Spygold trojan found in rogue android application
SonicWALL UTM Research team received reports of a rogue android gaming application spreading in the wild. The rogue application is a modified version of a legitimate game available on the android market. The modified application was found spying on call logs and text messages. SonicWALL advices users against installing applications from untrusted sources and to be wary of applications that request for suspicious permissions.
When the rogue application is downloaded and executed, it requests for the following permissions:
It performs the following activities when installed:
- It stores calls logs and text message periodically to the following locations
- Grabs IMEI, IMSI and SIM number
SonicWALL Gateway AntiVirus provides protection against this threat with the following signature: