Warning! SMS Reader Spam Dropping Trojans

Yesterday we informed you about a whole bunch of spam campaigns ascribed to the famous Waledac botnet. Today I'd like to warn everybody against a new variant of the SMS Reader spam campaign because spammers are not even considering the possibility of stopping or at least to reducing their malicious activities.

This time cyber criminals are bombarding potential victims' computers with email messages written in Russian, claiming to present the most recent version of the program called SMS Reader V4.0. Similarly to the previous spam campaign, senders of these emails prompt users to click on the provided link and download a free trial version of the program that can purportedly download SMS messages to any mobile phone anonymously and automatically.

Each message contains a URL link to, as it appears, randomly named executable file (e.g. gPGk8uD2UE.exe) which is hosted on Russian hosting servers. As the message itself is written in Russian, it seems to specifically target Russian-speaking users. However, I'd recommend that everybody be cautious of similar emails.

As you may already expect, as soon as you click on the executable file, it will download a file with a Trojan that will definitely infect your computer. The size of the file is 20454 bytes and it has MD5 104032f2a5789a2468fb47005ae256ee. As this spam campaign can have many different executable files, the size of it and its MD5 may, of course, differ from the ones provided in this article.

The following table presents all possible alias names of the Trojan downloaded by the executable called gPGk8uD2UE.exe. Since this antivirus detection information was collected on the 16th of April, there may already be new variants of this malware that are not given in the table.

Table 1.  Alias names of the Trojan

Security experts warn all users to stay alert and not to trust everything that they find in their inboxes. Spammers and other cyber-criminals are becoming more and more creative in their "advertising" schemes. We, simple users, need to be very careful and do our best to secure our computers if we don't want these criminals to gain benefits from their malicious activities. The best solution is of course to delete all unsolicited messages without even opening and reading them.