Riskware/GPSpy!Android

Analysis

Riskware/GPSpy is an Android application destined to track the location of the device on which it is installed.

Technical Details

Riskware/GPSpy is a tracking application for Android phones. It goes by the name GPS Spy Plus.
To remain undetected, when installed, it does not show in the launcher menu.
It continuously (every 15 minutes) tracks the device's location and stores the location points. The data stays available for 1 week.
When run from the spying device, the application shows the location history as a trace of connected points on a map.
The spying device can also receive notification emails for proximity alerts when the tracked device comes within the proximity radius of a point defined by the tracker phone.

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.