{"id":37026,"date":"2014-07-31T23:30:05","date_gmt":"2014-08-01T06:30:05","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=37026"},"modified":"2025-05-29T03:31:01","modified_gmt":"2025-05-29T10:31:01","slug":"dhl-sms-spam-distributing-android-malware-germany","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/dhl-sms-spam-distributing-android-malware-germany\/","title":{"rendered":"‘DHL’ SMS Spam Distributes Android Malware in Germany"},"content":{"rendered":"

One of the most common methods for distributing PC malware is the use of email spam messages that pose as tracking notifications from popular delivery companies such as DHL Express, FedEx, or UPS. The reason for this popularity is the malware’s effectiveness. Most of the time the victim receiving the message can\u2019t resist opening the attachment file or clicking on a malicious link to know the current status of a hypothetical package. So many of us order items online these days that it\u2019s easy to fall into the trap.<\/p>\n

Spam Campaign Via SMS<\/h2>\n

The same approach can be effectively applied to infect mobile devices. We see it currently happening with a spam campaign via short message service (SMS) targeting German users by using a fake DHL tracking notification to distribute Android malware.<\/p>\n

Recently McAfee Labs received a mobile malware sample that is currently distributed as DHL.apk on the cloud storage service Dropbox. The complete URL is hidden using Google\u2019s URL shortening service goo.gl and used in an SMS spam campaign with the following text in German:<\/p>\n

“Ihr DHL Packung ist ihnen geliefert, verfolgen Sie online \u00fcber https:\/\/goo.gl\/<random>\u201d
\n(\u201cYour DHL package is delivered, track it online via …”)<\/p>\n

Once the application is downloaded and installed, the following icon appears in the home launcher pretending to be the Google Service Framework application:<\/p>\n

\"CASTILLO_SmsHndIcon\"<\/a>
\nWhen the malware is executed for the first time, it will ask for device administrator privileges to make its removal or uninstalling difficult. The app also simulates the loading of data:<\/p>\n

\"CASTILLO_SmsHndMainActivity\"<\/a><\/p>\n

What the malware is actually doing, however, is starting a service in the background that will constantly contact a remote control server to request commands to perform any of the following actions:<\/p>\n