Android.Fauxtocopy

Type:

Spyware

Name:

Update

Version:

1.2

Risk Impact:

High

Behavior

Android.Fauxtocopy is a spyware application for Android devices that gathers photos from the device and sends them to a predetermined email address. 

Android package file
The Trojan arrives as one of the following application packages:

APK: Update.apk 
Name: Update


InstallationThe program must be manually installed.

The application will create an icon that looks like a cog wheel.


APK: Update.apk 
Name: Update


InstallationThe application must be manually installed.

The application will create an icon that looks like a cog wheel.



Permissions
When the application is being installed, it requests permissions to perform the following actions:

• Start once the device has finished booting.
• Write to external storage devices.
• Access information about the WiFi state.
• Open network connections.
• Access information about networks.
• Check the phone's current state.

System monitoringThe application will gather photos from the device and send them to a predetermined email address on a weekly basis. 


Functionality
This risk is a modified version of a legitimate application. The developer offers to create customized versions of the application for a fee, which contain customized email addresses, icons, and application names, in order to mask the risk on a compromised device.