Trojan Android.SmsSend.754.origin is an apk application named Flow_Player.apk. During installation, it prompts the user to run it with administrator privileges—this will allow the malicious application to lock and unlock the screen. In addition, Android.SmsSend.754.origin later hides its icon from the home screen.

Once installed and launched, the Trojan sends various details about the infected device to the attackers and then waits for directives, the main one being to send SMS messages with a specific text to a specified number. Thus infected mobile devices can send any SMS, including expensive messages, regardless of the owner's country of residence or the telephone company they use. This allows botnet makers to not only use the botnet for their own ends but also to conduct criminal activities for third parties. More detailed information about this incident can be found in a corresponding publication at Doctor Web's site.

The benefit cybercriminals get from using SMS Trojans easily explains why malware of this family is so widespread, so it is hardly surprising that the geographical area in which it is being employed is constantly expanding. Thus, In September, Doctor Web's analysts discovered a site inviting Vietnamese users to download bogus games and other applications. The downloads contained Trojans that were subsequently added to the Dr.Web virus database as Android.SmsSend.760.origin.

When launched, the malicious applications send short messages to a premium number, and then open a web browser to download the desired software. However, the trouble did not end there. These resourceful fraudsters modified the programs downloaded later by the user so that when launched, those programs would also send chargeable short messages. That's why some programs are detected by Dr.Web anti-virus software as Android.SmsSend.761.origin.

The malicious program Android.SmsBot.5, discovered in the middle of the month, can be considered a relative of some SMS Trojans. It is distributed under the guise of a social networking client for VKontakte.

Several Android.SmsSpy Trojans spread under the guise of various applications, such as the flash player, were also identified in September. The spies' primary targets are short messages that can contain the mTAN codes used to confirm online banking transactions.

The last month saw some fake anti-viruses for Android, too. Doctor Web's analysts discovered three such programs which were dubbed Android.Fakealert.8.origin, Android.Fakealert9.origin, and Android.Fakealert.10.origin. Recall that these applications are fraudulent products that detect non-existent threats and invite the device's user to pay a certain amount in exchange for their neutralisation. Interestingly, one of these programs, namely Android.Fakealert.10.origin, was spread under the guise of an application for viewing adult videos but in truth mimicked an existing anti-virus and, when launched, showed a warning about the need to scan the mobile device for infection. To eliminate threats, which undoubtedly were found in abundance, it prompted the user to purchase a full version of the program.

Also discovered in September was a modification of Trojan Obad, which was added to the Dr.Web virus database as Android.Siggen.3.origin. This malware can send SMS messages to premium numbers and download other malicious applications to a mobile device. However, its exploitation of an Android error, which allows the Trojan to avoid removal, is among its most distinguishing features. During installation it requests access to features available to the device's administrator and, if privileges are granted, hides itself from the Apps list to prevent the user from modifying system settings and to minimise the risk of its removal by standard means. Dr.Web products for Android incorporate special routines to neutralise these types of threats and easily remove this Trojan from mobile devices.

Other events

G20 backdoor spam

According to a security report, scammers ill-used the wide publicity of the upcoming G20 summit in St. Petersburg to send messages with an attached RAR archive containing malignant files.

The archive included a .lnk file and two binaries. Researchers found that these binary files do not pose a threat, if run separately. But, in fact, they are a single file, split into two parts. The .lnk shortcut contains commands that merge them into a single executable file and then run that file on the infected computer. In turn, the backdoor communicates with the attackers‘ server to execute their malicious commands in the affected system and downloads plug-ins for keylogging and taking screen shots. The plug-ins' code is run in the backdoor's process and, therefore, the plugins do not appear on the list of running applications, making them harder to detect. This malware is detected by Dr.Web anti-virus software as Win32.HLLW.Autoruner1.54698.

Banking Trojan: Southern Europe, Turkey and the United Kingdom are under attack

According to security experts, a new Trojan has compromised the computers of bank customers in Turkey, the Czech Republic, Portugal and the UK. Its payload is similar to that of Zeus and SpyEye (keylogging, taking screen shots, capturing video, configuring a remote proxy server to intercept traffic, web-injections), but unlike the malware mentioned above, this Trojan can create a hidden VNC server in an infected system.

Criminals use the Trojan to get the victim's account information and prompt the user to install a malignant program as a software component for Symbian, Blackberry or Android. Victims received emails with the malicious file *.Pdf.exe attached to them that were supposedly sent by postal services and telecom providers (interestingly, Czechs who visited the fake postal service site ceskaposta.net were redirected to Czech Post’s real site ceskaposta.cz.

Doctor Web's analysts are aware of several versions of this Trojan: Trojan.Inject1.27640, Trojan.DownLoader10.3567, Trojan.DownLoader9.22851, Trojan.DownLoader10.10165. The earliest signature was added to the Dr.Web virus databases on July 31, 2013.

Trojan spread with pirated version of GTA V

In September many sites reported that a Trojan was being spread with an illegal version of the popular computer game Grand Theft Auto V (GTA V). The game is quite popular, so criminals didn't hesitate to take advantage of it. A file containing malware is spread via torrent trackers under the guise of this game.

The file conceals a Trojan that prompts a gamer to enter into a form their phone number and the confirmation code received via SMS in response. If the victim sends an SMS with the code, they are subscribed to some sort of service for which 1 euro is debited from their mobile account every day until the service is cancelled. This malware is a typical representative of the Trojan.SmsSend family.

Banking Trojan attempts to control transactions in the Middle East and Asia

An anti-virus lab outside Russia registered a small but highly effective spam mailing that was spreading a malicious ZIP attachment. Financial institutions in the UAE, Pakistan, Nepal and, perhaps other countries of the region were among the victims. Presumably, the messages were sent from compromised mailboxes of financial companies in India and Pakistan, and were meant to spread malware of the family Trojan.PWS.Panda, also known as Zeus. Dr.Web software detects this program as Trojan.PWS.Panda.2401. Its entry was added to the virus database on September 10, 2013. The program is dangerous because it can steal online banking data.

Trojan for Mac OS X: made in SEA?

In mid-September, security experts discovered a malicious program dubbed BackDoor.Leverage.1. A user from Belarus sent a sample of this program to VirusTotal, an online service, for analysis.

It is unknown how the malware got into the user's system. Probably, they received it via email or while visiting a compromised website. By September 17, the attackers’ C&C server stopped sending commands to compromised systems.

This malicious application is disguised as a JPEG file and poses a threat to Mac OS X if the option to hide extensions for known file types is enabled on the Mac. Files that the program downloads onto an infected computer include the logo of the Syrian Electronic Army (SEA).

Security experts believe that only earlier versions of Mac OS X are in danger. The malware cannot harm Mac OS X 10.8. In other words, timely updating will ensure a Mac is invulnerable to this malignant program.

This malware was added to Doctor Web's virus database on September 18, 2013. It is supposedly used by criminals to mount targeted attacks and is not found in large numbers in the wild.

Trojans are attacking from the "cloud"

According to expert Thomas Siebert from the company G Data, criminals have begun employing cloud technologies in their attacks on users of online banking. Attackers use a special version of Zeus or Ciavax Trojans. They place its component on a cloud server to deliver up-to-date code onto infected computers to mount attacks on sites. The malware is used to intercept information about payment operations conducted from an attacked computer.

According to Siebert, "It is now impossible to determine which sites cybercriminals are going to attack. At the same time, checking Internet addresses manually on the basis of their subject isn’t an effective solution, as a large number of requests can attract the attention of intruders".

According to G Data experts, using the cloud approach to place malware significantly complicates its analysis and makes it difficult to find effective ways to neutralise it. Dr.Web anti-viruses detect this threat as a Trojan.PWS.Panda program. Ciavax Tis, detected as Trojan.Mayachok.18612, was added to the virus database on April 2013.

Malicious files detected in mail traffic in September

Malicious files detected on user computers in September