{
  "family": "fakeinstaller",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:AndroidOS/Fakeinstaller is a massive, historically significant classification for a family of Android mobile malware designed to commit SMS Toll Fraud. These malicious applications masquerade as legitimate apps (like games, utilities, or even security software) on third-party app stores. Their sole purpose is to silently send premium-rate SMS text messages without the user's knowledge or consent, racking up massive charges on the victim's mobile phone bill.<br><br><b>Understanding Fakeinstaller (SMS Toll Fraud)</b><br>To an end-user, the infection often seems benign at first; the app might even provide the functionality it promised. However, the true impact is discovered weeks later when the mobile bill arrives. For a threat analyst, Fakeinstaller represents a highly lucrative, automated criminal enterprise that exploits the billing mechanics of mobile carriers.<br><br><b>Execution and Fraud Mechanics</b><br>Fakeinstaller is distributed primarily via unmoderated, third-party Android app stores or malicious links sent via SMS (Smishing). During installation, the crucial step occurs: the app requests the `SEND_SMS` Android permission. If granted, the malware activates upon installation or device boot (`RECEIVE_BOOT_COMPLETED`). It connects to a C2 server to retrieve a list of premium-rate shortcodes and the specific text strings required to trigger a billing event. It then silently sends these messages in the background (`T1624.001`). To evade detection by the user, many variants also utilize the `RECEIVE_SMS` permission to intercept and delete the confirmation texts sent back by the premium service, ensuring the victim remains unaware of the fraud.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct financial loss via carrier billing. Device-based IoCs include the presence of applications requesting SMS permissions (`SEND_SMS`, `RECEIVE_SMS`, `READ_SMS`) that have no legitimate need for them (e.g., a flashlight app requesting SMS access). A review of the device's outbound SMS logs (if the malware hasn't deleted them) will reveal texts sent to unknown 5-digit or 6-digit shortcodes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Fakeinstaller and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakeinstaller is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fakeinstaller establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakeinstaller typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Fakeinstaller compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Fakeinstaller should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Fakeinstaller?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakeinstaller frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Fakeinstaller across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Fakeinstaller by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1437",
    "T1498",
    "T1624.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1624.001",
      "name": "Data from Information Repositories: Short Message Service (SMS) (Intercepting and deleting billing confirmation texts)",
      "tactic": "Collection"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Though less DoS, it abuses network billing services)",
      "tactic": "Impact"
    },
    {
      "id": "T1437",
      "name": "Application Layer Protocol (Communicating with C2 to fetch premium shortcodes)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately uninstall the suspicious application via the Android Settings > Apps menu.",
    "Contact the mobile carrier immediately to report the fraud, request a refund for the premium SMS charges, and place a block on all premium-rate billing.",
    "Review all installed applications and revoke SMS permissions from any app that does not strictly require it (like messaging apps).",
    "Consider performing a factory reset of the device if multiple malicious applications were installed."
  ],
  "what_to_avoid": [
    "Do not allow users to 'sideload' applications (installing APKs from outside the official Google Play Store).",
    "Avoid blindly granting permissions during app installation; scrutinize why an app needs the access it requests."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}