Threat Spotlight

For the week of 14 Jul 2011
Threat 1

Android Trojan spies on SMS messages

Threat Name:

Andr/SMSRep-B

Users at Risk:

Android users
Linux users

Also Known As:

AVP Trojan-Spy.AndroidOS.Smser.a
Trend Android.83A888BE

Removal Instructions:

Please follow the instructions for removing Trojans.

About:

Andr/SMSRep-B is a Trojan that targets Android devices.

Andr/SMSRep-B uses a stolen Rapport icon and displays a simple screen when launched on an infected device.

The Trojan registers a Broadcast receiver, which intercepts all received SMS messages and forwards the messages to a malicious web server using HTTP POST requests. The stolen SMS messages are encoded using a JSON encoding scheme, often used by various web services.

Threat 2

Spam spreads get rich quick scams

About:

For the past few weeks we've been seeing a spam campaign that attempts to lure users into get-rich-quick scams. So far, the two scams involved have been typical "work from home" and "penny stock" scams.

On the social engineering front, these messages are targeting people's natural desire for financial success in a time of rising unemployment and personal debt. The claims are backed up by claims of endorsements by reputable third parties the likes of ABC, CNBC and CNN.

A typical message looks like this:

Get rich quick spam 
The messages all originate from free webmail services, mostly AOL, Hotmail and Yahoo.

For the work from home part of the campaign, the landing page leads the victim to a purchase page where they can buy the "startup kit" at a "massively discounted" price. This may be their main source of income in this scam, but once your credit card information is in their possession, the door has been opened for further fraud.

For the penny stocks part of the campaign, the landing page asks for the victim's name and email address so they can receive a newsletter. This serves to collect some information about the victim, as well as potentially accomplishing penny stock manipulation if enough people act on the advice of the newsletter.

As always, the landing pages are filled with disclaimers, the most suspicious and entertaining being:

"Never invest in any stock featured on our site or emails unless you can afford to lose your entire investment."
"Any claims or statements should be deemed hypothetical."

Threat 3

Bredo spam carries financial risk

Threat Name:

Troj/Bredo-IK

Users at Risk:

Windows users

Also Known As:

Avira TR/Oficla.BX
AVP Trojan.Win32.Jorik.Aspxor.y
F-Secure Trojan.Win32.Jorik.Aspxor.y

Removal Instructions:

Please follow the instructions for removing Trojans.

About:

Troj/Bredo-IK is a generic encrypted malware downloader for the Windows platform.

This Trojan has been seen in spam messages claiming to be financial statements. The message contains a zip file called Financial_Statement_.zip typically containing a file executable with the name Financial_Statement.exe.

On first execution, Troj/Bredo-IK will move itself to "\Programs\Startup\dxdiag.exe" to run on Windows startup.

Troj/Bredo-IK downloads various types of malware, but has also been observed to download fake Windows antivirus software, a common scam that attempts to lure users into giving up their credit card information to purchase the phony security program.