Mobile Defender - the last line of protection
Having studied malware delivered by spam for the past seven years, it is a fairly rare event for me to be amazed by something new, but that is exactly what happened today thanks to a new finding by Brendan Griffin, the lead author of Malcovery's Today's Top Threats report. 
In yesterday's report, Malcovery customers were informed of a prevalent spam email that used the subject lines:
- Voice Message Notification
- 1 New Voicemail(s)
- 2 New Voicemail(s)
- 3 New Voicemail(s)
- 4 New Voicemail(s)
- 5 New Voicemail(s)
- 6 New Voicemail(s)
For a Windows user who clicks on the link, the malware calculates a location and drops a .zip file to the visitor with a name appropriate for thier location. For example, in yesterday's T3 Report, Brendan documented the behavior of a file he received from "bhaktapurtravel.com.np" that was named "VoiceMail_Birmingham_(205)4581400.zip".
At the time of Brendan's review, only 6 of 48 Antivirus vendors detected the .zip file as malicious according to this VirusTotal Report for zip.
The unpacked file, which used an icon displaying a musical note on a sheet of paper, fared little better, with only 7 of 48 detections as shown in this Virus Total Report for exe.
Twenty-four hours later, that detection is up to 21 of 48 detections, with several vendors (AntiVir, DrWeb, Microsoft) calling the malware "Kuluoz" while BitDefender, EmSoft, and F-Secure prefer the name "Symmi".
Android Version?
Given that the email message was claiming to be from an Android application called "WhatsApp", Brendan revisited the link, using a User-Agent string that would be commonly associated with an Android-based browser. Instead of receiving an .exe file, when using the Android emulation mode, Malcovery received *AND INSTALLED* a file called "WhatsApp.apk". Examining the code, Brendan found bilingual messages in Russian and English that seemed to be indicating that various malware packages had been found on his phone. Here's one example, that seems to claim the presence of Downad/Conficker: 
The Android malware, which had the MD5: 5290df867914473426b82233567c03af, was much better detected by AV engines ... 
At first glance, that seems quite encouraging! But think about it more. What possible good does it do you to have AVG, ESET, F-Secure, Kaspersky, and Trend Micro telling you that this APK file is hostile? You certainly aren't running any of their Anti-virus products on your Android phone, are you?
Brendan decided it was time to put this malware into a true Android phone, and received some shocking results, shown below!
First, the Android App pretends to scan your phone for malware . . . 
And then, it asks you for your credit card information in order to buy the "Mobile Defender" application to protect your phone! 
We were amused by the "Lifetime Software License" which offers a 60% discount. I wonder how many years they expect us to live to calculate that discount! Hopefully they are referring to the lifetime of their malware, rather than us or our phone!
Historical FakeAV Scams
We certainly have been talking about Fake AV for a long time! Here are some of our previous articles on the subject, dating all the way back to 2008 -- but this Fake AV on Android Phones was a first for us, especially in such a prominent spam campaign! FTC Moves against Fake AntiVirus ScareWare Companies - Dec 2008
Conficker Fears Spread Fake AV - April 2009
Fake Twitter, Linked In, and ScribD pages lead to Fake AV - June 2009
Fake AV in the News - April 2010
MasterCard Spam leads to Fake AV - July 2011
Sites seen in spam with either "info.php" or "app.php" malware links
Each of the sites below was found in spam in the Malcovery Spam Data Mine, either with an "app.php" path, such as "/app.php?message=7nof02WSsCV044njNqRS+F1mNBPcaaHD7u7VE/2vY7c=" or an "info.php" path such as "/app.php?message=NaZNY1tYTjYL5u0C/rimmNLlnDKRleqTEBJme/hthH4="We believe that each of the sites below was compromised to allow the criminals to insert the "app.php" or "info.php" file on their system.
At this time, we are unsure whether the "localization" seen on the Windows version of this malware is based on geolocation of the infected computer's IP address, or whether the parameter passed in the URL contains an encoding of the user's location. Every URL observed had a unique string in the "message=" portion.
| count | machine | ||
| count | machine | count | machine |
| 24 | babytoysbaby.com | 4 | coffsdentalcentre.com.au |
| 22 | bhaktapurtravel.com.np | 4 | admingo.ru |
| 22 | tsypa.ru | 4 | 5100429.ru |
| 19 | manchesterbuddhistcentre.org.uk | 4 | skupina-lira.si |
| 18 | koshergiftsuk.com | 4 | planeta-avtomat.ru |
| 17 | casperscomputers.com | 4 | personalcarephysio.ca |
| 17 | mywebby.ru | 4 | iperidrosi.org |
| 16 | ifuneral.it | 4 | dxixisport.com |
| 16 | tk-galaktika.ru | 4 | guru27.ru |
| 15 | mdou321.ru | 4 | holenefesh.com |
| 14 | thaiecom.net | 4 | zag.com.ua |
| 14 | thenewdabbs.com | 4 | yildizotel.com.tr |
| 14 | locweld.com | 4 | shinyvsem.ru |
| 14 | gourmetschlitten.com | 4 | dr-nonna.ru |
| 14 | sadafmirza.com | 4 | niessing-gladbeck.de |
| 14 | serov1.com | 4 | uwes-futterkiste.de |
| 14 | growlerscraftbeerandales.com | 4 | boat-plastic.ru |
| 13 | globalpeat.com | 4 | morterablanca.com |
| 13 | dj220w.ru | 4 | co-co-mail.net |
| 12 | improvisera.net | 4 | vizazh.zp.ua |
| 12 | www.raspinawin.com | 4 | verfassungsschutz-bw.de |
| 12 | srivivekananda.com | 4 | darkmatta.com |
| 12 | amicidelcuore.info | 4 | www.kip26.ru |
| 12 | shop-rakushki.ru | 3 | veerbootkobus.nl |
| 11 | rkbtservice.ru | 3 | fehoozy.com |
| 11 | djvakcina.com | 3 | juhatanninen.com |
| 11 | muzikosfabrikas.lt | 3 | artedangi.com |
| 10 | ikarplus.com | 3 | truesouthmanagement.com |
| 10 | katrinfil.ru | 3 | paternocalabro.it |
| 10 | ladwig-gmbh.de | 3 | tennissimo.be |
| 10 | profnastil-sm.ru | 3 | westsaitama.com |
| 10 | cateringjaipur.com | 3 | venoras.com |
| 10 | clockcards.ie | 3 | netbook.com.ua |
| 10 | lichtenauer-fv.de | 3 | einstalacje.pl |
| 10 | mrsergio.com | 3 | kovka1.ru |
| 10 | gseo.it | 3 | piotrkozak.com |
| 10 | mirvshkatulke.ru | 3 | momks.org |
| 10 | albecoperu.com | 3 | tcpredatorsbaseball.com |
| 9 | dimater.com | 3 | autovaza.net |
| 9 | dezibelmusik.de | 3 | surya.org |
| 9 | goldnart.ru | 3 | fiskr.ru |
| 9 | rickhelpt.nl | 3 | piediplomacy.com |
| 9 | designmakers.kz | 3 | dis-travel.ru |
| 9 | crazyparty.com.pl | 3 | sportsbettingonlineusa.net |
| 9 | tc.CastineLLC.com | 3 | dmitriy-vasilchuk.com |
| 9 | gustavblome.de | 3 | craftyfolks.net |
| 9 | autopialighting.com | 3 | cityglobal.ru |
| 9 | eckkaluga.ru | 3 | isuzu.loader.com.ua |
| 9 | redmangoindo.com | 3 | isa-scouts.de |
| 9 | olimpodelbenessere.it | 3 | www.michael-roos.net |
| 9 | mazdaparts.su | 3 | www.ninja-ninja.com |
| 9 | lexbox.am | 3 | net2day.tk |
| 8 | pennerimperium.de | 3 | maov.info |
| 8 | yakitoriya-mo.ru | 3 | elmetsystem.pl |
| 8 | dush80-svao.ru | 3 | tischlerei-klemm.de |
| 8 | mastersonpr.com | 3 | such-spinne.de |
| 8 | slocis.com | 3 | pts.kovrov.ru |
| 8 | art52.ru | 3 | thundermistpowerboats.com |
| 8 | tva.ru | 3 | sungatov.ru |
| 8 | frescomeble.pl | 3 | harald-rupp.com |
| 8 | darkstudio.net | 3 | shermes.biz |
| 8 | orbitmotion.com | 3 | auronzo.it |
| 8 | cam.shaksha.ru | 3 | yakrus.com |
| 8 | www.chelyabreduktor.com | 3 | gogreenbravo.com |
| 8 | everyday24h.de | 3 | tengritel.kz |
| 8 | www.auxtribusindiennes.com | 3 | sewretro.com |
| 7 | dialoguetrust.net | 3 | oilhelp.info |
| 7 | magavilla.com | 3 | bdlmachines.com |
| 7 | structuredsettlementsannuities.com | 3 | cypresshomecareinc.com |
| 7 | brainseal.com | 3 | yalublutebyazhizn.ru |
| 7 | bareli.co.il | 3 | specialistdental.com.au |
| 7 | colorpaco.com | 3 | trivenidigital.com |
| 7 | kasutin.ru | 3 | englishteam.ru |
| 7 | www.myinnerpc.com | 2 | e-nt.de |
| 7 | fasthotel.ru | 2 | cargor.net |
| 7 | whiteys.co.uk | 2 | ingredientspring.com |
| 7 | smsa.pt | 2 | cthmail.de |
| 7 | granitderi.com.tr | 2 | corpstroy.ru |
| 7 | ntsysteme.de | 2 | heartwood.com |
| 7 | artisan-co.ru | 2 | na-derevnu-dedu.ru |
| 7 | mosobladvokatura.ru | 2 | swanseacity.co.uk |
| 7 | gamez.com.ua | 2 | mdou104.ru |
| 7 | sentabilisim.com | 2 | assistantinukraine.com |
| 7 | tufts.biz | 2 | wowbestservers.com |
| 6 | angelomasotti.it | 2 | arsenalyar.ru |
| 6 | tripdogs.com | 2 | velvet-sound.ru |
| 6 | ciarko.by | 2 | intimdosug38.ru |
| 6 | big-cock.biz | 2 | supertouch.co.in |
| 6 | softrace.no | 2 | chemycards.com |
| 6 | haugesund-toppidrettsgymnas.no | 2 | cebuhomesville.com |
| 6 | samedaystationery.co.uk | 2 | leaderscenter.com |
| 6 | tadaphotography.com | 2 | rolandward.co.uk |
| 6 | dyffryn.org | 2 | ignologics.com |
| 6 | hochseilgarten-springe.de | 2 | zarco-sic.com |
| 6 | bagnaradiromagna.net | 2 | etarlo.ru |
| 6 | sitallsmolensk.ru | 2 | bigpk.ru |
| 6 | humtata.de | 2 | ofis-v-nikolaeve.com |
| 6 | tiarahlds.com | 2 | ravolna.ru |
| 6 | allpress.biz | 2 | pyora68.net |
| 6 | zdrowieonly.ovh.org | 2 | poster.ua |
| 6 | webasto-ufa.ru | 2 | scottishtaxifinance.co.uk |
| 6 | custers.ru | 2 | formularmaker.com |
| 6 | hansobermeier.de | 2 | ais-stroi.ru |
| 6 | ziehdichauskunft.com | 2 | bluereefwatersports.com |
| 6 | venetamalaysia.com | 2 | fundigital.org |
| 6 | cathedralcityestates.co.uk | 2 | avminho.pt |
| 6 | paminklaizidiniai.lt | 2 | pechatiboom.ru |
| 6 | mbuhgalter.ru | 2 | filtrum-safari.ru |
| 6 | shilvi.com | 2 | aquatechperu.com |
| 6 | orderschering.com | 2 | butik-koles.ru |
| 5 | mouvsoch185.ru | 2 | visumconsulting.com |
| 5 | zenxual.com | 2 | warehouseboxing.com |
| 5 | michael-roos.net | 2 | elviras-tischdeko.de |
| 5 | easywebmexico.com | 2 | homemoney.ru |
| 5 | agapy.com | 2 | mar-kant.nl |
| 5 | marsperformance.ru | 2 | eeesolution.com |
| 5 | muzacikunovice.cz | 2 | microfi.co.uk |
| 5 | andyxator.ru | 1 | neps.ru |
| 5 | bahfuture.org | 1 | christel-gekeler.de |
| 5 | cfgb.fr | 1 | open-63.ru |
| 5 | golazvezda.ru | 1 | hardmetalunderground.com |
| 5 | mapradio.org | 1 | nickparton.com |
| 5 | therabrands.com | 1 | dieschrauba.at |
| 5 | goetzke-krottelbach.de | 1 | gardi.eu |
| 5 | paleorecip.es | 1 | vivasan-forum.ru |
| 5 | rus-futbolka.ru | 1 | aki-kowalstwo.pl |
| 5 | lcc.org.au | 1 | dotmatt.com |
| 5 | stolk.de | 1 | wesselinkgmbh.de |
| 5 | mikemetcalfe.ca | 1 | turfirma-yaroslavl.ru |
| 5 | nbvf.nl | 1 | positivelynaked.com |
| 5 | juszczyn.eu | 1 | barkersofwindsor.co.uk |
| 5 | izumrudny.org | 1 | assignmentwriting.co.uk |
| 5 | myinnerpc.com | 1 | manfred-konrad.de |
| 5 | burtonbrothers.net | 1 | frenken-adviesburo.nl |
| 5 | asesoriacontableperu.com | 1 | alumdeco.ru |
| 5 | dustycatwriter.com | 1 | pawsathome.ca |
| 5 | coolpcgames.co.uk | 1 | demonic3d.com |
| 5 | wallmountainweb.com | 1 | computing4schools.co.uk |
| 5 | airspill.com | 1 | visibus.ru |
| 5 | schweitzers.com | 1 | nazike.com |
| 5 | cond.ru | 1 | vitapool.ru |
| 5 | trimeducation.com | 1 | eventlocation-kiel.de |
| 5 | bfphotography.eu | 1 | radio-kabyle.com |
| 5 | meter-online.info | 1 | stkiliansnsmullagh.ie |
| 5 | organocontinuo.com | 1 | spentec.ca |
| 5 | damsit.com | 1 | gsp35.ru |
| 5 | ahkrc.org | 1 | shkolaimperatritsy.ru |
| 5 | tc.castinellc.com | 1 | cdrv.ru |
| 5 | muralzbyjean.com | 1 | altaicompass.com |
| 5 | gubo.com | 1 | pototype.com |
| 4 | paulhughestransport.com | 1 | line-message.net |
| 4 | koo-doo.ru | 1 | sad-natali.ru |
| 4 | louisedenson.com | 1 | gie-expo.com |
| 4 | mcmillandefense.com | 1 | lkmining.com |
| 4 | avionstudio.com | 1 | sonyfoto.com.pt |
| 4 | permanentmakeup-soest.de | 1 | schulezorneding.de |
| 4 | rogerclarkejohnson.com | 1 | angelkeeper.ru |
| 4 | solovy.ru | 1 | enlightenpro.com |
| 4 | simoneliebst.de | 1 | burim.by |
| 4 | georgysphoto.ru | 1 | pp73.ru |
| 4 | initsiativa.com | 1 | avitrade.ru |
| 4 | mephics.co.tz | 1 | centik.de |
| 4 | pax-sancta.de | 1 | nevertoolatebook.com |
| 4 | physiotherapie-kies.de | 1 | alyes.nl |
| 4 | idollighting.com | 1 | romchik.com |
| 4 | semeylib.kz | 1 | towi69.de |
| 4 | foundationforhealthaction.org | 1 | eplater.co.uk |
| 4 | ekimenko.net | 1 | intal.net.ua |
| 4 | mikroeta.lt | 1 | radio-germanija.de |
| 4 | contact.com.vn | 1 | manjitubhi.com |
| 4 | yu7.ru | 1 | carrahar.co.uk |
| 4 | srmarketers.com | 1 | arenda-t.ru |
| 4 | supercarsofmoscow.ru | 1 | torbeta.com |
| 4 | greaterbaycomputer.com | 1 | ventoz.ru |
| 1 | babysun-volga.ru |
