1. /
  2. Security Response/
  3. Android.Mobinaspy

Android.Mobinaspy

Updated:
November 15, 2011 4:05:11 PM
Type:
Spyware
Infection Length:
Varies
Name:
SMS Spy
Version:
1.6.0
Publisher:
mobinauten
Risk Impact:
High
Android package file
The application arrives as the following application package:

APK: de.mobinauten.smsspy.apk
Version: 1.6.0
Publisher: mobinauten
Name: SMS Spy


Installation
The application must be manually installed.

The application will create an entry with an icon containing the text "SMS SPY" in the Settings > Applications menu.


However, the icon will not appear in the standard Applications menu.

The application also creates a service with the following name:
EmergencyService


Permissions
When the application is being installed, it requests permissions to perform the following actions:

  • Monitor incoming SMS messages.
  • Send SMS messages.
  • Access location information, such as GPS information.
  • Read SMS messages on the device.
  • Create new SMS messages.
  • Check the phone's current state.
  • Read contact data.


System monitoring
The application monitors incoming SMS messages. If it receives a message with the following text, it will send back the device's GPS coordinates and a link to Google Maps:
How are you???


Other information
These SMS messages will be visible to the user, unless the attacker previously created a contact on the device with the following name:
systemnumber

If this contact exists, the SMS messages will be deleted before they are displayed.
Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver