“The downloaded control data is fetched via HTTP and includes settings such as how many SMSes to send what SMS text to use where to link to and more.”Īlso, it sends itself to only five contacts now, instead of 20-presumably an anti-detection policy or, as Ducklin said, “cyber-criminal caution” after the Heart App virus’ aggressive use of SMS (it hit the first 99 contacts) raised its profile. “This time, it's using a botnet-style call-home to download data to decide what to do next, rather than having its malicious activities pre-programmed,” said Ducklin, in a blog. Now, the modus operandi and the coding structure are similar to the original, but “it's both pushier and more flexible than before,” according to Sophos Security researcher Paul Ducklin. The original version of the Selfmite bug sent itself as an SMS link to a victim’s top 20 contacts, and then pushed a third-party app for an alternative Android software market onto the mobile phone. A fresh variant of an Android virus that resembles the self-propagating email worms of the early 2000s has been discovered, which pretends to be a Google Plus app.

Android worm virus