TrojanSpy:AndroidOS/DDLight.A

TrojanSpy:AndroidOS/DDLight.A is a trojan that affects devices running on the Android operating system, such as mobile phones. The trojan collects information about the device, which it sends back to a remote attacker.

Installation

TrojanSpy:AndroidOS/DDLight.A may be downloaded as part of a repackaged Android application, bundled with legitimate applications.

In the wild, one such observed application is called "Hot Girls 3". When installed, it may display the following:

TrojanSpy:AndroidOS/DDLight.A is executed every time a phone-related activity happens, for example, when the user makes a call.

Payload

Downloads arbitrary files
When executed, TrojanSpy:AndroidOS/DDLight.A downloads files from certain servers. Servers it has been known to connect to in the wild are:

• ju5o.com
• mlo6.com
• ya3k.com

It also collects the following information about the device, which it sends back to a remote attacker:

• Phone IMEI
• Phone number
• Phone model
• Phone subscriber ID
• Phone SDK version

Analysis by Tim Liu