18 June 2007 14:21 GMT
SMS for profit
SophosLabs experts have identified a new Trojan that targets Symbian mobile devices, specifically Nokia Series 60 devices. Once installed, Troj/Viver sends an SMS message every 15 seconds to a predefined premium-rate number. The discovered malware was distributed through a popular Russian web site masquerading as a useful telephone utility. Variants known so far have used the following enticing filenames for the installer
- codecs_tool.sis
- RulesViwer.sis
- NetCompressor.sis
Upon installation the Trojan displays one of the following messages:
![[Screenshots for Troj/Viver upon installation]](/images/sophoslabs-blog/2007/06/sms4profit.gif)
The premium rate number used by the Trojan is a short number - expensive things to obtain. However, many content providers obtain batches of short numbers and then sublet them to whoever is willing to pay. A keyword or password is assigned by the content-provider in order that a proportion of the revenue generated is paid to the subletter. This model is a perfect fit for hackers, who can essentially rent out the short numbers quite cheaply, and use them for their own financial gain.
AnnaSzalay, SophosLabs UK
