Android SMS Trojan variant targets Russian users

It worked for the first two times, why wouldn’t it a for third?

It’s likely that the same scammers who were behind the previously discovered Android Trojan variants (1,2) secretly sending text messages to premium numbers are behind this latest one spotted by Kaspersky.

A few things have changed – such as the destination numbers (located in Russia) and the media player icon from the first Trojan that is now combined with the name of the second one (PornoPlayer) – but most things stayed the same.

The cost of the message ($6), the blackhat SEO tricks used to propagate it, and the permission screen that pops up during the installation and asks you to allow it to modify/delete your SD card content, send text messages and read phone state and identity. But, even though there are no significant changes, the researcher says that the regular updating of the Trojan should be a concern.

He also warns users with phones supporting J2ME to be careful when surfing to a website that spreads this Trojan by using a mobile web browser, because they will be offered a link to download a J2ME application that is actually another Trojan detected by Kaspersky.