Mutated Android Trojan spotted in the wild

Posted by Trent Nouveau

Kapersky Lab has positively identified a third variant of the FakePlayer SMS Trojan targeted at Android devices.

According to Kapersky's Denis Maslennikov, the latest iteration of the Trojan sends for-fee SMS/text messages to two short numbers: 7132 and 4161.

The cost for every SMS/text message remains a rather hefty $6, approximately 170 Russian rubles.

Mutated Android Trojan spotted in the wildThe current FakePlayer variant also features a "porno player" icon that was present in the first strain of the Trojan.

"There are no other changes. The same archive - pornplayer.apk, the same infection vector - via the Internet using SEO tricks and the same queries upon installation. So no real changes - just a new variant to earn additional money," Maslennikov confirmed.

"[Still], everyone with a phone which supports J2ME should also beware: if you go to a website which is spreading Trojan-SMS.AndroidOS.FakePlayer.c using a mobile web browser, such as Opera Mini for instance, you will be offered a link to download a J2ME application - which happens to be a Trojan we detect as Trojan.SMS.J2ME.Small.r..."