Trojan:Android/Torsm.A

Classification

Malware

Trojan

Android

Trojan:Android/Torsm, Android.Torec.A, Android/Torec.A, Torec, Andr/SMSTor-A, Backdoor.AndroidOS.Torec.a

Summary

Trojan:Android/Torsm.A is reportedly the first trojan to use the open-source, anonymizing Tor network to hide its communications with its Command & Control (C&C) structure. When active, the trojan monitors and intercepts incoming SMS messages, as well as sends SMSes to a specified number.

Automatic action

Once the scan is complete, the F-Secure security product will ask if you want to uninstall the file, move it to the quarantine or keep it installed on your device.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

For more Support

Community

Find the latest advice in our Community.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

When installed, Trojan:Android/Torsm.A will monitor and intercept incoming SMS messages and forward them to a number that can be specified in instructions sent via the C&C server. It can also harvest information from the device, including the phone number, device model and a list of installed apps.

Torsm.A is notable for the way it communicates with the attacker(s) controlling its operations, as the C&C server used by the operators is within the anonymizing Tor network. This makes it extremely difficult for security researchers and law enforcement authorities to takedown the server. Though this technique has been previously used with PC-based malware, this is the first known instance of an Android malware using the same technique to hide its communications.

The code for the Torsm trojan was reportedly based on the available, open-source Orbot Tor client, with additional code to enable the trojan's malicious functions. For more information, see: