Trojan:AndroidOS/HipSMSer.A

Trojan:AndroidOS/HipSMSer.A is a torjan that affects mobile devices running the Android operating system. It sends an SMS to a premium number, thus charging the user without his or her knowledge.

Installation

When installed, Trojan:AndroidOS/HipSMSer.A may display the following images:

Payload

Sends SMS to premium numbers
Trojan:AndroidOS/HipSMSer.A sends an SMS to the premium number "1066156686". It then blocks the device from receiving SMSes from numbers starting with "10", such as "10086". This is to ensure that the user is unaware that a premium-rate SMS has been sent to a certain number, thus allowing the user to be charged for the SMS without his or her knowledge.

Allows data and device access
Trojan:AndroidOS/HipSMSer.A requests for the following permissions upon installation:

• Allow the application to open network sockets
• Allow the application to access information about the network
• Allow mounting and unmounting of the file system for removable storage
• Allow the application to send SMS messages
• Allow the application to write to external storage
• Allow the application to receive the ACTION_BOOT_COMPLETED command that is broadcast after the device finishes booting
• Allow the application to monitor, record, and process incoming SMS messages
• Allow the application to write SMS messages
• Allow the application to read SMS messages
• Allow the application to install shortcuts

Analysis by Tim Liu