Aliases

Trojan.SymbOS.Skuller.a (Kaspersky Lab) is also known as: SymbOS.Skulls (Symantec),   Troj/Skulls-A (Sophos),   SymbOS_SKULLS.A (Trend Micro),   SymbOS/Skulls.A (Grisoft),   SymbOS/Skulls.A (Panda),   SymbOS/Skulls.A (Eset)

Detection added	Nov 20 2004
Description added	Dec 29 2004
Behavior	Trojan

Technical details

This Trojan program infects mobile phones running Symbian. Any mobile running Symbian is potentially vulnerable.

The Trojan itself is an SIS file, usually called 'extendedtheme.sis', although it may have a different name. The file is 1,192,117 bytes in size.

The Trojan was distributed via a range of mobile phone forums. It was presented as a program with new icons, new wallpaper etc.

During installation, the Trojan creates the following information and application files:

• .\System\Apps\About\About.aif
• .\System\Apps\About\About.app
• .\System\Apps\AppInst\AppInst.aif
• .\System\Apps\AppInst\Appinst.app
• .\System\Apps\AppMngr\AppMngr.aif
• .\System\Apps\AppMngr\Appmngr.app
• .\System\Apps\Autolock\Autolock.aif
• .\System\Apps\Autolock\Autolock.app
• .\System\Apps\Browser\Browser.aif
• .\System\Apps\Browser\Browser.app
• .\System\Apps\BtUi\BtUi.aif
• .\System\Apps\BtUi\BtUi.app
• .\System\Apps\bva\bva.aif
• .\System\Apps\bva\bva.app
• .\System\Apps\Calcsoft\Calcsoft.aif
• .\System\Apps\Calcsoft\Calcsoft.app
• .\System\Apps\Calendar\Calendar.aif
• .\System\Apps\Calendar\Calendar.app
• .\System\Apps\Camcorder\Camcorder.aif
• .\System\Apps\Camcorder\Camcorder.app
• .\System\Apps\CbsUiApp\CbsUiApp.aif
• .\System\Apps\CbsUiApp\CbsUiApp.app
• .\System\Apps\CERTSAVER\CERTSAVER.aif
• .\System\Apps\CERTSAVER\CERTSAVER.APP
• .\System\Apps\Chat\Chat.aif
• .\System\Apps\Chat\Chat.app
• .\System\Apps\ClockApp\ClockApp.aif
• .\System\Apps\ClockApp\ClockApp.app
• .\System\Apps\CodViewer\CodViewer.aif
• .\System\Apps\CodViewer\CodViewer.app
• .\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.aif
• .\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.app
• .\System\Apps\Converter\Converter.aif
• .\System\Apps\Converter\converter.app
• .\System\Apps\cshelp\cshelp.aif
• .\System\Apps\cshelp\cshelp.app
• .\System\Apps\DdViewer\DdViewer.aif
• .\System\Apps\DdViewer\DdViewer.app
• .\System\Apps\Dictionary\Dictionary.aif
• .\System\Apps\Dictionary\dictionary.app
• .\System\Apps\FileManager\FileManager.aif
• .\System\Apps\FileManager\FileManager.app
• .\System\Apps\GS\GS.aif
• .\System\Apps\GS\gs.app
• .\System\Apps\ImageViewer\ImageViewer.aif
• .\System\Apps\ImageViewer\ImageViewer.app
• .\System\Apps\location\location.aif
• .\System\Apps\location\location.app
• .\System\Apps\Logs\Logs.aif
• .\System\Apps\Logs\Logs.app
• .\System\Apps\mce\mce.aif
• .\System\Apps\mce\mce.app
• .\System\Apps\MediaGallery\MediaGallery.aif
• .\System\Apps\MediaGallery\MediaGallery.app
• .\System\Apps\MediaPlayer\MediaPlayer.aif
• .\System\Apps\MediaPlayer\MediaPlayer.app
• .\System\Apps\MediaSettings\MediaSettings.aif
• .\System\Apps\MediaSettings\MediaSettings.app
• .\System\Apps\Menu\Menu.aif
• .\System\Apps\Menu\Menu.app
• .\System\Apps\mmcapp\mmcapp.aif
• .\System\Apps\mmcapp\mmcapp.app
• .\System\Apps\MMM\MMM.app
• .\System\Apps\MmsEditor\MmsEditor.aif
• .\System\Apps\MmsEditor\MmsEditor.app
• .\System\Apps\MmsViewer\MmsViewer.aif
• .\System\Apps\MmsViewer\MmsViewer.app
• .\System\Apps\MsgMailEditor\MsgMailEditor.aif
• .\System\Apps\MsgMailEditor\MsgMailEditor.app
• .\System\Apps\MsgMailViewer\MsgMailViewer.aif
• .\System\Apps\MsgMailViewer\MsgMailViewer.app
• .\System\Apps\MusicPlayer\MusicPlayer.aif
• .\System\Apps\MusicPlayer\MusicPlayer.app
• .\System\Apps\Notepad\Notepad.aif
• .\System\Apps\Notepad\Notepad.app
• .\System\Apps\NpdViewer\NpdViewer.aif
• .\System\Apps\NpdViewer\NpdViewer.app
• .\System\Apps\NSmlDMSync\NSmlDMSync.aif
• .\System\Apps\NSmlDMSync\NSmlDMSync.app
• .\System\Apps\NSmlDSSync\NSmlDSSync.aif
• .\System\Apps\NSmlDSSync\NSmlDSSync.app
• .\System\Apps\Phone\Phone.aif
• .\System\Apps\Phone\Phone.app
• .\System\Apps\Phonebook\Phonebook.aif
• .\System\Apps\Phonebook\Phonebook.app
• .\System\Apps\Pinboard\Pinboard.aif
• .\System\Apps\Pinboard\Pinboard.app
• .\System\Apps\PRESENCE\PRESENCE.aif
• .\System\Apps\PRESENCE\PRESENCE.APP
• .\System\Apps\ProfileApp\ProfileApp.aif
• .\System\Apps\ProfileApp\profileapp.app
• .\System\Apps\ProvisioningCx\ProvisioningCx.aif
• .\System\Apps\ProvisioningCx\ProvisioningCx.app
• .\System\Apps\PSLN\PSLN.aif
• .\System\Apps\PSLN\PSLN.app
• .\System\Apps\PushViewer\PushViewer.aif
• .\System\Apps\PushViewer\PushViewer.app
• .\System\Apps\Satui\Satui.aif
• .\System\Apps\Satui\Satui.app
• .\System\Apps\SchemeApp\SchemeApp.aif
• .\System\Apps\SchemeApp\SchemeApp.app
• .\System\Apps\ScreenSaver\ScreenSaver.aif
• .\System\Apps\ScreenSaver\ScreenSaver.app
• .\System\Apps\Sdn\Sdn.aif
• .\System\Apps\Sdn\Sdn.app
• .\System\Apps\SimDirectory\SimDirectory.aif
• .\System\Apps\SimDirectory\SimDirectory.app
• .\System\Apps\SmsEditor\SmsEditor.aif
• .\System\Apps\SmsEditor\SmsEditor.app
• .\System\Apps\SmsViewer\SmsViewer.aif
• .\System\Apps\SmsViewer\SmsViewer.app
• .\System\Apps\Speeddial\Speeddial.aif
• .\System\Apps\Speeddial\Speeddial.app
• .\System\Apps\Startup\Startup.aif
• .\System\Apps\Startup\Startup.app
• .\System\Apps\SysAp\SysAp.aif
• .\System\Apps\SysAp\SysAp.app
• .\System\Apps\ToDo\ToDo.aif
• .\System\Apps\ToDo\ToDo.app
• .\System\Apps\Ussd\Ussd.aif
• .\System\Apps\Ussd\Ussd.app
• .\System\Apps\VCommand\VCommand.aif
• .\System\Apps\VCommand\VCommand.app
• .\System\Apps\Vm\Vm.aif
• .\System\Apps\Vm\Vm.app
• .\System\Apps\Voicerecorder\Voicerecorder.aif
• .\System\Apps\Voicerecorder\Voicerecorder.app
• .\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
• .\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
• .\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
• .\System\Apps\WALLETAVOTA\WALLETAVOTA.APP

It also creates the files listed below:

• .\System\Libs\licencemanager20s.dll
• .\System\Libs\lmpro.r01
• .\System\Libs\lmpro.r02
• .\System\Libs\notification.cmd
• .\System\Libs\softwarecopier200.dll
• .\System\Libs\ZLIB.DLL

The application files created by the Trojan program are standard application files for the Symbian platform and do not contain any malicious code. The .aif files, however, are malicious; these create skull icons and block access to the application for which the skulls act as an icon.

All the applications on the telephone will cease to function. Once a telephone has been infected it can only be used to make calls; SMS, MMS, camera, organiser functions etc. will no longer work.