34 Repackaged Android Applications are Found in Official Market

June 02, 2011 By Claud Security Response - TAG： , , ,

On May 30, Software with embedded malware appeared on the official Android market. On June 2, according to statistics from multiple parties, there were 34 infected applications uploaded via 6 developer accounts (see the Appendix). It was reported that 30,000 to 120,000 users had downloaded the software and been compromised. As of this writing, Google has removed the software and accounts from the Android market.

After detailed analysis, Antiy Labs found that the malware that was embedded was com.passionteam.lightdd and that the attack method was similar to that of the DroidDream Trojan. In March of this year, DroidDream had been embedded into more than 50 types of software in Android official market and had infected many users.

The malware is composed of a service (com.passionteam.lightdd.CoreService) and a radio receiver (com.passionteam.lightdd.Receiver, see Figure 1). In addition, it contains a configuration file named prefer.dat. When its DES encryption is reversed, 3 remote server addresses can be found in the configuration.

Figure1: the malware contains a service and a receiver
Figure1: the malware contains a service and a receiver

Whenever the call state of the phone changes, the radio receiver will be triggered and the service will be started. The service will then set a 10-hour timer. After 10 hours, the malware will start collecting user information such as IMEI, IMSI, country, language, system version and the applications installed. Then, it will upload the information to a remote server specified by the configuration file.

Figure 2: the malware collects device information
Figure 2: the malware collects device information

Appendix

The accounts that uploaded the software, and all the 34 types of software that were implanted with malware.

1. Magic Photo Studio

  • Sexy Girls: Hot Japanese
  • Sexy Legs
  • Beauty Breasts
  • Sex Sound
  • Sex Sound: Japanese
  • HOT Girls 1
  • HOT Girls 2
  • HOT Girls 3
  • HOT Girls 4

2. Mango Studio

  • Floating Image Free
  • System Monitor
  • Super StopWatch and Timer
  • System Info Manager

3. E.T. Tean

  • Call End Vibrate

4. BeeGoo

  • Quick Photo Grid
  • Delete Contacts
  • Quick Uninstaller
  • Contact Master
  • Brightness Settings
  • Volume Manager
  • Super Photo Enhance
  • Super Color Flashlight
  • Paint Master

5. DroidPlus

  • Quick Cleaner
  • Super App Manager
  • Quick SMS Backup

6.GluMobi

  • Tetris
  • Bubble Buster Free
  • Quick History Eraser
  • Super Compass and Leveler
  • Go FallDown!
  • Solitaire Free
  • Scientific Calculator
  • TenDrip