To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.
Malware Overview
This Symbian malware is a Symbian Information Source (SIS) file that arrives as a dropped component of SYMBOS_DROPPER.A.
Upon installation, it drops files that are also detected by Trend Micro as SYMBOS_KIAZHA.A.
It creates a registry entry to ensure its automatic execution at every startup.
It then executes several .EXE files that perform different routines on the affected mobile phone.
Apart from this Symbian malware, the following are also dropped by SYMBOS_DROPPER.A:
- SymbOS_BESELO.A
- SYMBOS_COMWAR.A
This SIS file package can act as a rogue anti-spyware tool that will install other malware into the system and then flag them as malicious. This routine is intended to prove their claim that other Symbian malware are indeed present on the system.