July 3, 2014

Doctor Web's security researchers are continuously monitoring and analysing the number of positives registered by Dr.Web for Android on mobile devices. For a very long time, applications incorporating advertising modules have ranked at the top of Doctor Web’s unique rankings of malicious program popularity. Other threats, various Trojans included, have lagged far behind them. However, recent statistics indicate that an Android.SMSBot program has been spreading on a wider scale. In late May, the number of incidents involving this malware increased by 227%, and in June the number exceeded 670,000.

According to information acquired via Dr.Web for Android, the number of Android.SmsBot.120.origin detections in the last month of spring 2014 reached 235,516. Thus, this malicious program became the leader among the Trojans detected in May. Throughout June, the mobile Dr.Web anti-virus for Android continued to register growth in the number of attempts by this malware to infiltrate protected devices, and by the end of the month, the total number of incidents was 670,422, showing an increase of 227% compared with the previous reporting period. Thus, in the past month Android. SmsBot.120.origin once again became the most "popular" Trojan and accounted for 11% of the virus incidents detected on user handhelds.

This Trojan belongs to a common group of malicious programs that can receive commands from criminals and carry out a wide range of malicious activities. In particular, Android.SmsBot.120.origin can send, intercept and delete SMS, load specified web pages in the browser, obtain device coordinates and even remove specific applications.

In most cases, the Trojan is distributed by cybercriminals in the guise of adult videos. However, it can also be made available as legitimate software, as well as audio files, so the owners of Android devices should exercise caution and refrain from downloading questionable content. Devices running Dr.Web for Android are protected from this malware.

Doctor Web's analysts continue to monitor this threat.