TrojanSpy:AndroidOS/DroidDream.A

Installation

TrojanSpy:AndroidOS/DroidDream.A can be downloaded from the Internet.
 
Upon installation, it displays the following text on the device, outlining its capabilities:

<

Payload

Steals information

TrojanSpy:AndroidOS/DroidDream.A is capable of the following:

• Accessing the Internet
• Accessing your device's SD card (including modifying and deleting the card contents)
• Toggling the Wi-Fi on and off
• Modifying the device's settings and system files
• Gaining highest privilege on the device's operating system
• Downloading other potentially malicious files into the device

TrojanSpy:AndroidOS/DroidDream.A also contains the following exploit code:

• rageagainstthecage
• exploid

Both are detected as Exploit:Unix/Lotoor, and can allow a remote attacker to gain administrator privilege to the underlying operating system of the mobile device. It also contains the following file, which is also detected as TrojanSpy:AndroidOS/DroidDream.A:

• sqlite_db

When installed, this file can steal the following information stored in the device and send the information to the remote address 184.105.245.17:

• IMEI
• IMSI
• Model
• ProductId
• Partner
• Language
• Country
• UserId

It is also capable of downloading other potentially malicious files into the device and can execute SQL commands. Analysis by Marianne Mallen