FakeAV holds Android Phones for Ransom

Avast Mobile Security Avast Mobile Security for Android
1

Are we protected against this by avast!?

polonus

2

Here is more information,

http://arstechnica.com/security/2013/06/device-disabling-fake-av-migrates-to-android-phones-demands-ransom/

http://www.symantec.com/security_response/writeup.jsp?docid=2013-060301-4418-99

http://www.symantec.com/connect/blogs/fakeav-holds-android-phones-ransom

http://video.symantec.com/services/player/bcpid292374537001?bckey=AQ~~,AAAABuIiy9k~,I8BhasVwr9zYL9V36WFi86fR_NoePscn&bctid=2496711760001

3

Any Virustotal link?

4

Does avast! detect this?
http://bgr.com/2013/06/24/android-malware-fake-antivirus/

5

Yes, this malware is detected via scanner.

6

Not really: https://www.virustotal.com/en/file/983e662c5fa649ab25a5209d8996d6ddf581f15ef73d8e14c8360125d2c5f920/analysis/1372331050/

I have sent the sample number of times since yesterday :o

7

This is strange. Last VPS contains this signature. Anyway thanks for report I will push it forward and check if everything is running ok.

8

Wait…you mean 130626-1,right?

It may happen latest VPS is not released in my area!?

9

Could be it, but still, we should push the new version for all users.

10

Well,you are right,but if it is that way then why avast scanner on VT doesnt detect it too!? I am sure avast will detect this in next VPS :slight_smile:

Thanks for your reply Jan.Much appreciated.

11

Still not detected :-\

12

Now is fully deployed, so please try; you should see:

Trojan detected - Android:Defender -C [Trj]
Trojan detected - Android:Defender -A [Trj]
Trojan detected - Android:Defender -B [Trj]
Trojan detected - Android:FakeAV -D [Trj]

13

Thanks now detected ;D

And guess what!? avast the one among the few to detect this: https://www.virustotal.com/en/file/983e662c5fa649ab25a5209d8996d6ddf581f15ef73d8e14c8360125d2c5f920/analysis/