Trojan:Android/Torsm.A is reportedly the first trojan to use the open-source, anonymizing Tor network to hide its communications with its Command & Control (C&C) structure. When active, the trojan monitors and intercepts incoming SMS messages, as well as sends SMSes to a specified number.
Once the scan is complete, the F-Secure security product will ask if you want to uninstall the file, move it to the quarantine or keep it installed on your device.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
When installed, Trojan:Android/Torsm.A will monitor and intercept incoming SMS messages and forward them to a number that can be specified in instructions sent via the C&C server. It can also harvest information from the device, including the phone number, device model and a list of installed apps.
Torsm.A is notable for the way it communicates with the attacker(s) controlling its operations, as the C&C server used by the operators is within the anonymizing Tor network. This makes it extremely difficult for security researchers and law enforcement authorities to takedown the server. Though this technique has been previously used with PC-based malware, this is the first known instance of an Android malware using the same technique to hide its communications.
The code for the Torsm trojan was reportedly based on the available, open-source Orbot Tor client, with additional code to enable the trojan's malicious functions. For more information, see: