Android package file
The Trojan may arrive as a package with one of the following names:
When the Trojan is being installed, it requests permissions to perform the following actions:
- Allow read-only access to the phone state
- Open network sockets
- Send SMS messages
- Set the wallpaper
- Write to an external storage device
This Trojan poses as a Super Mario wallpaper app.
When executed, the Trojan requests the user to click Next to continue the installation of the app.
The Trojan then connects to the following location:
It downloads the following app from the above location:
A Super Mario screensaver can then be used on the device.
The Trojan sends a SMS message to the premium-rate number 3170.
The app is removed after the SMS message is sent.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":