Security researchers from FireEye Labs have discovered six variants of new Android malware dubbed “Android.HeHe,” which is capable of stealing SMS and monitoring phone calls.
The malware is distributed as a security update for the Android OS. Once it infects a device, it communicates with the command and control (C&C) server and monitors incoming SMS.
The phone details including, IMEI number, IMSI (International Mobile Subscriber Identity), phone number, operating system version, phone model, are transferred to the C&C server.
It also checks if the IMSI code is null, so that it can determine if it is running on an emulator or a real device (Emulators do not have an IMSI code).
The C&C server responds to the device with a list of phone numbers. If the infected device receives an SMS or a phone call from one of these numbers, the threat monitors the message or call.
Text messages from one of these numbers are collected and stored on the attacker's server. Phone calls from these numbers are blocked or dropped.
