Malicious programs spotted on Google Play store, warns Dr Web

G

Security software developer Dr Web has confirmed that several malicious programs were found lurking in the Google Play store. The company then promptly notified Google about the incident.

As for the users, the Russian anti-virus firm has warned that these malicious programs on the store install Android.SmsSend Trojans on mobile devices. These can then send short messages to premium numbers and empty subscriber accounts in the process.

*im.tech2.in.com/gallery/2013/aug/googleplay_1_101416093724_640x360.jpg

The discovery was made by the company's analysts and the programs were found to belong to the Vietnamese developer AppStore Jsc. Users should note that these programs masquerade around as audio players and a video player that displays adult content. Now, while these may appear harmless, they carry an extra apk-file containing an Android.SmsSend Trojan.

Dr Web explains, "While running these carrier applications, dubbed Android.MulDrop, Android.MulDrop.1, and Android.MulDrop.2 by Dr.Web, can prompt the user to download the content they need, but their consent initiates the installation of another application rather than the downloading of files. For example, the video player program offers to get the user new adult clips."

If an unsuspecting user agrees to install the dubious application, the Trojan Android.SmsSend.512 will be promptly installed on the device. It moves on to sending short messages to 8775 – specified in the malware's configuration file. Interestingly, though, the Trojan does allow a user to view adult video clips, possibly to avoid suspicion. The remaining two programs contain Android.SmsSend.513.origin. This malware gets details about short numbers from a command and control server.

What's even more worrying is that the the number of installations of these programs – Phim Sex HD-Free, Zing MP3 - BXH Music and Phim Nguoi Kon - Audio 18+ – range between 11,000 and 25,000.