Trojan:AndroidOS/Fakebrows.A is a trojan that targets mobile devices running the Android platform. It disguises itself as a legitimate app.
This threat sends multiple SMS messages to a premium number.
Installation
Trojan:AndroidOS/Fakebrows.A disguises itself as a legitimate browser app localized for Russian language speakers. When users try to install it, it may ask for access to the following data:
- Personal information, such as the phone's state, calendar events, emails, and contacts
- Permission to send and receive SMS and MMS messages
- Permission to access network communication and system level alerts
The prompt for your permission may look like the following:
We've seen this threat pretend to be the following apps:
- Navitel Navigator
- Opera Mini Browser:
Payload
Sends messages to premium numbers
Trojan:AndroidOS/Fakebrows.A displays a fake progress bar, so that it appears as if it is downloading an app into your mobile device:
It then displays a statement of agreement indicating the cost of the download:
This roughly translates to the following:
Initialization
Confirm agreement with the rules of loading <Android app - in this case, Navitel>. To continue the download, then click Next.
If you tap on the "Agree" button, Trojan:AndroidOS/Fakebrows.A sends multiple SMS messages to premium numbers at your expense.
The expenses are as follows:
For Russia:
Send up to 3 SMS messages on the service numbers:
7151 (MTS 33.87 rubles., Megaphone £ 35.40., Beeline £ 40.00).
9151 (MTS 101.60 rubles., Beeline 111.00 rubles., Megaphone £ 140.42).
2855 (Megaphone 200.00rub., Beeline 170.00 rubles., MTS 203.20 USD).
Send up to 2 SMS messages to the service number:
3855 (Beeline 300.00 rubles., Megaphone £ 300.00., MTS 304.79 USD).
If you tap on the "Agree" button again, you may see the following screen containing a URL supposedly where the app can be downloaded:
This roughly translates to the following:
Completed
Activation completed successfully. You will receive an SMS message with a link to <Android app>, after which the download will be available.
If the message does not come, you can download <Android app> at http://<download URL>, and then click Next to automatically reboot.
Analysis by Zarestel Ferrer
