Do not sideload this app on your Android phone!
The notification on the phone in this picture is from the spyware, not the app
Once the app is installed, “the device gets registered with the Firebase Command and Control (C&C) with details such as the presence or absence of WhatsApp, battery percentage, storage stats, the token received from the Firebase messaging service, and the type of internet connection.” The spyware is triggered when multiple conditions take effect such as the addition of a new contact, the receipt of a new SMS, or the installation of a new app. The spyware is always looking for something to, well, spy on. If it detects that a phone call is taking place it will record the conversation, add the updated call log, and store the information to a command and control (C&C) server as an encrypted ZIP file. To make sure that there are no traces of what happened, the spyware deletes the files as soon as it receives a thumbs up from the server stating that the files have been received.
The data is then placed into several folders in the spyware’s private storage. One characteristic of the spyware is that it always wants fresh data. For example, if the malicious software is set to collect a new photo after 40 minutes, that is exactly what will happen. Location data is collected via GPS or through the network depending on which one has more recent data. If the current data is more than five minutes old, the location data is collected and stored once again.
The spyware will create a fake notification if the infected device’s screen is off when a command is received using the Firebase messaging service. of the things that this spyware does includes stealing thumbnails of images and video.
There is no doubt that this is a dangerous app. Perhaps the best thing you can do is stay away from sideloading an app called “Software Update.” Or you might want to consider staying away from third party app stores altogether. After all, check this list of things that this malicious app can do:
- Steal instant messenger messages;
- Steal instant messenger database files (if root is available);
- Inspect the default browser’s bookmarks and searches;
- Inspect bookmark and search history from browsers such as Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
- Search for files with certain extensions such as.pdf, .doc, .docx, and .xls, .xlsx;
- Inspect data from the clipboard;
- Inspect the content of notifications;
- Record audio and phone calls;
- Take pictures on a timed basis through the front or back cameras;
- Create a list of installed apps;
- Monitor the GPS location;
- Steal SMS messages; phone contacts, images & videos, and call logs;
- Removing device information device such as installed applications, device name, and storage stats; and
- hiding the icon from the device’s app drawer and menu.
You can see why it is important to avoid this app at all costs.
