About Me

Jimmy Shah
Jimmy Shah is a Mobile Security Researcher for McAfee, specializing in analysis of mobile threats on existing ...

Blogs

Consumer (478)
Corporate (155)
Enterprise (466)
McAfee Labs (1126)

Tags

#SecChat $1 million guarantee 12 Scams of Christmas access to live fraud resolution agents Acquisition Alex Thurber Android antivirus Apple botnet Channel Partners cloud security Compliance Consumer counter identity theft credit card fraud and protection credit fraud alerts credit monitoring credit monitoring and resolution critical infrastructure Cyber Security Mom cyberbullying Cybercrime cybermom data breach data center data center security Data Protection Dave DeWalt DLP Email & Web Security embedded encryption Endpoint Protection enterprise facebook fake anti-virus software Family Safety Friday Security Highlights global threat intelligence google government Hacktivism how to talk to kids how to talk to teens identity fraud identity fraud scams identity protection identity protection $1 million guarantee identity protection fraud identity protection surveillance identity surveillance identity theft identity theft expert identity theft fraud identity theft protection identity theft protection product Identity thieves and cybercriminals intel iphone kids online behavior lost wallet protection malware McAfee McAfee Channel McAfee Family Protection McAfee Identity Protection McAfee Initiative to Fight Cybercrime McAfee Labs McAfee security products Mid-Market Mobile mobile malware mobile security monitor credit and personal information Network Security online personal data protection online safety Operation Aurora PCI personal identity theft fraud personal information loss personal information protection phishing privacy proactive identity protection proactive identity surveillance Public Sector restore credit and personal identity Risk and Compliance scam scams scareware security smartphones social media social networking social networks spam Stuxnet twitter vulnerability Web 2.0 work with victim restore identity

McAfee Labs :

Want spies with that?

Wednesday, December 6, 2006 at 1:48am by Jimmy Shah

We’ve received a sample of a new mobile malware in the MultiDropper family, variant CG. MultiDroppers are like a collection of top 10 hit songs, a ‘hits CD’. They also require about as much creativity. Take a successful hit like SymbOS/Cabir or SymbOS/Commwarrior, mix in a SymbOS/Appdisabler or SymbOS/Skulls.

The trouble with hits CDs is that you probably already own all the albums containing the hits. Maybe you get a bonus song now and then. In the same manner we already detect most of the malware in most mobile MultiDroppers. Every so often we do get the bonus unseen or rare single (malware).

MultiDropper.CG is the first in the series to include spyware, SymbOS/Mobispy.A.

SymbOS/Mobispy.A is based on an early version of commercial call and SMS recording software. SymbOS/Mobispy.A installs on a phone and records incoming and outgoing SMS messages. It also tracks the phone numbers of all dialed and received calls. The purchaser of the software gets an account on a central server. SymbOS/Mobispy. A sends all the data it’s captured to that account.

Considering that data-stealing and other for-profit malware have made their entrance on mobile phones, it is worrisome to see spyware make its debut. Around eight months ago a commercial remote phone monitoring application was released. There was much speculation on how much time it would take for malware authors to integrate it into their own malware. We have seen malware authors create custom prototype code to implement new attacks but it is interesting to see them purchase commercial spyware to do their job for them.

It would appear that the SymbOS/MultiDropper.CG author has made a wise choice in using commercial products, avoiding the hassle and expense of creating a new hit single by using an existing one. There are two things though that complicate the picture:

The software is licensed for only one phone ID(IMEI). As soon as the monitoring account on the central server receives logs from an unregistered IMEI it’s expected to be shut down.
It is unlikely that the author of SymbOS/MultiDropper.CG is the original purchaser of this copy of the software. Only the original purchaser would have access to the results of SymbOS/Mobispy.A’s spying.

Although SymbOS/MultiDropper.CG does not appear likely to be a winner, it does signify a probable switch in malware authors’ goals. Rather than destroying your data and information, they’re stealing it for profit.

Submit your own comments / message for this post

Comments (8)

cindy September 7, 2010 7:15AM

mcafee said to send this virus in ur lab cause it cannot be deleted i tried the scanning 2 times and restart my computer everytime then scanning again its still cant be deleted the file name is Artemis!2746A132D0A7

connie January 24, 2010 5:32AM

I have an unwanted spyware on my computer, Macafee says it can not completely remove it. Can you help me? Thank You.

Jackie Aron November 20, 2009 11:50AM

I have unwanted adware on my computer.It can’t be completely removed. I tried to unistall the ioio mechanic program off the computer, but its still here when I run a scan…that’s where my virus is. So McAfee said to go to spyware_researchlabs dot com put in (subject line “MAS Content in a .Zip file”) And put in a password infected but how do I do that? Please help…thanks

willie October 30, 2009 7:36AM

i have unwanted adware on my computer and cant remove it .and artemis!21c5d4a2e4eb.and cant remove it eather.can u help? its a ‘mas content’ in a zip file on my computer.

Linda June 5, 2009 1:29PM

I can not r3move from my coumper it said connot be completely. I need to go to spyware-reseatchlabs dot com ( Subject line: “Mas content”) in a Zip file must be no larger than 3 MB. okay what can I do? come back and help me please

janice May 15, 2009 7:58AM

( GENERIC PUP.X ) HAS SHOWN UP ON MY COMPUTER

I HAVE TRIED TO DELETE BUT SAYS IT CANNOT BE REMOVED COMPLETELY.

THIS IS A BRAND NEW LABTOP BOUGHT SINCE JANUARY AND LESS THAN A MONTH THIS HAPPENS

(I USE THAT JUNK CALLED MCAFEE) A MONEY MAKING PRODUCT BUT DOES NOT PROTECT YOUR COMPUTER WHEN UNKNOWN DOWNLOADS POSES TREAT’S
IT SHOULD BE TAKEN OFF THE MARKET BECAUSE YOU ARE WORKING ON YOUR COMPUTER AND UNKNOWN TO YOU THE PROGRAMS LIFT THE BAR OF SECURITY UNKNOWING TO YOU AND LEFT YOU VULNERABLE FOR THIS VIRUS. ITS NOT UNTIL YOU CHECK THE SECURITY LEVEL OF YOUR COMPUTER OR SCAN OT BEFORE YOU WILL RECOGNIZED THIS

damion April 29, 2009 8:27PM

i have a virus or trogan and some parts cant be removed so i need to know what to do next plz. The virus is called (generic PUP.x) i have mcafee but dont know waht to do. Thanks

CALVIN December 8, 2006 7:16PM

Nowadays, malware creator seems to be more sophisticated in creating “Rainbow” malware. In the past, they learnt from experience and eventually created dangerous or destructive malware. With Symbian OS Smartphones getting popular, opportunities for malware creator rise correspondingly.

The thing that I worried the most is, “Mobile Wallets” technology is being used widely in Malaysia. This will result in more payment solutions can be done using mobile phones. Interestingly, private data also keep flowing into mobile network. As always, when thereâ€™s money or private data, hackers will always try their best to “dig” out those confidential information.

Smartphone spyware seems to be harmful, especially to those who always use their mobile phone to do online banking. As always, I would like to emphasize on “Prevention is better than cure”. User should practice some security measures to protect themselves about latest mobile threats. Preferably, I would like to secure my phone with an extra shield, i.e. having an anti-virus in my phone system.

About Me

Feeds & Podcasts

Blogs

Meet the Bloggers

Archive

Tags

Want spies with that?

Submit your own comments / message for this post

Comments (8)