Vidro: How deep and mobile is the rabbit hole?

The appearance of a new Android malware family is not that surprising at all today. Especially when we talk about SMS Trojans which are one of the most popular and oldest type of threats created for extracting money from users. A new family of SMS Trojans named Vidro appeared a few days ago but we’ve already collected a lot of APK files with very similar functionality. At the moment all the samples we have found target users only from Poland. Read Full Article

Android Security Suite Premium = New ZitMo

On the 4th of June 2012 we found 3 APK files of ~207 kb in size each heuristically detected by our engine as HEUR:Trojan-Spy.AndroidOS.Zitmo.a. All these applications are malicious and were created to steal incoming SMS messages from infected devices. SMS messages will be uploaded to a remote server whose URL is encrypted and stored inside the body of the Trojan. We found 3 more APK files with exactly the same functionality on 8th, 13th and 14th of June. So there are at least 6 files which pretend to be ‘Android Security Suite Premium’ but in fact were created only for stealing incoming SMS messages. Read Full Article

Foncy is dead. Long live Mania

Foncy is dead. And what is Mania? Mania is an SMS Trojan which currently only targets users of Android from France and its code is very similar to the code of the Foncy malware. The first sample of Mania (Trojan-SMS.AndroidOS.Mania) was found approximately at the same time when the Foncy IRC bot was discovered (during the first half of January). After that new variants of Mania appeared in February, March, April and May. Read Full Article

IRC bot for Android

Not so long time ago we found a very interesting piece of malware for Android. Unfortunately, it is not clear how it was spread but in any case it’s worth mentioning. The malicious application displays itself as ‘MADDEN NFL 12’ game after the installation. The file size is over 5+ MB and actually is a Trojan that drops a set of malware components onto the system: root exploit, SMS Trojan and IRC bot. The .class file “AndroidBotAcitivity” maintains this dropper functionality. Read Full Article

Android malware: new traps for users

There is no secret that cybercriminals try to intimidate users very often in order to infect their machines. We’ve seen a lot of examples of cybercriminals using black SEO for redirecting users to web pages which emulate AV scanning. And there is no surprise that the results of such ‘scanning’ show that the user’s machine is infected with a lot of dangerous malicious apps and it is very essential to download and install a brand new ‘antivirus program’ which is actually fake AV. But what about smartphones and mobile phones? Cybercriminals have started to use almost the same techniques in order to force users to download and install malware. But in this case we talk about SMS Trojans with fake AV rudiments. Here are some details. Read Full Article

SMS Trojans: all around the world

In the middle of July I wrote about porn SMS senders which covertly subscribed users to a range of premium-rate services with the promise of raunchy images. Now this problem has evolved to SMS Trojans which target users from a number of European countries and Canada. Yes, these SMS Trojans don’t target either Russian or Chinese smartphone users. Read Full Article