Kapersky Lab has positively identified a third variant of the FakePlayer SMS Trojan targeted at Android devices.
According to Kapersky’s Denis Maslennikov, the latest iteration of the Trojan sends for-fee SMS/text messages to two short numbers: 7132 and 4161.
The cost for every SMS/text message remains a rather hefty $6, approximately 170 Russian rubles.
The current FakePlayer variant also features a “porno player” icon that was present in the first strain of the Trojan.
“There are no other changes. The same archive – pornplayer.apk, the same infection vector – via the Internet using SEO tricks and the same queries upon installation. So no real changes – just a new variant to earn additional money,” Maslennikov confirmed.
“[Still], everyone with a phone which supports J2ME should also beware: if you go to a website which is spreading Trojan-SMS.AndroidOS.FakePlayer.c using a mobile web browser, such as Opera Mini for instance, you will be offered a link to download a J2ME application – which happens to be a Trojan we detect as Trojan.SMS.J2ME.Small.r…”
