virus logo Virus

SymbOS/RomRide.B!tr

description-logoAnalysis


  • Upon installation it refers to itself as an application update by MSF as seen in Figure A, and will prompt the user for phone restart as seen on Figure B.


    • Figure A: Installation

    Figure B: Restart Prompt
  • It drops the following files:
    • undefinedSystemundefined\bootdata\LocaleData.D01
    • undefinedSystemundefined\Shareddata\10005943.ini
    • undefinedSystemundefined\Shareddata\10005a40.ini
    • undefinedSystemundefined\Shareddata\1005984.ini
  • Most of the abovementioned files are nearly zero or zero byte files.


    • recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
      FortiClient Systems
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiClient
    Extreme
    FortiMail
    Extreme
    FortiSandbox
    Extreme
    FortiWeb
    Extreme
    Web Application Firewall
    Extreme
    FortiIsolator
    Extreme
    FortiDeceptor
    Extreme
    FortiEDR
    ID 808249
    Released Mar 31, 2009
    Description
    Updated    		 Apr 06, 2009
    Aliases Trojan.SymbOS.Romride.b, SymbOS/Romride.b trojan, Troj/Romride-B, SYMBOS_ROMRIDE.L, SymbOS.Romride.B
    Platform Profile Symbian OS