The Latest in IT Security

Failed Android Premium Rate SMS Trojan


We’ve found Android trojans that attempt to send SMS messages to premium rate SMS numbers. That’s not unusual. What is different though is that these trojans don’t work.

The trojans (detected as Trojan:Android/RuFailedSMS.A) use these permissions:

RuFailedSMS, permissions

And pretend to be installers for a range of applications, with each malicious app offering to download a package (of what is presumably a popular app):

RuFailedSMS, main UI

Some of the “offered” applications include:

  •  Add_It_Up
  •  Advanced_Launcher_Lite
  •  AmazingMaze_supLitesup
  •  Analog_Clock_Collection
  •  Animal_Sudoku
  •  AnySoftKeyboard
  •  AnySoftKeyboard_Slovak_Language_Pack
  •  AppInventor_Toggle
  •  Arrow_Caz
  •  Astronomical_Flashlight
  •  BentoCam!
  •  Bimaru_-_Battleship_Sudoku
  •  BlackJack
  •  Carve_a_Pumpkin_supLitesup
  •  Chinese_Chess
  •  Christmas_Ringtones
  •  Coloring_pages
  •  Contact_Finder_supLitesup
  •  Converter
  •  Countdown_Widget
  •  Crayon_Ball
  •  Cyan_aHome_Theme

Fortunately, due to some uncaught exception in the code, the trojan (SHA1: 0d2d3317c6ca1a9812d357741f45af6bb360d89c) doesn’t complete its malicious activities — it just crashes and terminates:

RuFailedSMS, crashed

We’ve found over a hundred copies of the trojans, but the large number doesn’t make it technically advanced — the copies basically use the same source code, but just re-shuffled into different configurations for the different packages.

The trojans were found on third-party Android markets and targets users in Russia, Belarus, Kazakhstan and Azerbaijan.

Even though these trojans crash and fail, we are still detecting them due to the malicious routines, and also because of large number of copies circulating.

Threat Solutions post by — Jessie

Leave a reply



Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...



Latest Comments