{"id":37085,"date":"2014-08-05T09:24:58","date_gmt":"2014-08-05T16:24:58","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=37085"},"modified":"2025-08-07T22:20:05","modified_gmt":"2025-08-08T05:20:05","slug":"chinese-worm-infects-thousands-android-phones","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/chinese-worm-infects-thousands-android-phones\/","title":{"rendered":"Chinese Worm Infects Thousands of Android Phones"},"content":{"rendered":"

Last weekend, it was reported in China that an SMS worm was wildly spreading among Android mobile phones, with more than 500,000 devices infected. The malware spread by sending SMS texts to a phone’s contacts with a message body such as:<\/p>\n

XXX\u770b\u8fd9\u4e2a\uff0chttp:\/\/cdn.<removed>.com\/down\/4279139\/XXshenqi.com<\/p>\n

\"SMS<\/a><\/p>\n

Worm + Trojan<\/h2>\n

This malware is much more than just a worm. It is actually a worm plus a Trojan. The Trojan component resides in another install package in the original one.<\/p>\n

Once the malware is installed, it checks whether the Trojan is installed. If not, it ask the user to install it.<\/p>\n

\"Install<\/a><\/p>\n

After installing, the malware sends a text message to a control server phone number, which we believe belongs to the author of this malware, to let him know that a new victim is infected.<\/p>\n

\"Reports<\/a><\/p>\n

The installation then asks the user to input his or her ID and name, which will also be posted to the control number.<\/p>\n

\"User's<\/a><\/p>\n

The Trojan monitors incoming SMS messages, forwards all incoming SMS messages to the control number, and executes the following commands:<\/p>\n