Experts at Kaspersky have recently spotted a new Android Trojan that not only send SMSs to premium-rate numbers but also steals money from QIWI electronic wallet.
Visa QIWI Wallet is electronic payment service can be used to pay for goods and services around the world, receive payments, and transfer money.
Once installed on a device, the malware, dubbed as 'Waller', attempts to communicate with Command and control (C& C) server located at playerhome.info and awaits further commands.
Malware is capable of checking the balance of infected phone by sending SMS to mobile network operator and intercepts the reply, send SMS, open web pages, download and install other malware. It is also capable of updating itself and send SMS to victim's contact list.
This trojan also checks the balance in the QIWI Wallet by sending an SMS to 7494. The response messages is intercepted by the trojan and forwarded to the cyber criminals. If there is money in the Wallet, the malware will send message to 7494 with attacker's wallet number and the amount to be transferred.
The Trojan is being distributed via SMS spam and cybercriminal's site disguising as various applications.
