Android package file
The Trojan may arrive as a package with the following details:
When the Trojan is being installed, it requests permissions to perform the following actions:
- Initiate a phone call without using the Phone UI or requiring confirmation from the user.
- Open network connections.
- Check the phone's current state.
- Read user's contacts data.
- Access information about networks.
Once installed, the application will display an icon with the Japanese text "Will you win??"
When the Trojan is executed, it displays a page with Japanese text that reads, "Will you win?? Unfortunately you didn't win."
It then collects the following information:
- Display name, email address, and phone number from the user's Contacts
- Phone number of the compromised device
It sends it to the following location:
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":