Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Trojan:SymbOS/Pbstealer.E


Discovered:
Aliases:


January 26, 2005
Trojan:SymbOS/Pbstealer.E
Trojan:SymbOS/Pbstealer.E

Malware
Trojan
SymbOS

Summary

Also known as a trojan horse program, this is a deceptive program that performs additional actions without the user's knowledge or permission. It does not replicate.



Disinfection & Removal

F-Secure Mobile Anti-Virus is capable to detecting and deleting the Pbstealer.E trojan. Pbstealer.E tries to remove itself after sending data over Bluetooth. This self-removal doesn’t always work, but fortunately it can be also removed by uninstalling it with Symbian application manager.



Technical Details

Trojan:SymbOS/Pbstealer.E steals information from a phone (Contacts, Notepad, Calendar, etc) and attempts to forward the stolen data to a random Bluetooth-accessible phone within range.


Payload

Pbstealer.E is distributed in a malicious SIS file that contains Pbstealer.E application file and string resource. When the SIS file is installed, Pbstealer.E starts automatically and shows the following text:

Compacting your contact(s), step2 Please wait againuntil done...

While showing the text, the Pbstealer.E reads all contacts information in the phone contact database, and copies the information to file C:\SYSTEM\MAIL\PHONEBOOK.TXT. In addition to contacts information, Pbstealer.E also copies the contents of Notepad and Calendar ToDo database files. But, this information is not very readable to receiver as the resulting file contains in the databases is in binary form. If the Notepad and Calendar are empty, it simply fails in execution. After building the text file, Pbstealer.E searches for the first device it finds over Bluetooth and sends the text file to it. When trying to send the file over Bluetooth, the Pbstealer.E uses repeated connection attempts, so that if user answers no, he will immediately get a second connection request. This technique is similar to the propagation tactic used by Cabir, except that Pbstealer will give up attempts after one minute and exit. If the user of the target phone accepts the Bluetooth transfer, he will receive a text file that contains information copied from the infected phones contacts database.


Note

Although Pbstealer.E uses Bluetooth for sending phone book data, this data is pure text and cannot infect the receiving device.







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Keep your mobile device protected




F-Secure Mobile Security will keep your mobile device protected on the go and enable you to find it in case you lose it