TrojanSpy:AndroidOS/YangaMon.A

TrojanSpy:AndroidOS/YangaMon.A is a trojan, which affects mobile devices, that can send and receive SMS messages, upload personal and phone-specific data to a web service, add bookmarks to the browser, change the Access Point Name (APN), and disable the device's Wifi.

Installation

TrojanSpy:AndroidOS/YangaMon.A may arrive in the device bundled with a game. When installed, it requests the following permissions:

• INTERNET
• ACCESS_NETWORK_STATE
• READ_PHONE_STATE
• WRITE_SMS
• RECEIVE_SMS
• SEND_SMS
• RECEIVE_BOOT_COMPLETED
• CHANGE_NETWORK_STATE
• WRITE_APN_SETTINGS
• ACCESS_WIFI_STATE
• CHANGE_WIFI_STATE
• WAKE_LOCK
• READ_HISTORY_BOOKMARKS
• WRITE_HISTORY_BOOKMARKS

Payload

Sends SMS, and changes device settings

TrojanSpy:AndroidOS/YangaMon.A monitors for the following events:

• Bootreceiver - if this event occurs, it sets up an alarm at a random time to perform malicious actions.
• Smsreceiver - if this event occurs, it sends a copy of the received SMS, including the sender's phone number, to a remote server via HTTP
• Alarmreceiver

If the Alarmreceiver event is received, it may perform the following actions:

• Turn off Wifi
• Add a new Access Point Name (APN) named cmcc and make it the default APN (note that a legitimate APN with the same name exists and may have been previously present in the device is the user subscribes to a particular service)
• Send an SMS to a mobile phone number randomly chosen from the following:
  • 13521419442
  • 13552040604
  • 13661258744
  • 13521273944
  • 13552040894
  • 13520931794
  • 13520234741
  • 13520234194
  • 13520234194
• Open a browser to a certain URL chosen by the remote server
• Add a bookmark to a certain URL chosen by the remote server

Analysis by Stefan Sellmer