\u00a0Destruction Level<\/strong>: Moderate<\/p>\n Prevalence:<\/strong> Moderate<\/p>\n Trojans are malware types that introduce themselves as healthy and legal software and act similarly to practical and applicable software but cause many destructions to the system when executing. The downloaded software from the internet, placing HTML text, attaching it to an email, etc. are ways that Trojans use to enter the system. Contrary to viruses and computer worms, Trojans are not reproducible.<\/p>\n There are a bunch of infected applications aimed at phishing attacks and accessing users’ banking accounts distributed through prominent markets such as Caf\u00e9 Bazaar, and Myket as well as other illegible sites and markets, Telegram channels, or SMSes containing infected links. These kinds of malware represent themselves as legit and applicable applications but not only provide no useful and positive services, but will steal users’ important information using phishing attacks.<\/p>\n Their procedure is to give the clients false claims such as payment services, access to judiciary, and other financial and monetary services and sometimes demanded an amount of money through fake payment pages. As soon as the users enter their information (in the present malware the information is the Credit Card image) the attach will receive them, and the attacker can easily access the SMS, the user’s cellular data, and the second password to easily steal the money.<\/p>\n <\/p>\n The Vam Pey malware application receives permissions such as reading and receiving SMS when installed. Then after installation, it will display the following image, and after receiving the user’s personal information right after the authentication it demands the user to upload a national card picture, ID Card picture, Credit Card picture, and user’s picture. If the users upload their Credit Card picture, then the attacker can receive the user’s dynamic password by accessing SMS and steal all user’s money easily.<\/p>\n In this activity, the malware uses the POST method to inform its server that the user has installed the malware by sending the phone build ID.<\/p>\nWhat is the Trojan?<\/h2>\n
What is SmsSpy.Irpardakht malware family?<\/h2>\n
Technical Review
\nSigns of Infection<\/h3>\n![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2023\/02\/20.jpg\")
<\/h2>\nPerformance Description<\/h2>\n
The \u201cIr.pardakht.MainActivity\u201d Activity<\/h4>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2023\/02\/20-1.jpg\")
<\/p>\n