Malware Analysis Reports

Detailed analysis of how the malware works and how it can be removed.

Item	Date
Q1 2012 Malware Report This quarterly report shows general trends found in the first quarter of 2012 for malware infections in residential households or infections in mobile devices and computers connected through mobile adapters or tethered through a mobile device. This report highlights top security threats including DNSChanger, Zero Access and Flashback.	05/09/2012
Encrypted p2p C&C for ZeroAccess/Sirefef Botnet This is an analysis of an encrypted p2p command and control protocol used by malware identified as ZeroAccess, Sirefef, Vobfus and many of other names. The scale of the infection is quite large. Since November we have seen p2p connections to over 500,000 different peers.	02/28/2012
Geinimi Trojan for AndroidOS This malware has been identified as another variant of Geinimi, which targeted a significant number of Android Phone users since December 2010. The Trojan was originally used as a package named “com.geinimi”, but over a period of time the variants took on a more advanced obfuscated form.	11/18/2011
DroidDeluxe Trojan for AndroidOS The DroidDeluxe Trojan attempts to root the phone without the user’s knowledge, changes file permissions to allow world-write access to some system files and sends information about the phone to Google Analytics. Once the damage is done the user will require root access to undo the access permission changes that were made.	10/31/2011
Spitmo for AndroidOS Spitmo is a variant of the SpyEye Banking Trojan targeted at Android phones. “Spitmo” stands for “SpyEye In The Mobile” and is regarded as the SpyEye equivalent of Zitmo (Zeus in the mobile).	10/28/2011
DroidKrungFu.A Trojan for AndroidOS This Trojan affecting Andriod-based smart phones can be attached to a variety of legitimate apps. The infected application used in this analysis was a Chinese SIP Video Phone application based on “linphone” that is used as part of a dating/romance service.	10/17/2011
GGTracker.A Trojan for AndroidOS The GGTracker Trojan joins a list of malware affecting Android smartphone users. GGTracker intercepts SMS messages, blocks messages from specific phone numbers and also scans the file system and sends any logged SMS messages.	09/29/2011
Walk&Text Trojan for AndroidOS This Walk&Text application is actually Android malware that contains no code to support any Walk&Text functionality. Instead, it sends your contact list to a server and sends embarrassing SMS messages to everyone on your contact list.	09/22/2011
ZitMo Trojan for AndroidOS ZitMo is an Android version of the Zeus in the Mobile Trojan, which works in conjunction with the Zeus banking Trojan to steal login information or money from your bank account.	09/14/2011