ThreatExpert Report: Trojan.AndroidOS.FakeLookout, Android.FakeLookout

Technical Details:

File System Modifications

The following files were created in the system:

Filename(s)

File Size

File Hash

Alias

%Temp%\AndroidManifest.xml

60,220 bytes

MD5: 0x167E30FC40B3828300FD6053FAA0F147
SHA-1: 0xECB07C10A6526A6D58E5F49D5CD0C5580F997C6A

(not available)

%Temp%\classes.dex

267,024 bytes

MD5: 0x47E2C8DFBCEB8EFB421F16BF434BD399
SHA-1: 0x15746E248CCD63525A513A5550491EFC8C045B36

Android.FakeLookout [Symantec]
Trojan.AndroidOS.FakeLookout [Ikarus]

%Temp%\META-INF\CERT.RSA

1,327 bytes

MD5: 0xC7E4FE0075B8AA7111FDB8DDB5C461DE
SHA-1: 0x6E248E24BAE1C50D1C49534229FFD9106C51F358

(not available)

%Temp%\META-INF\CERT.SF

1,358 bytes

MD5: 0x5886707028CF259C1954D60A7DCB6621
SHA-1: 0x3C93F761BD28EE0BC6DD2C49BF022426010542AC

(not available)

%Temp%\META-INF\MANIFEST.MF

1,305 bytes

MD5: 0x0017C1B738EB3C5D0134A0A8DDF20974
SHA-1: 0x0676DF60DF42AFD3630CE172CE05344559B30CC9

(not available)

%Temp%\res\drawable\beta_icon.png

2,311 bytes

MD5: 0x90B4619A0D39F8EAD9E44D6EDAB635F2
SHA-1: 0xDD1544392713275EF1C83266ED05E09E7D15E87F

(not available)

%Temp%\res\drawable\icon_v1_1.png

1,648 bytes

MD5: 0xD6FF355ECAE62249128CB7AB73A554C8
SHA-1: 0x77D3A49624D43C86B933254758004B6011811E41

(not available)

%Temp%\res\drawable\icon_v2_0.png

2,897 bytes

MD5: 0x597E08AE497A647443209424BBA3B2F2
SHA-1: 0x8C1C9D68CF3C8FADC9A6DEBE90640FCEC7030FE0

(not available)

%Temp%\res\drawable\logo.png

125,750 bytes

MD5: 0x1A32EF50FF847588251E7D6061D28109
SHA-1: 0x8E852DF2A6D7BC104A21F5EB08E3AC3A83F9B655

(not available)

%Temp%\res\drawable\notification.png

354 bytes

MD5: 0xE4C55EB0458BE3EDE691328FD54973DF
SHA-1: 0x74A9B2F2C7B92AA7C0A121E62C40CD8CE8A4DADB

(not available)

%Temp%\res\drawable\notification_gimp.xcf

1,749 bytes

MD5: 0x71499BDD971653D534033BC57F462007
SHA-1: 0xC1B374EE739B4AD6CF8554CCD1F0DDA697A23675

(not available)

%Temp%\res\drawable\notification_gimp_2.xcf

1,724 bytes

MD5: 0xBAA98A6DA7C6A8B440E37793E76C66FB
SHA-1: 0x66E00CAFB673503266773DA464DC5E45F043C68F

(not available)

%Temp%\res\drawable\scanned.png

150,494 bytes

MD5: 0x89EDD7B4A1A9B01762E4F300B905301F
SHA-1: 0x18D9EB76BA75BB6B1C7C87D4F5468DF41CB29C50

(not available)

%Temp%\res\drawable\widget_off.png

4,236 bytes

MD5: 0x55659A94C47BFCD24D49B75F31995A6B
SHA-1: 0x42ADACF2A47FF9D15F402403FEEB850CDA083942

(not available)

%Temp%\res\drawable\widget_on.png

4,344 bytes

MD5: 0x1006467E31DB084E10B8700A2C968A40
SHA-1: 0x31665B6066163F7D4BF7C035A1D3F96454E39EFF

(not available)

%Temp%\res\layout\server_control_activity.xml

1,152 bytes

MD5: 0x1E5EA8678EC1AA2E084B5AD69C449492
SHA-1: 0xED90DDD8D94E809633FA5C4A140FCC5367D093A2

(not available)

%Temp%\res\layout\widget.xml

1,096 bytes

MD5: 0x32C6B3C11DE1C9EC44F52412451CB783
SHA-1: 0x3A54F3BB73E6AFA50C496DBCFB29584F9B2B90AB

(not available)

%Temp%\res\xml\widget_provider.xml

628 bytes

MD5: 0xF45E8BADFA9A636EDD56BB3F01B65F85
SHA-1: 0x5F0493B0370FD9D5705D55BDE57F759A49F43DAA

(not available)

%Temp%\resources.arsc

3,228 bytes

MD5: 0x011CD8AD57BF8481293B541C7D4FEBFE
SHA-1: 0xBAD1497990DE02C22E46B4F6DA2F11B9C89A3B16

(not available)

[file and pathname of the sample #1]

429,800 bytes

MD5: 0x65BAECF1FE1EC7B074A5255DC5014BEB
SHA-1: 0x68ADC0730B86A346053E048B3D7708ED50BF7FF9

Trojan.AndroidOS.FakeLookout [Ikarus]

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%Temp%\META-INF
%Temp%\res
%Temp%\res\drawable
%Temp%\res\layout
%Temp%\res\xml

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Submission Summary:

Technical Details: