Android Malware Using Blog As C&c Server

snoopy · Oct 5, 2011

Android Malware Using Blog as C&C Server

By Steve Ragan on October 05, 201

Researchers at Trend Micro have discovered a unique feature circulating in some Android-based malware. The malicious application is using a blog in China to act as a Command and Control (C&C) server.

Over the last year, rogue Android applications have made headlines, and stressed to consumers the need to stick with known Application repositories, such as the Android Marketplace. On Tuesday, Trend Micro discovered a malicious Android application out of China using a new trick to receive instructions. “This, based on our research, is the first time Android malware implemented this kind of technique to communicate with its server,” commented Trend’s Karl Dominguez, a Threat Response Engineer.

Disguised as a eBook reader, the application requests nearly total control over the mobile device when installed, including access to the Web, network settings, the ability to edit, read, and receive SMS or MMS messages, read and write to contact lists, disable key locks, make calls, and more.

“From our analysis, we found that this malware has two hard-coded C&C Servers to which it connects to receive commands and deliver payloads. The first server is just like the usual remote site, where the malware posts and gets information and commands. The second C&C server, however, caught our attention. The second C&C server is a blog site with encrypted content,” Dominguez notes.
Click to expand...

Article plus screenshot - http://www.securityweek.com/android-malware-using-blog-cc-server

Log in or Sign up

Android Malware Using Blog As C&c Server

snoopy Registered Members

Share This Page

Log in or Sign up

Android Malware Using Blog As C&c Server

snoopy Registered Members

Share This Page

Useful Searches