Android Malware "Android/Samsapo.A" Multiplies Via SMS

Slovakian security firm, ESET has discovered an interesting Android malware, called Android/Samsapo.A that spreads via SMS. While most of the Android malware spreads through email attachments, detachable media or through infected websites; this malware uses text messages to find victims. So far the malware is known to affect Russian speaking users by sending texts in Russian language. The worm uses social engineering to trick the users to click on a link. It sends a message that says "Это твои фото?" (translates to "Is this your photo?") along with a link that links to a malicious APK package. Since the message seems to be from your contact; recipients of the SMS click on the link and download the malware on their phones without any hesitation.

Once installed on the victim's Android, the worm appears to run as a system utility (package name: com.android.tools.system v1.0) and has no user interface or icon in the app-drawer. The worm is capable of downloading additional files from its servers and is also demonstrated to be able to upload user's personal data like phone-numbers, text messages to a remote server. The worm just doesn't stop there; it registers the victim's phone number into a premium-rate service. It can also block phone calls and alter alarm settings in the default Android clock.


The malware seems to be created very recently; because the domain it drops files to has been registered just a few days ago, on April 24, 2014. While the worm's targeting Russian users; we'd strongly advise all our readers to refrain from opening and installing unknown websites. Be extremely careful while opening links even if they seem to be from your trusted contacts. It'd also be a good idea to install an anti-malware software on your Android.

We'd love to know how many of our CEans use anti-malware, anti-virus on their Android devices.

Via: Android malware worm catches unwary users | WeLiveSecurity