NEWS FROM THE LAB - Thursday, October 13, 2005

New Commwarrior variant detected Posted by Jarno @ 13:59 GMT

commwarrior_c_install (45k image)

We just received a new sample of Commwarrior worm, Commwarrior.C.

The Commwarrior.C seems to function in similar manner as A and B variants, which means that is spreads over bluetooth using random file names and sends MMS messages. However as we just got the sample, the MMS message sending is not yet confirmed.

The sample that we received was posted in mobile phone forum in SIS trojan, which pretends to be pirate copied software SymCommander. So there might be people who have downloaded and installed Commwarrior.C and thus it might be in the wild, but we don't estimate it to be widespread at least yet.

F-Secure Mobile Anti-Virus detects Commwarrior.C with database update 53 that was published 13:31 GMT. So please make sure that your Anti-Virus is up to date.