Risiko: hoch (F-Secure), mittel (Symantec)
Typ: Spyware (Trojaner)
entdeckt am: keine Angabe
auch bekannt als: Flexispy.A [F-Secure], SYMBOS_FLEXSPY.A [Trend]

Information:
Symantec
Behavior
Spyware.FlexiSpy is spyware program that runs on either the Symbian OS or BlackBerry mobile devices. Once installed, it monitors phone call details and SMS text messages and sends them to a remote server.

F-Secure
Flexispy.A is a commercial spying application written for the Symbian OS. It records details of voice call information, SMS information and contents, and sends the details to a remote server.

When Flexispy.A is installed on the phone it will hide from Symbian's built in process menu and it does not have any visible user interface or icon. After Flexispy.A is installed on the phone, the only indication that it is installed is that the application removal menu has an additional application named "phones" in the list. This "phones" application cannot be removed with the application manager.

Flexispy.A has a hidden user interface that can only be accessed using a special code known to the person who has purchased the spying application and has installed it on the phone.

When Flexispy.A is active on the device, it will record details of all voice call and SMS information, and then later send those details to the FlexiSpy server.

technische Details:

On Symbian OS:
The spyware arrives on the device as the following file:
FSL_Nokia_[Cellular Phone Name].SIS

When a user opens the file, the phone installer will display a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device will prompt the user to install "Phones".

When executed, the spyware drops the following files to the device:
[DRIVE LETTER]:\system\recogs\FSLRECOG.MDL
[DRIVE LETTER]:\system\recogs\FXSMON.MDL
[DRIVE LETTER]:\system\apps\system\phones\FXSMON.EXE
[DRIVE LETTER]:\system\apps\system\phones\MONUNINS.EXE
[DRIVE LETTER]:\system\apps\system\phones\t4l.cfg
[DRIVE LETTER]:\system\apps\system\phones\Fxs_caption.rsc
[DRIVE LETTER]:\system\apps\system\phones\Fxs.rsc
[DRIVE LETTER]:\system\apps\system\phones\Fxs.app
[DRIVE LETTER]:\system\apps\system\phones\Fxs.aif
[DRIVE LETTER]:\system\apps\system\phones\MONITOR.DLL
[DRIVE LETTER]:\system\apps\system\phones\config.dat
[DRIVE LETTER]:\system\apps\system\phones\monitor.log
[DRIVE LETTER]:\system\apps\system\phones\phones.db


On BlackBerry:
The program arrives as the following Java application:
net_rim_app_console_pro.cod

Once installed, it monitors phone call details and SMS text messages and sends them to a remote server. The monitored logs can subsequently be viewed with a Web browser.

The program may contact the following Web sites:
[[Link nur für registrierte Mitglieder sichtbar.] [REMOVED]
[[Link nur für registrierte Mitglieder sichtbar.] [REMOVED]

[Link nur für registrierte Mitglieder sichtbar.]
[Link nur für registrierte Mitglieder sichtbar.]