Malware descriptions

First SMS Trojan for Android

I think the title of this post speaks for itself. Trojan-SMS.AndroidOS.FakePlayer.a passes itself off as a media player application. If the user chooses to install it, this icon with the name “Movie Player” will appear in the list of applications:

The malware sends SMS messages to two premium rate numbers 3353 and 3354, with each message costing approximately $5. It does this stealthily, without requiring any confirmation from the device owner.

During installation, the user is asked to allow this application to change or delete memory card data, send SMS and read the data about the phone and phone ID. This is a huge red flag – why does a simple media player require permission to send SMS messages? – and anyone who’s paying attention during the installation process will immediately be suspicious.

This flags up an important point: when installing a new program, you really should pay attention to which services the application requests access to. Automatically permitting a new application to access every service it requests means you could end up with malicious or unwanted applications doing all sorts of things without requesting any additional confirmation. And you won’t know anything about it.

Trojan-SMS.AndroidOS.FakePlayer.a is quite a development – yet another popular mobile platform, and one with an ever increasing market share is now being targeted by the bad guys. At the moment, although anyone’s device can be infected, the Trojan only causes losses for Russian users, and as far as we can tell, it’s currently not being spread via Android Marketplace.

In the past, though, we’ve seen plenty of local problems evolve to become global ones. And when we get malware that uses a new infection vector or targets a previously untouched platform, we know that sooner or later, there will be more on the way.

First SMS Trojan for Android

Your email address will not be published. Required fields are marked *

 

Reports

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Subscribe to our weekly e-mails

The hottest research right in your inbox