Android Package File
The Trojan arrives as a package with the following name:
The Trojan will have the following name:
Détecteur de Carrier IQ
When the Trojan is being installed, it requests permissions to perform the following actions:
- Allow access to low-level system logs.
- Send SMS messages.
The Trojan pretends to be an application that will locate and remove the Carrier IQ software from the device.
If the user presses the "Désinstaller" button, the Trojan will send four premium SMS messages to 81168 containing the following text:
The Trojan will then ask the user if they wish to uninstall the Trojan.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":