Android package file
The Trojan may arrive as a package with the following name:
When the Trojan is being installed, it requests permissions to perform the following actions:
- Read user's contacts data.
- Access information about networks.
- Open network connections.
- Write to external storage devices.
Once installed, the application will display an icon of a recharging battery power meter.
Alternatively, it will display an icon that states in Japanese "Secure Virus Scan".
When the Trojan is executed, it may display a screen with a recharging battery power meter and some Japanese characters.
Alternatively, it may display a screen stating that it is performing a virus scan.
The Trojan collects email addresses from the compromised device and sends the information to the following remote location:
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":