• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Malware   »   Fake Skype for Android Leads to Malicious .JAR File

Fake Skype for Android Leads to Malicious .JAR File

  • Posted on:July 6, 2012 at 1:30 am
  • Posted in:Malware, Mobile
  • Author:
    Karla Agregado (Fraud Analyst)
0

Following the fake versions of Instagram, Angry Birds Space, and Farm Frenzy apps, we recently spotted a website offering different fake Skype mobile apps for Android. But based on our analysis, these apps are actually malware that run on older Symbian versions or Android devices installed with apps that enable execution of Java MIDlet. Once installed, the malware send messages to premium numbers without users’ consent.

The website http://{BLOCKED}ndroidl.ru offers different versions of Skype app for Android. The said site is hosted on Russian domains, similar to the webpages we’ve seen hosting the fake Instagram and Angry Birds Space apps. During analysis, we attempted to download the said app, but noticed that the said app was being downloaded from another website, http://{BLOCKED}mobile.ne.

We also tried downloading the other Skype mobile app versions being offered by the site. Doing so, however, only lead us to the same .JAR file (instead of an .APK file, the expected download file for Android apps) downloaded from the same malicious site. This .JAR file (detected by Trend Micro as JAVA_SMSSEND.AB) is a Java MIDlet that poses as an installer of Skype for the Android platform. Once executed, the file displays the following interface:

Should users press the left soft key of their smartphone, it displays the following:

However, pressing the right soft key redirects the mobile device’s browser to the URL http://{BLOCKED}1.net/?u=1l4zi3m938o80vl. This malicious app functions to send SMS messages to specific numbers. As a result, affected users incur unnecessary monetary charges for these messages.

Though these fake Skype apps are marketed specifically to Android users, this malicious .JAR file executes on pre-SIS (Software Installation Script) Symbian phones or certain versions of Android that run Java MIDlet. For Android devices to run Java MIDlet, users must first install an app that enables the device to execute the said file. Typically, these type of apps are available on third-party app stores.

To have an an overview of the latest threats targeting Android devices, you may refer to our infographic Behind the Android Menace: Malicious Apps.

Trend Micro protects users from this threat via Smart Protection Network™ , which detects and deletes this malicious .JAR file. Access to related websites is also blocked via web reputation service. As an added precaution, users must refrain from downloading apps from dubious websites. Users should also make it a habit to read mobile apps ratings and reviews, to know which apps are safe to download.

To know more about how to enjoy your mobille devices safely and securely, you may refer to our comprehensive Digital Life e-guides below:

  • When Android Apps Want More Than They Need
  • 5 Simple Steps to Secure Your Android-Based Smartphones

With additional analysis from Christopher So.

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»
Tags: fake skypeskype app for android

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2018

  • Attackers are banking on network vulnerabilities and inherent weaknesses to facilitate massive malware attacks, IoT hacks, and operational disruptions. The ever-shifting threats and increasingly expanding attack surface will challenge users and enterprises to catch up with their security.
    Read our security predictions for 2018.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Necurs Evolves to Evade Spam Detection via Internet Shortcut File
  • Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant
  • XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
  • XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner

Popular Posts

  • New MacOS Backdoor Linked to OceanLotus Found
  • Monero-Mining HiddenMiner Android Malware Can Potentially Cause Device Failure
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner
  • ChessMaster Adds Updated Tools to Its Arsenal
  • Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.