'Geinimi' Trojan taking down Android devices in Asia

Andre Yoskowitz
30 Dec 2010 22:34

Lookout Mobile Security has reported this week that a new Android-based Trojan Horse dubbed "Geinimi" has been taking down Android devices in China over the past month.
So far, there have been no reported cases in Europe or the Americas, as the malware-infected apps have only been seen on Chinese mobile apps websites.

Says the security firm:

A new Trojan affecting Android devices has recently emerged in China. Dubbed “Geinimi” based on its first known incarnation, this Trojan can compromise a significant amount of personal data on a user’s phone and send it to remote servers. The most sophisticated Android malware we’ve seen to date, Geinimi is also the first Android malware in the wild that displays botnet-like capabilities. Once the malware is installed on a user’s phone, it has the potential to receive commands from a remote server that allow the owner of that server to control the phone.
Geinimi is effectively being “grafted” onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets. The affected applications request extensive permissions over and above the set that is requested by their legitimate original versions. Though the intent of this Trojan isn’t entirely clear, the possibilities for intent range from a malicious ad-network to an attempt to create an Android botnet.

If the phone is infected, "it has the potential to receive commands from a remote server that allow the owner of that server to control the phone," says Lookout. "Though the intent of this Trojan isn't entirely clear, the possibilities range from setting up a malicious mobile ad network to creating an Android botnet."

A couple of the games tainted with the Trojan are Monkey Jump 2, Sex Positions, President vs. Aliens, City Defense and Baseball Superstars 2010.

The company makes it clear that any apps coming directly from the Google Android Market are safe.