[NEWS] Occhio a chi vi contatta su ICQ - sopratutto su cellulare (Trojan-SMS.J2ME)

[xcdegasp]

Proprio oggi ho ricevuto la richiesta di autorizzazione dal classico spambot ma anzicchè inviare pubblicità il suo intendo era inviare un bel virus camuffato da archivio jar

la richiesta era la seguente:

470446528 vuole aggiungere 107222167 alla sua lista dei contatti: Privet eto Olenka xo4y seksa
vot glan moa fotka
h..p://image.slidexxx.cn/foto.jpg

Ovviamente il link porta a scaricare un bel virus che ancora gode il privilegio d'essere poco riconosciuto:



Risultato: 17/41 (41.47%)



http://www.virustotal.com/it/analisi...fbb-1259491062


Scanner results : 43% Scanner(s) (16/37) found malware!
http://virscan.org/report/d9e71cce90...22f4a1414.html



ThreatExpert lo identifica come Altamente Rischioso (livello 10) Trojan Horse [Symantec]
Trojan-SMS.J2ME.Agent.d [Kaspersky Lab]

di seguito il link per poter visionare il report dell'analisi:
http://www.threatexpert.com/report.a...dc439c05cd5e89



Aggiornamento:
Il trojan è stato confezionato e sviluppato per colpire i cellulari e palmari che possono installare le applicazioni java come dichiara l'analisi svolta dai laboratori kaspersky il 24/07/2009:
link tradotto da russo a italiano -> http://babelfish.yahoo.com/translate...rUrl=Translate

link originale -> http://www.securelist.com/ru/descrip...S.J2ME.Agent.d


The technical details

Trojan program, which damages the cell phones of any producers, which use Java (J2ME). Are achieved attempts at the not sanctioned by user dispatch of SMS- communications from the infected mobile devices to the paid [premium]- numbers.


Destructive activity

Is the application Of java - archive in the size JAR. File has a name of foto.jar. The size of file can vary in the limits from 68386 to 68434 bytes.

Archive includes the following files:
# inf.dat - auxiliary file (115 bytes);
# icon.png - [ikonka] of appendix (1477 bytes);
# 1.png - file of image (7156 bytes);
# 2.png - file of image (30706 bytes);
# 3.png - file of image (19725 bytes);
# a.class - auxiliary file (1058 bytes);
# b.class - auxiliary file (2634 bytes);
# c.class - harmful file, which achieves an attempt at the sending of SMS- communications (3171 bytes);
# d.class - auxiliary file (5601 byte);
# e.class - auxiliary file (300 bytes);
# f.class - auxiliary file (3365 bytes);
# midlet.class - auxiliary file (1071 byte).

Trojan is extended with the aid of the distribution of [spama] in ICQ. Text to [spam] of communication can take the following form:

“[Privetik] to me friend did give [tvoyyu] to [fotku] here cast a look this you or not? and that to me it was strongly pleased) "


Application is established on the telephone by the name “of foto”. The following image is reflected after the starting of program on the screen of telephone:


Which through several seconds is changed to this picture:


After which the following is reflected on the screen:


If user presses “to increase”, then program attempts to send SMS- communication with the specific text to one of the short numbers: 8355 (cost of one SMS - 4 US dollars or ~110 of rubles); 7122 (cost of one SMS - 9 US dollars or ~250 of rubles); or 7132 (cost of one SMS - 6 US dollars or ~180 of rubles).

Recommendations regarding the removal

1. If program was established on the common telephone, then users can move away by its standard means.
2. If program was established on [smartfone], then, besides the standard means of removal, users can use Kaspersky Of mobile Of security with the renovated bases for the removal of harmful file.

[FulValBot]

alla faccia :| cmq nel sitolo metti news xkè questa è la sezione delle news.

[xcdegasp]

sì ma non proviene da un acanale uffciale è per questo che non ho messo il tag..

[xcdegasp]

a quanto pare l'esca sono i cellulari:
link tradotto da russo a italiano -> http://babelfish.yahoo.com/translate...rUrl=Translate

link originale -> http://www.securelist.com/ru/descrip...S.J2ME.Agent.d