Spygold trojan found in rogue android application

SonicWALL UTM Research team received reports of a rogue android gaming application spreading in the wild. The rogue application is a modified version of a legitimate game available on the android market. The modified application was found spying on call logs and text messages. SonicWALL advices users against installing applications from untrusted sources and to be wary of applications that request for suspicious permissions.

When the rogue application is downloaded and executed, it requests for the following permissions:

It performs the following activities when installed:

• It stores calls logs and text message periodically to the following locations

• The contents of the files storing call logs and text messages are shown below:
  • zjphonecall.txt:
    

    

  • zjsms.txt:
    

    

• It ensures service is started on reboot of the phone

• It scrounges device information
  • Grabs IMEI, IMSI and SIM number
    
• It uploads collected data to a remote server
  • http://{removed}.net/zj/upload/UploadFiles.aspx

SonicWALL Gateway AntiVirus provides protection against this threat with the following signature: