In few days ago, Google released "Android Market Security Tool" that intented to recovery devices from the modification made by "DroidDream" trojans. This tool was automatically deliver to devices of users who had downloaded and installed infected applications.

   But according to the report in mobile.malware discussion group, a repackaged version was distributed in China local forum. Thanks for Justin Case offering the sample, and we identify it was the same as the "Fake10086" we discovered in one week before. Both of them utilize a Google Code project http://code.google.com/p/mmsbg/. Also thanks for Tim Wyatt from Lookout who send us private mail dated in March 05 to disclose this information.

    Related analysis can be found at:

By AegisLab