• Post author:
  • Post category:Mobile / Security
  • Post comments:30 Comments
  • Reading time:57 mins read

Last Updated on August 11, 2011

Update August 14: After the list (and the subsequent turmoil) here is the Look Inside a Year Of Android Malware.

So here it is the full list of Android Malware in a very dangerous year, since August, the 9th 2011 up-to-today.

My birthday gift for the Android is complete: exactly One year ago (9 August 2010) Kaspersky discovered the first SMS Trojan for Android in the Wild dubbed SMS.AndroidOS.FakePlayer.a. This is considered a special date for the Google Mobile OS, since, before then, Android Malware was a litte bit more than en exercise of Style, essentially focused on Spyware. After that everything changed, and mobile malware targeting the Android OS become more and more sophisticated.

Scroll down my special compilation showing the long malware trail which characterized this hard days for information security. Commenting the graph, in my opinion, probably the turning point was Android.Geinimi (end of 2010), featuring the characteristics of a primordial Botnet, but also Android.DroidDream (AKA RootCager) is worthwhile to mention because of its capability to root the phone and potentially to remotely install applications without direct user intervention.

As you will notice, the average impact is low, but, the number of malware is growing exponentially reaching a huge peak in July.

Let’s go in this mobile malware travel between botnets, sleepwalkers, biblic plagues and call Hijackers, and meanwhile do not forget to read my presentation on how to implement a secure mobile strategy.

Date Description Features Overall Risk
Aug 9 2010

First SMS Android Malware In the Wild: The malicious program penetrates Android devices in the guise of a harmless media player application. Once manually installed on the phone, the Trojan uses the system to begin sending SMSs to premium rate numbers without the owner’s knowledge or consent, resulting in money passing from a user’s account to that of the cybercriminals.

Aug 17 2010 AndroidOS_Droisnake.A

This is the first GPS Spy Malware disguised as an Android Snake game application. To the victim, Tap Snake looks like a clone of the Snake game. However, once someone installs this app on a phone, the “game” serves as a front for a spy app that proceeds to run in the background, secretly reporting GPS coordinates back to a server. The would-be spy then pays for and downloads an app called GPS Spy and enters an email address and code to gain access to the victim’s uploaded data.

Android MarketGPS Spy
Sep 14 2010 SMS.AndroidOS.FakePlayer.b

Pornography lands on Android! This malware is a variant of SMS.AndroidOS.FakePlayer.A. The malware poses as a pornographic application whose package name is pornoplayer.apk, and it installs on the phone with a pornographic icon. When the user launches the application, the malware does not show any adult content and, instead, sends 4 SMS messages to short codes, at the end-user’s expense.

Oct 13 2010

Pornography back on Android! Third variant of the malware SMS.AndroidOS.FakePlayer.A. New pornographic application, old icon. Sends 2 SMS messages to short codes, at the end-user’s expense.

Dec 29 2010

First example of a Botnet-Like Malware on Android. “Grafted” onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets. Once the malware is installed on a user’s phone, it has the potential to receive commands from a remote server that allow the owner of that server to control the phone. The specific information it collects includes location coordinates and unique identifiers for the device (IMEI) and SIM card (IMSI).

Botnet Like Features
Feb 14 2011
Android.Adrd AKA Android.HongTouTou

New Malware with Botnet-like Features from China. The trojan compromises personal data such as IMEI/IMSI of the device and sends them back to the remote side to react based on the commands from there. Similar to Android.Geinimi but with a lower profile (less commands)

Botnet Like Features
Feb 22 2011 Android.Pjapps

New Trojan horse embedded on third party applications. It opens a back door on the compromised device and retrieves commands from a remote command and control server.

Botnet Like Features
Mar 1 2011 Android.DroidDream AKA Android.Rootcager AKA AndroidOS_Lootoor.A

The first example of a new generation of Mobile Malware: distributed through the Official Android Market, affected, according to Symantec 50,000 to 200,000 users. Expoits two different tools (rageagainstthecage and exploid) to root the phone

Android MarketBotnet Like FeaturesRoot

Mar 9 2011 Android.BgServ AKA Troj/Bgserv-A AKA AndroidOS_BGSERV.A

Trojanized version of the Android Market Security tool released by Google, on March the 6th, to remove the effects of DroidDream. The trojan opens a back door and transmits information from the device to a remote location. It shows more than ever security and reputation flaws in the Android Market Proposition Model. 5,000 users affected.

Android MarketBotnet Like FeaturesRoot

Mar 20 2011 Android.Zeahache

Trojan horse that elevates privileges on the compromised device, discovered on a Chinese language app available for download on alternative Chinese app markets. The app has the ability to root an Android device (by mean of the exploid tool called by zHash binary), leaving the device vulnerable to future threats. The app, which provides calling plan management capabilities was found also on the Android Market albeit this version lacked the code to invoke the exploit.

Android MarketRoot

Mar 30 2011 Android.Walkinwat

Manually installed from non-official Android Markets, the Trojan modifies certain permissions on the compromised device that allow it to perform the following actions: Access contacts in the address book, ccess network information, access the phone in a read-only state, access the vibrator on the phone, Check the license server for the application, find the phone’s location, initiate a phone call without using the interface, open network sockets to access the Internet, read low-level log files, send SMS messages, turn the phone on and off. It gives a message to user trying to discipline users that download files illegally from unauthorized sites.

May 9 2011

Android.Adsms AKA AndroidOS_Adsms.A

This malware specifically targeted China Mobile subscribers. The malware arrived through a link sent through SMS. The said message tells the China Mobile users to install a patch for their supposedly vulnerable devices by accessing the given link, which actually leads to a malicious configuration file. The malware then send message to premium numbers.

Android Market

May 11 2011

Android.Zsone AKA Android.Smstibook

Google removed a Trojan, Zsone, from the Android Market with the ability to subscribe users in China to premium rate QQ codes via SMS without their knowledge. 10,000 users affected.

Android Market

May 22 2011


A biblical plague For Android! Trojanized version of a legitimate application that is part threat, part doomsayer. The threat was embedded in a pirated version of an app called ‘Holy ***king Bible’, which itself has stirred controversy on multiple forums in which the app is in circulation. The malware targeted North American Users. After the reboot, it starts a service whichm at regular intervals, attempts to contact a host service, passing along the device’s phone number and operator code. It then attempts to retrieve a command from a remote location in intervals of 33 minutes. In addition to having abilities to respond to commands through the Internet and SMS, the threat also has activities that are designed to trigger on the 21 and 22 of May 2011, respectively (The End of The World).

Android Market

Botnet Like Features

May 31 2011


A brand new version of Android.DroidDream, dubbed DroidDreamLight, was found in 24 additional apps repackaged and redistributed with the malicious payload across a total of 5 different developers distributed in the Android Market. Between 30.000 and 120.000 users affected.

Android Market

Botnet Like Features

Jun 6 2011

Android/DroidKungFu.A AKA Android.Gunfu

Malware which uses the same exploit than DroidDream, rageagainstthecage, to gain root privilege and install the main malware component. Once installed, the malware has backdoor capabilities and is able to: execute command to delete a supplied file, execute a command to open a supplied homepage, download and install a supplied APK, open a supplied URL, run or start a supplied application package. The malware is moreover capable to obtain some information concerning the device and send them to a remote server: The collected information include: IMEI number, Build version release, SDK version, users’ mobile number, Phone model, Network Operator, Type of Net Connectivity, SD card available memory, Phone available memory. In few words, the device is turned into a member of a botnet.


Botnet Like Features

Jun 9 2011


Trojan Horse that attempts to send premium-rate SMS messages to predetermined numbers. When an infected application is installed, it attempts to exploit the udev Netlink Message Validation Local Privilege Escalation Vulnerability (BID 34536) in order to obtain “root” privileges.  Once running with “root” privileges it installs an executable which contains functionality to communicate with a control server using HTTP protocol and sends information such as Subscriber ID, Manufacturer and Model of the device, Version of the Android operating system. The Trojan also periodically connects to the control server and may perform the following actions: send SMS messages, remove SMS messages from the Inbox and dial phone numbers. The Trojan also contains functionality to monitor phone usage.

Botnet Like Features

Jun 9 2011

Android.Uxipp AKA Android/YZHCSMS.A

Trojan Horse that attempts to send premium-rate SMS messages to predetermined numbers. Again the threat is as an application for a Chinese gaming community. When executed, the Trojan attempts to send premium-rate SMS messages to several numbers and remove the SMS sent.
The Trojan sends device information, such as IMEI and IMSI numbers.

Android Market

Jun 10 2011

Andr/Plankton-A AKA Android.Tonclank 

This is a Trojan horse which steals information and may open a back door on Android devices. Available for download in the Android Market embedded in several applications, when the Trojan is executed, it steals the following information from the device: Device ID and Device permissions. The above information is then sent to a remote server from which  the Trojan downloads a .jar file which opens a back door and accepts commands to perform the following actions on the compromised device: copies all of the bookmarks on the device, copies all of the history on the device, copies all of the shortcuts on the device, creates a log of all of the activities performed on the device, modifies the browser’s home page, returns the status of the last executed command. The gathered information is then sent to a remote location.

Although this malware does not root the phone, its approach of loading additional code does not allow security software on Android to inspect the downloaded file in the usual “on-access” fashion, but only through scheduled and “on-demand” scans. This is the reason why the malware was not discovered before.

Android Market

Botnet Like Features

Jun 15 2011


Trojan found in alternative Android markets that predominately target Chinese Android users. This Trojan predominantly affects devices with a custom ROM. The application masquerades as a legitimate one and exploits a vulnerability found in the way most custom ROMs sign their system images to install a secondary payload (without user permission) onto the ROM, giving it the ability to communicate with a remote server and receive commands. Once installed the second payload may read, send and process incoming SMS messages (potentially for mTAN interception or fraudulent premium billing subscriptions), install apps trasparently, communicate with a remote server using DES encryption.

Botnet Like Features

Jun 20 2011


This trojan is automatically downloaded to a user’s phone after visiting a malicious webpage that imitates the Android Market. The Trojan, which targets users in the United States by interacting with a number of premium SMS subscription services without consent, is able to sign-up a victim to a number of premium SMS subscription services without the user’s consent.  This can lead to unapproved charges to a victim’s phone bill. Android users are directed to install this Trojan after clicking on a malicious in-app advertisement, for instance a Fake Battery Saver.

Jul 1 2011

Android.KungFu Variants

Repackaged and distributed in the form of “legitimate” applications, these two variants are different from the original one by  re-implementing some of their malicious functionalities in native code and supporting two additional command and control (C&C) domains. The changes are possibly in place to make their detection and analysis harder.

The repackaged apps infected with the DroidKungFu variants are made available through a number of alternative app markets and forums targeting Chinese-speaking users.

RootBotnet Like Features
Jul 3 2011 AndroidOS_Crusewin.A AKA Android.Crusewind

Another example of a trojan which sends SMS to premium rate numbers. It also acts as a SMS Relay. It displays a standard Flash icon in the application list. The Trojan attempts to download an XML configuration file and uses it to retrieve a list of further URLs to send and receive additional data. The Trojan also contains functionality to perform the following actions: delete itself, delete SMS messages, send premium-rate SMS messages to the number that is specified in the downloaded XML configuration file, update itself.

Jul 6 2011

AndroidOS_SpyGold.A AKA Android.GoldDream

This backdoor is a Trojanized copy of a legitimate gaming application for Android OS smartphones. It steals sensitive information of the affected phone’s SMS and calls functions, compromising the security of the device and of the user. It monitors the affected phone’s SMS and phone calls and sends stolen information to a remote URL. It also connects to a malicious URL in order to receive commands from a remote malicious user.

Botnet Like Features

Jul 8 2011 DroidDream Light Variant

New variant of DroidDream Light in the Android Market, immediately removed by Google. Number of downloads was limited to 1000 – 5000. This is the third iteration of malware likely created by the authors of DroidDream.

Android Market

Botnet Like Features

Jul 11 2011

Android.Smssniffer AKA Andr/SMSRep-B/C AKA Android.Trojan.SmsSpy.B/C AKA Trojan-Spy.AndroidOS.Smser.a

ZiTMO arrives on Android!
This threat is found bundled with repackaged versions of legitimate applications. When the Trojan is executed, it grabs a copy of all SMS messages received on the handheld device and sends them to a remote location.

Jul 12 2011

Android.HippoSMS AKA Android.Hippo

Another threat found bundled with repackaged versions of legitimate applications. When the Trojan is executed, it grabs a copy of all SMS messages received on the handheld device and sends them to a remote location.

Jul 15 2011


This threat is often found bundled with repackaged versions of legitimate applications. The repackaged applications are typically found on unofficial websites offering Android applications. When the Trojan is executed, it steals information and sends it to a remote server.

Botnet Like Features

Jul 15 2011

Android/Sndapps.A AKA Android.Snadapps

Five Android Apps found in the official Android Market share a common suspicious payload which upload users’ personal information such as email accounts as well as phone numbers to a remote server without user’s awareness.

Android Market

Botnet Like Features

Jul 27 2011


Trojan horse which steals several information from Android devices (for instance GPS Location or Wi-Fi position). For the first time on the Android Platform a malware is believed  to spy conversations.

Botnet Like Features

Jul 28 2011


Trojan horse that sends SMS messages to premium-rate phone number. When the Trojan is executed, it retrieves information containing premium-rate phone numbers from a malicious URL then sends premium-rate SMS messages. and attempts to block any confirmation SMS messages the compromised device may receive from the premium-rate number in an attempt to mask its activities. The Trojan also attempts to gather IMSI and location information and send the information to the remote attacker.

Aug2 2011


This is a detection for Trojan horses that send SMS texts to premium-rate numbers. These Trojan is a repackaged versions of genuine Android software packages, often distributed outside the Android Marketplace. The package name, publisher, and other details will vary and may be taken directly from the original application..

Aug 9 2011


It belongs to the same NickiSpy family. However, it is significantly different from its predecessor since it is fully controlled by SMS messages instead of relying on a hard-coded C&C server for instructions. In addition, NickiBot supports a range of bot commands, such as for (GPS-based) location monitoring, sound recording and (email-based) uploading, calllog collection, etc. It also has a check-in mechanism to a remote website. his threat is often found bundled with repackaged versions of legitimate applications. The repackaged applications are typically found on unofficial websites offering Android applications. When the Trojan is executed, it steals information and sends it to a remote server.

Botnet Like Features


Parallel Market

Android MarketAndroid Market

Manual Install

Automatic Install of Apps

Send SMS or Calls to Premium Numbers

Botnet Like Features Server C&C

GPS SpyGPS Spyware

Root Root Access

This Post Has 30 Comments

  1. mobiappmax

    Wow didn’t realise how much of a problem malware on phones had become!!

  2. mobiappmax

    very nice it is the perfect malware fighter it is expected to have great future.

  3. sean

    Wow didn’t realise how much of a problem malware on phones had become!!

  4. MAC

    Has anyone got any firm figures of the number of infections reported or attempted infections? I have contacted all of the prominent antivirus companies and they won’t say…..it is all starting to look suspicious.

    1. Paolo Passeri

      You are right, information concerning number of infections is missing (or incomplete) from Vendors’ malware databases. So far with a quick search (but the info may be clearly incomplete), I only found data for DroidDream (maybe the one with the higher impact since it has been the first malware in the official market) for which Symantec reports 50,000-200,000 infections (or better downloads which is not the same thing). The only other malware for which I found some data is Android.Zeahache (from LookOut).

      But if, for instance, you look at the Android.Rootcager definition on Symantec database: http://www.symantec.com/business/security_response/writeup.jsp?docid=2011-030212-1438-99 the reported number of infections is 0-49, while another blog from the same company reports 50,000 – 200,000 downloads (http://www.symantec.com/connect/blogs/new-android-threat-gives-phone-root-canal)

      Very strange indeed.

  5. Matt

    Talakitok :
    Could you please tell me which malware listed above that asks the user: “Is it OK for me to steal your data”? Android apologists have lost their senses. It’s “till death do us part” to them. I call them android martyrs.

    Yes, there is a list of permissions that you are asked to approve before you install any app. If you download a calculator app and see it wants access to your contacts, to your SMS messages and the Internet and you say “OK” then you deserve everything that’s coming to you.

    1. Talakitok

      I think you have to review my post and the poster before me to get the clear conversation. I’m posting against his comment regarding the question the program or the malware ask to the user. If you could not understand my argument then we’re not in the same level and there’s no point to converse further.

  6. Sined

    Talakitok :
    Could you please tell me which malware listed above that asks the user: “Is it OK for me to steal your data”? Android apologists have lost their senses. It’s “till death do us part” to them. I call them android martyrs.

    This is exactly the kind of post that would come from an ignorant fool who has never used Android. Any app you install asks for a list of permissions before it can be installed, if you see “Requires Access to Sensitive Information” (yes there is a requirement for that) and you say yes for an app that normally doesnt need such permission then you are a quality grade A moron. Before you spew out more bovine manure out your sorry excuse for a mouth how about you learn a bit more about what you are bashing.

    1. A380

      +1 to that. A Google+1 that is.
      Just another misguided iFollower.

      This Engadget article is deeply unfair/unbalanced and I would expect there is a big fat check is on its way from Cupertino.

    2. Talakitok

      My comment was a response to the previous post that states a different argument. I think you must also add the quote the previous poster to get the whole conversation.

      But if you insist to butt in and defend android for its faults then I understand.

      I feel your sorrow and frustration… It’s no denying that you’re hurting because what I said is true. You’re one of them that want to believe that your choice is the greatest and don’t want to accept any criticism to your chosen platform. I pity you. So poor and unfortunate soul.

  7. AV

    Typical someone is getting paid to talk shit about android , they deny
    it but it is true.

    1. Paolo Passeri

      @AV: the problem is not to talk shit about Android, but rather to enhance user awareness since the issue concerning android model for application permission and provenance is real, and further enhanced by sideloading.
      Have a look to this excellent report by Symantec to compare the security model of Android and iOS: http://bit.ly/iZceu4
      BTW I own an Android device, and convinced my relatives and friends to jump on GoogleOS!

      1. A380

        It might be a real problem, but it’s tiny! And with Engadget sourcing this, it gets blown completely out of proportion!!!

        The people who get infected phones tend to have VERY GOOD REASONS (i.e. going to the wrong places on the internet and downloading the wrong files). It’s not like it’s been spreading to innocent people with Android phones.

        I’m willing to pay this price, if this is a real price at all, for freedom from the iMaffia.

  8. Decius

    Of Course Engadget would source this! Not only have you miss spelled so many times in the Trojan Information box, but the threat level of each risk as at medium at best.

    The most ‘notorious’ of trojans hit maybe topping 20,000 Users. What do you expect when phones get more modern, you can’t expect/assume that every application you download on any marketplace is going to be 100.00% Safe.

    It’s bad enough the Author misspelled words like; Exploit… Come on really?

    These trojans could be worse, it could stop the phone from working if you don’t hold it correctly. I heard this happened to a phone company except wait!! I don’t think it was a trojan!

    1. Talakitok

      Do you mean we should not believe this article because it has misspelled words? Or are you saying that any or all of the listed trojans above doesn’t really exist? Finally, are you saying that having these trojans in android should be tolerable?

    2. Jake

      Uh oh someones mad about the truth. Android is a hotbed for malware due to Google’s lax attitude towards threats.

  9. Jason

    On an underground site some user is demoing a C & C bot controlled via HTTP for sale. It’a crazy.

  10. Mike D.

    Wow… I’m glad i don’t have an Android phone… security is clearly not their priority.

    On a per device and per app basis, there’s more Android malware out there than Windows malware!

    1. Ed Burnette

      Most of these required user permission. Would you call a PC program that asked you if it was OK to erase your disk malware if you clicked ‘yes’ and then it erased your disk?

      1. Talakitok

        Could you please tell me which malware listed above that asks the user: “Is it OK for me to steal your data”? Android apologists have lost their senses. It’s “till death do us part” to them. I call them android martyrs.

      2. Ryan Thompson

        I don’t carry a PC in my pocket to make phone calls, bad analogy. Regardless, yes, if that program were deceptively named, and I misread the question.

  11. John

    lol! android users need to install nortion antivirus ! Android is a malware infested junk

  12. Fabio

    Grande Paolo. Non credevo ai miei occhi quando ti ho visto quotato su Engadget!!!

    Fabio Pacione

  13. Ed Burnette

    Thanks for the list. If I could suggest an additional legend item, it would be to tell the difference between malware that asked for and was given explicit permission by the user to do what it does (for example send premium SMS messages) vs. malware that somehow got around the asking for permissions, i.e., did things that the user did not give it permission to do (for example gain root access and install other programs).

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.