Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 10.03.2006
auch bekannt als: SymbOS/Mabtal.A [McAfee ], Mabtal [F-Secure]

Information:

SymbOS.Mabtal.A is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan may attempt to install another Symbian threat onto the compromised device and a Windows Trojan horse onto the device's memory card. It also disables legitimate Symbian applications.

technische Details:

The Trojan reportedly arrives as the following file, disguised as Profimail v2.75_FULL.sis, a cracked version of a legitimate email application, Profimail. When a user opens this file, the phone installer will display a dialog warning users that the application may be coming from an untrusted source and may cause potential problems. If the user clicks yes, the device will display the following message prompting the user to install the threat:

Install
Profimail v2.75_FULL

The following message is also displayed during installation:

Profimail v2.25 multilingual pack cracked by [REMOVED]ker team! If you like it, please buy it, just crack for fun! ^_^

When SymbOS.Mabtal.A is executed, it performs the following actions:
Drops the following files:

C:\System\Apps\AppInst\Appinst.aif
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\caribe\caribe.rsc
C:\System\Apps\caribe\caribe.app - a copy of SymbOS.Mabir
C:\System\Apps\caribe\flo.mdl - a copy of SymbOS.Mabir
C:\System\Apps\Profimail\Data\messages.bin
C:\System\Apps\Profimail\Data\config.bin
C:\System\Apps\Profimail\Data\PM_S60.dta
C:\System\Apps\Profimail\Data\shop.txt
C:\System\Apps\Profimail\Data\Alert.mid
C:\System\Apps\Profimail\ProfiMail.rsc
C:\System\Apps\Profimail\ProfiMail.aif
C:\System\Apps\Profimail\ProfiMail.app
C:\System\Apps\ProfiExplorer\ProfiExplorer.app
C:\System\Apps\ProfiExplorer\ProfiExplorer.aif
C:\System\Apps\ProfiExplorer\ProfiExplorer.rsc
C:\System\recogs\flo.mdl - a copy of SymbOS.Mabir
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.RSC
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.APP - a copy of SymbOS.Mabir
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.SIS - a copy of SymbOS.Mabir
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ INFO.SIS - a copy of SymbOS.Mabir
C:\System\Fonts\11x12 euro_fonts.gdr - a copy of SymbOS.Fontal.A

Note: The overwritten AppInst, which is a ROM application installer application, will disable the application installer if the device is successfully rebooted.

Displays an error message and reboots, when the dropped ProfiMail file runs. Then the dropped SymbOS.Fontal.A file will prevent the device from booting.

May prevent the compromised device from restarting as some dropped files are corrupted.

The following file is also created by the device installer, not the Trojan itself:

\system\install\Profimail v2.75_FULL.sis

[Link nur für registrierte Mitglieder sichtbar.]