ANDROIDOS_RUSMS.A

This malware is related to the SMS spam attack that affected users in Taiwan. Once installed, the malicious app may send SMS, as well as intercept incoming ones. As such, this may incur charges without the user's knowledge.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

Arrival Details

This Trojan arrives via SMS messages that contain the following details:

• http://goo.gl/W{BLOCKED}TBf

NOTES:
Once installed, it may send text messages without the user's knowledge and/or authorization. It uses an electronic payment method named Micropayment to charge the user of the affected device.

Since this malware intercepts certain incoming text messages, the user is left unaware of the charges incurred.

The malware blocks text messages from certain SMS addresses that contain the specific characters below. An SMS address is the originating address, or email address if the message came from an email gateway.

• 6279
• 1232111
• mopay
• boku
• 66245
• bezahlcode
• holyo
• 55498
• 55496
• 33235
• 46645

The blocked SMS is forwarded to http://{BLOCKED}.{BLOCKED}.13.43/sms/SMSHandler1.ashx.

It also sends contacts and phone numbers to a remote server.