Android package file
The Trojan may arrive as a package with the following characteristics:
When the Trojan is being installed, it requests permissions to perform the following actions:
- Access information about networks, including WiFi
- Allow read-only access to phone state
- Open network sockets
- Read or write the system settings
- Read and write the user's browsing history and bookmarks
Once installed, the application will display an icon with the text "Blackberry messenger".
Once the Trojan is executed, it displays a license agreement.
If the user accepts the agreement, the Trojan installs an adware program, and generates revenue from it.
Furthermore, the fake license agreement will keep appearing at random intervals.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":