Android/PUP.Riskware.SMSreg.WWPA

[AndYet]

After a database update, malwarebytes detected Android/PUP.Riskware.SMSreg.WWPA under the file /system/priv-app/SamsungBilling/SamsungBilling.apk and name Samsung Billing. This app has previously not been detected as malware, and as I have not installed any apps or downloaded anything recently, I am confused about how this got on my phone and why it is being detected now, and since it is a system app it is not letting me completely uninstall it. If someone could help me understand how this got onto my phone, and what damage it might have down, that would be greatly appreciated.  

[mbam_mtbr]

Hi @AndYet,

Android/PUP.Riskware.SMSreg.WWPA is simply a potentially unwanted program that uses sms to register itself.  We will investigate this further, but in the meantime we disabled the trace.  If you can send an Apps Report, we can further verify.

To send an Apps Report with Malwarebytes for Android use the following instructions.

1.Open the Malwarebytes for Android app.

2.Tap the Menu icon.

3. Tap Your apps.

4. Tap three lines icon in upper right corner.

5. Tap Send to support

Choose an email app to send Apps Report.

Your email app will open with the Apps Report included. Send the Apps Report to create a ticket.

Private Message (PM) me the email used and/or the ticket number assigned.

Nathan

 

[mbam_mtbr]

Hi @AndYet,

I apologize for the delay as I was out of office yesterday.

Upon further review, there is definitely the presence of sms activity in the code of Samsung Billing.  In reality, the activity would be closer to PUP.Riskware,SmsPay then PUP.Riskware.SmsReg.  SmsPay is a program that is used to pay using sms.  However, with this being so close to the line between what we consider Potentially Unwanted Programs (PUP) and it being a system app on some phones, we are going to defer to leaving it disabled.  Please note that PUP is NOT malware.  Thus, there was no real threat presence, just simply a warning to customers.  We would recommend NOT using Samsung Billing using sms, but will leave it as a "clean" app.

Nathan