1

Mazar Bot is new Android malware that spreads via SMS.
Its capabilities: It can read incoming SMS and send itself, make calls to directory contacts, contaminate Chrome, access to the Network, read the phone status or query the network to know the status and completely erase the contents of storage.

What are the measures to be taken to protect against this new malware?
And what are the steps to follow for cleaning an infected smartphone?

Improve this question
2
  • Speaking Russian, and setting your language settings to Russian? – Matthew Feb 18 '16 at 12:03
  • 2
    Don't tap the link? Don't allow installation from unofficial sources? – kalina Feb 18 '16 at 12:24
8

The text message to infect your device with the Mazar bot looks like this:

You have received a multimedia message from +[country code] [sender number] Follow the link http: //www.mmsforyou [.] Net / mms.apk to view the message.

Don't run the link and you don't get infected.

You can also ensure that the option to not allow installation of applications from unknown sources (within Settings > Security) is enabled as this will also block the installation of the APK.

As noted in the post from Heimdal Security, Mazar won't install on a device with the language set to Russian,

the malware cannot be installed on smartphones running Android with the Russian language option. Mazar BOT will check the phone to identify the victim’s country and this will stop the malicious APK if the targeted phone turns out to be owned by a Russian user

Mazar will "gain boot persistence to help survive device restarts". To remove, nuke the device from orbit and start again.

Improve this answer
2
  • 1
    "Home ground" for malware? – Mindwin Feb 18 '16 at 12:53
  • What happens if you follow the link? Do you get prompted to install an app, or does the remote site somehow install the app without your permission? If it's the former (and it looks like it is), then basically the phone's owner has to make three mistakes to get infected: a) enable applications from unknown sources in settings, 2) follow the link, and 3) install the app. – Edward Falk Mar 21 '16 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.