Symbian Anti-Virus Bundled with Symbian trojan

Today we received rather interesting Symbian malware sample.

SymbOS/Doomboot.G is a new variant of Doomboot family. This malware also contains a pirated version of the ExoVirusStop antivirus application.

We have seen Symbian trojans that pretend to be antivirus application from some company or another. But I believe that Doomboot.G is the first case that actually contains a fully working pirate copy.

In addition to the antivirus application, the Doomboot.G contains corrupted system binaries from Doomboot.A and empty files that have the same file name and path that the virus SymbOS/Lasco.A uses.

The goal of the virus author has probably been that user installs the ExoVirusStop and later updates the Anti-Virus to a version that detects Lasco.A. Then the user scans a his phone and gets report about Lasco.A, and with that report a request to reboot his phone. F-Secure : News from the Lab

Linked by shanmuga Tuesday, 8th November 2005 8:20AM