Fakeinstaller

Overview

Trojan:AndroidOS/Fakeinstaller is a massive, historically significant classification for a family of Android mobile malware designed to commit SMS Toll Fraud. These malicious applications masquerade as legitimate apps (like games, utilities, or even security software) on third-party app stores. Their sole purpose is to silently send premium-rate SMS text messages without the user's knowledge or consent, racking up massive charges on the victim's mobile phone bill.

Understanding Fakeinstaller (SMS Toll Fraud)
To an end-user, the infection often seems benign at first; the app might even provide the functionality it promised. However, the true impact is discovered weeks later when the mobile bill arrives. For a threat analyst, Fakeinstaller represents a highly lucrative, automated criminal enterprise that exploits the billing mechanics of mobile carriers.

Execution and Fraud Mechanics
Fakeinstaller is distributed primarily via unmoderated, third-party Android app stores or malicious links sent via SMS (Smishing). During installation, the crucial step occurs: the app requests the `SEND_SMS` Android permission. If granted, the malware activates upon installation or device boot (`RECEIVE_BOOT_COMPLETED`). It connects to a C2 server to retrieve a list of premium-rate shortcodes and the specific text strings required to trigger a billing event. It then silently sends these messages in the background (`T1624.001`). To evade detection by the user, many variants also utilize the `RECEIVE_SMS` permission to intercept and delete the confirmation texts sent back by the premium service, ensuring the victim remains unaware of the fraud.

Indicators of Compromise & Impact
The primary impact is direct financial loss via carrier billing. Device-based IoCs include the presence of applications requesting SMS permissions (`SEND_SMS`, `RECEIVE_SMS`, `READ_SMS`) that have no legitimate need for them (e.g., a flashlight app requesting SMS access). A review of the device's outbound SMS logs (if the malware hasn't deleted them) will reveal texts sent to unknown 5-digit or 6-digit shortcodes.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FAKEINSTALLER {
    meta:
        description = "Detects Fakeinstaller (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fakeinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fakeinstaller Activity
id: 05d49a4bf69f04419b90042acbda59ae
status: experimental
description: Detects generic indicators of the fakeinstaller malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fakeinstaller*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately uninstall the suspicious application via the Android Settings > Apps menu.
2. Contact the mobile carrier immediately to report the fraud, request a refund for the premium SMS charges, and place a block on all premium-rate billing.
3. Review all installed applications and revoke SMS permissions from any app that does not strictly require it (like messaging apps).
4. Consider performing a factory reset of the device if multiple malicious applications were installed.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow users to 'sideload' applications (installing APKs from outside the official Google Play Store).
2. Avoid blindly granting permissions during app installation; scrutinize why an app needs the access it requests.

References & External Analysis

• Search "fakeinstaller" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Trickster
• Fenomengame
• Bifrost
• Detnat
• Trjgen

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/fakeinstaller.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.