TrojanSpy:AndroidOS/Nickispy.A

TrojanSpy:AndroidOS/Nickispy.A is a malicious program that affects mobile devices running the Android operating system; it may be distributed as an app named "Android System Message", that collects information from the mobile device then attempts to send this data to a remote attacker.

Installation

Upon execution, TrojanSpy:AndroidOS/Nickispy.A runs itself as a service named "com.nicky.lyyws.xmall", from here its presence can be seen in the 'Running services' menu:

Payload

Steals sensitive information

TrojanSpy:AndroidOS/Nickispy.A has been observed logging data about the following from an affected device:

• Voice calls
• SMS messages
• GPS location information
• International Mobile Equipment Identity
• IP address

The malware stores the voice call data on the SD card in a folder named '/sdcard/shangzhou/callrecord', and creates a timer event to initiate data collection and upload these details to a remote host.

Contacts remote host

TrojanSpy:AndroidOS/Nickispy.A attempts to connect to a remote server at ann.56mo.com via port 2018, and upload the stolen data.

Additional information

An uninstaller for "Android System Message" may be available on the affected mobile device; an affected user may be able to use this uninstaller to remove the trojan.

Analysis by Sergey Chernyshev