of Talking Tom Cat.
The site can be found at:
hxxp://tom-talking-cat[dot]ru/.
The download at:  
hxxp://filegx.com/load/8924/Talking-Cat[dot]apk.
You may need to download on a mobile device or in Malzilla with a Android user agent. Check here for a how-to.

Instead of a talking Russian cat, you get the same old SMS scam that has been re-hashed for over a year now. The Virus Total results confirm that this is just garbage and the screenshot to the right shows that you aren't getting a talking cat. It's worth a note that this is the same fake opera scam that first started it all.

To stay protected make sure to download good antivirus software for your phone.

Stay safe out there
-R`/4N

Shop Amazon Gold Box - New Deals. Everyday

How bad can live wallpaper be?

So, you're surfing the net with your phone and find a site with some awesome live wallpapers on it.  It looks pretty decent and even has a silly name of gama-rama.net, so you click one of the wallpapers. I clicked on a Matrix one for this example. Then you blindly click through the permissions without looking because its just the same standard garbage that all the other apps have.  Well, guess what? your phone is now infected and you will see it on your next phone bill..

While this is an extreme circumstance that you may think would never ever happen. It actually does all the time. There are plenty of people who keep downloading and installing stuff like this. Just take a look at this article from the BBC showing how a French hacker amassed a collection of 500,000 euros in little under a year by defrauding 17 thousand people with Android software exactly like this.

So how do we know that this is a Trojan before we download it.  First thing it is recommended to only install items from the Google Play store.  However, Google has limitations on what they put out and the "live wallpapers" form an alternate market are very alluring.  So the next thing to do would be to get a good Anti-Virus on your phone. Like this one here for Symantec, or you can check out this post for other options. This way you can download what you want and still feel safe.

If you don't want AV software or think that it is not required on your device then just be very wary of permissions that you grant software installed on your phone. If you check out the public online mobile-sandbox, I sent this file for analysis. As you can see below it asks to send SMS.  This is a big warning sign that it may be bad.

So, check out the Virus Total report and you can see this is a variant of the Trojan Android.Boxer that I have posted about before here. You can find some more research on what boxer does here or here and although there are many different variants the one thing that doesn't change is that it will add a few bucks to your phone bill and steal some of your devices info.

You can download this directly from:
hxxp://gama-rama.net/walpapers/The_Matrix___Live_Wallpaper_1.4.0[dot]apk
Warning: This is a direct address with no password and will link to the file through a series of redirects.

Stay safe out there
-R`/4N

Fake Need for Speed is Two Part SMS Scam

RESEARCH:

• Personal Research:
• The fake Android game of Rockstar's Need For Speed is used as a the first part of a Trojan designed to send premium rate SMS messages.
• After install it asks the user to download a required Flash Player update to finish installing the game.
• This Fake flash player update is the part of the malware doing the work.  It will send a premium rate SMS that charged to the users phone bill then install a valid copy of Adobe Flash Player.  
• No valid version of NFS is ever installed.
• Please note that this scam is in Russian and must be side-loaded onto the phone.

MD5:

• com.rockastar.nfss_1.apk : 
• 52FADDBF80D97B93209BC0929B666049
• Flash_Player_install.apk: 
• 8C806A367D97532CA438F40C26AF14D2

VIRUS TOTAL:

•  com.rockastar.nfss_1.apk: 
• https://www.virustotal.com/file/a9ab7fce522a30fa74f245b0226d0f2ebe454e8a0b4365b3551cff89d6e9e2b6/analysis/1352839363/
• Flash_Player_install.apk: 
• https://www.virustotal.com/file/bf38fb1f9661eb7a1dfeaf374c31cb86b71ca3ccef484a798cbd3b9198f34d71/analysis/1347042569/

CAPTURED SAMPLES:

• WARNING: These are direct non pass-worded links to the APKS and are harmful if loaded on the phone.  DOWNLOAD WITH CAUTION. 
• com.rockastar.nfss_1.apk: 
• hxxps://www.dropbox[dot]com/s/ydw3rpgfysycmft/com.rockastar.nfss_1.apk
• Flash_Player_install.apk:
• hxxp://mobi-go[dot]in/load.php?d=gp&f=1223&s=6343&PHPSESSID=419b55b5dgcptskmm9si752l24

MY OPINION:

• This is very similar to other Android scams in the past that use a payload.  The lack of permissions on the first part is meant to trick the user into thinking it is safe. A user having already gone through the first install is more likely to continue on even though more alerting permissions are needed. Some researches labeled this as a hoax because it is thought that the 2nd part is not related. They believe that someone found the Fake Flash Player download and created the first part that calls it just to be malicious.

MORE RESEARCH:

• Research to Similar Scams in the past that I think this is related to. 
• http://www.gfi.com/blog/gta-vice-city-android-game-installs-sms-sending-boxer-variant/
• http://www.symantec.com/security_response/writeup.jsp?docid=2012-070909-0726-99
• http://www.zdnet.com/warning-gta-super-mario-on-google-play-are-android-malware-7000000716/