Skulls.D is a malicious SIS file trojan, that pretends to
be Macromedia Flash player for Symbian Series 60 devices.
Skulls.D drops SymbOS/Cabir.M worm into the phone,
disables system applications and third party applications
needed to disinfect it and displays animation that
shows flashing skull picture.
Unlike earlier Skulls versions the Skulls.D disables only
few phone system applications. The only system applications
that are disabled, are the ones that are needed in disinfecting it.
The third party applications disabled by Skulls, are ones that
user would need to disinfect his phone, if it got infected by skulls.
However for some reason Skulls.D copies the replacement files to the
device memory card, thus disabling the tools only if user has not
installed them on the C: drive.
Skulls.D tries to disable F-Secure Mobile Anti-Virus by replacing it's
files with non-functional versions. However as F-Secure Mobile Anti-Virus
is capable of detecting Cabir.M contained by Skulls using generic detection.
The Anti-Virus will detect the infected SIS file and prevent it from being
installed. Provided that the Anti-Virus is in realtime scan mode as it is
by default.
The Cabir.M worm dropped by Skulls.D is already detected with generic
detection as Cabir.Gen. So the Skulls.D is already detected and stopped
without need for updated Anti-Virus database.
The Cabir.M dropped by Skulls.C does not activate automatically,
but will activate on reboot.
The Skulls.D does also drop other application that will activate on device
reboot, this application displays animation of flashing Skull picture on
background, no matter what application user is trying to use.
If you have installed Skulls.D, the most important thing is not to
reboot the phone and follow the disinfection instruction in this
description.
Kill the Skulls animation process, so that you can use the phone normally:
1. Press menu button on the phone for 5 seconds to get Symbian process menu
2. Look for any suspicious process, such as Caribe or Yewsprite
3. Select suspicious process and kill it with 'C' button
4. Repeat for all other processes
Installation to system
Skulls.D is a SIS file that replaces system ROM binaries related to
application uninstall and bluetooth control, drops Cabir.M and other
applications into the system and disables third party file managers
and tries to disable F-Secure Mobile Anti-Virus.
Spreading in infected SIS files
Skulls.D has been found both as independent SIS file, and as embedded
SIS in which the host SIS file pretends to contain cracked game or application.
Payload
Replaces built in and third party applications with non-functional ones, installs
Cabir.M worm and starts animation that shows flashing skull picture.
![](/images/pixel.gif"){kind=tracking}
