MMarketPay.A, New Android Malware Found in the Wild
By TrustGo Security Labs On July 6, 2012 In Malware, Security
On the 4th of July 2012, we uncovered a new malware that can download paid apps and contents from China Mobile’s Mobile Market. It placed orders automatically on behalf of users and could cause unexpected high phone bills. TrustGo Security Labs named it as: Trojan!MMarketPay.A@Android.
MMarketPay.A may arrive as repackaged applications with the following package names:
This virus is already found in following 9 China markets. More than 100,000 devices have been infected.
- nDuoa http://www.nduoa.com
- GFan http://www.gfan.com
- AppChina http://www.appchina.com
- LIQU http://www.liqucn.com
- ANFONE http://www.anfone.com
- Soft.3g.cn http://www.soft.3g.cn
- TalkPhone http://www.talkphone.cn
- 159.com http://soft.159.com
- AZ4SD http://www.az4sd.com
HOW IT WORKS
Mobile Market (http://mm.10086.cn/) is an Android Market hosted by China Mobile, one of the largest wireless providers on the planet. It hosts both free and paid applications and multimedia contents. Its payment workflow for paid application is as following:
- Customers login at M-Market website (http://mm.10086.cn/). No login required if customer use If you are using CMWAP as Access Point.
- M-Market will send a verification code to you via SMS if customer purchased paid apps or contents.
- Customers receive the verification code and input it to M-Market for verification
- Once the verification completed, the market will download apps automatically. China Mobile will add this order in customers’ phone bill.
MMarketPay.A can place orders via M-Market payment system automatically:
- Change the APN to CMWAP, so that it can login MMarket automatically.
- Find paid application and simulate the click action in background.
- Intercept the received SMS messages and collect verification code sent by M-Market.
- If CAPTCHA image is invoked, it will post the image to remote server for analyzing the verification code.
- Post the verification code to M-Market website.
- Download the application and customers get charged.
Following screenshot of malicious code shows the whole auto payment process.
Besides paid apps, M-Market also offers paid video contents. MMarketPay.A can also search, play and pay for the paid video contents on M-Market. Following piece of code shows the paid video auto play.
In summary, this sophisticated new malware could cause unexpected high phone bills. TrustGo recommends customers only download apps from trusted app stores and download a mobile security app which can scan malware in real-time.