So far we have seen the URLs hxxp:///tiNk1 and hxxp:///NwVk1 (both currently down) and the text “Is this your Photo?” used in the SMS spam campaigns. In addition to this payload, the malware has a mechanism to dynamically send SMS spam based on parameters provided by the control server and using the contacts stored on the device and the SIM card. The main purpose of this malware is to obtain as much money as possible from clicks on full-screen ads that appear constantly and several advertisement modules bundled inside the application. So what is this app doing in the background? If we wait for a couple of minutes, the mystery will be revealed: Does that mean that the application was uninstalled? Not really. However, if we try to execute the application again, we find that the icon in the home launcher is gone. If the recently installed application is opened, the following image related to Photo Grid appears in full-screen mode:Īnd that’s all! Apparently no other functions were implemented beyond showing these images. The icon belongs to the popular legitimate application Photo Grid, which is available on Google Play. If the application is installed, the following icon appears in the home launcher: Once the shortened URL is clicked, the file PhotoViewer.apk is downloaded. The URL included in the message is hidden using a shortening service and redirects to the control server that hosts the malicious application. The message comes from a contact who was previously infected with the malware and includes the name of the receiver to increase its credibility. Recently some people from Singapore (country code +65) have reported a new SMS spam campaign with the message “Is this your photo?” and a specific URL: For this reason one of the most effective phishing attacks is to claim that someone’s video or photo is public thus the victim cannot resist clicking on the malicious link. One of the most important concerns of Internet users is privacy.

Text spammer youtube download