SMS for profit
SophosLabs experts have identified a new Trojan that targets Symbian mobile devices, specifically Nokia Series 60 devices. Once installed, Troj/Viver sends an SMS message every 15 seconds to a predefined premium-rate number. The discovered malware was distributed through a popular Russian web site masquerading as a useful telephone utility. Variants known so far have used the following enticing filenames for the installer
- codecs_tool.sis
- RulesViwer.sis
- NetCompressor.sis
Upon installation the Trojan displays one of the following messages:
![[Screenshots for Troj/Viver upon installation]](http://www.sophos.com/blogs/sophoslabs/images/blogs/sophoslabs/2007/06/sms4profit.gif)
The premium rate number used by the Trojan is a short number - expensive things to obtain. However, many content providers obtain batches of short numbers and then sublet them to whoever is willing to pay. A keyword or password is assigned by the content-provider in order that a proportion of the revenue generated is paid to the subletter. This model is a perfect fit for hackers, who can essentially rent out the short numbers quite cheaply, and use them for their own financial gain.
Posted on June 18th, 2007 by AnnaSzalay, SophosLabs UKFiled under: Malware
Windows 7 security - A great leap forward or business as usual?
