via Dr. Web...
Android.DDoS.1.origin
creates an application icon, similar to that of Google Play. If the
user decides to use the fake icon to access Google Play, (Google Play)
will be launched, which significantly reduces the risk of any suspicion.When launched, the Trojan tries to connect to a remote server and, if successful, it transmits the phone number of the compromised device to criminals and then waits for further SMS commands...
Activities of the Trojan can lower performance of the infected handset and affect the well-being of its owner, as access to the Internet and SMS are chargeable services. Should the device send messages to premium numbers, malicious activities will cost the user even more.
It is not quite clear yet how the Trojan spreads but most probably criminals employ social engineering tricks and disguise the malware as a legitimate application from Google. (more)
