Pierluigi Paganini June 29, 2014

Experts at AdaptiveMobile discovered a rare Android SMS worm dubbed Selfmite which spreads itself by sending SMS including a malicious link to the contact list.

Security researchers at AdaptiveMobile have discovered a rare Android malware dubbed Selfmite that propagates via SMS text messages, the worm in fact sends malicious links to 20 contacts present in the device owner’s address book.

Selfmite is the second malware discovered in the last months that use this propagation mechanism, security experts consider this circumstance a possible indicator of a worrying trend.

In April experts at ESET discovered a malware targeting Russian-speaking Android users, dubbed Samsapo, which abuses a person’s contact list to propagate itself to other devices.

The SMS messages sent by Selfmite have the following format:

“Dear [NAME], Look the Self-time,” followed by a shortened URL generated with goo.gl.

The malicious link points to an APK file called TheSelfTimerV1.apk, the application once installed allows the Selfmite worm to convince users to download and install a file called mobogenie_122141003.apk.

Mobogenie is a popular legitimate application that allows Android users to synchronize their devices with PCs and download apps from an alternative app store. The Mobogenie Market app was already downloaded over 50 million times from the official Google Play, but it is also proposed via different ad platforms.

“As you might have already noticed Selfmite worm uses advertising platform to redirect user to the particular version of Mobogenie app. And this particular version of Mobogenie app will ‘click’ after the installation to a certain URL with additional device parameters in order to confirm the Mobogenie app installation.

So as a result we believe that an unknown registered advertising platform user abused legal service and decided to increase the number of Mobogenie app installations using malicious software.”  is reported by AdaptiveMobile in the blog post.

The impact on users is not only have they been deceived into installing a malware and other unwanted apps, the worm can automatically send messages that victim’s will pay and it must be also considered the risk that mobile operator noticing suspect activities will block the mobile.

Experts at AdaptiveMobile have already detected dozens of devices infected with Selfmite in North America, the malicious short goo.gl URL used to spread the malicious APK was visited 2,140 times until Google disabled it.

Of course it is expected that bad actor behind Selfmite worm will create other URL in future campaigns, the good news is that experts have discovered the threat early.

As usual, it is strongly suggested to not download applications from third-party stores, it is also suggested to not allow the installation of apps from “unknown sources” using the necessary settings on the Android device.

Pierluigi Paganini

(Security Affairs –  Selfmite, malware)