TrojanSpy:AndroidOS/Ewall.A

TrojanSpy:AndroidOS/Ewall.A is a trojan that affects devices running on Android operating systems and sends user information to a remote server.

Installation

This trojan may be distributed as a wallpaper application and when installed, it may display a graphic such as the following:

Payload

Sends data to a remote server
This trojan captures the following data and sends it to a remote server named "im<removed>et.us" for collection by a remote attacker:

• Device ID and software version
• Build display and model
• Network operator (provider) and type
• SIM country and serial number
• Subscriber ID
• Voice mail number
• Total memory

Analysis by Haoran Yu