A new Symbian malware detected by Trend Micro as SYMBOS_BESELO.A attempts to spread what appears to be the good stuff via Bluetooth and Multimedia Messaging Service (MMS) messages. Disguised as a picture or a multimedia file, it uses any of the following file names to spread to other mobile phones:

• beauty.jpg
• love.rm
• sex.mp3

Notice the file extensions? Do not be deceived because in reality, these are .SIS files, the typical installer files used in mobile technology. Aside from using enticing file names, the disguised file extensions help in effecting its successful installation.

Once the user unwittingly installs the malicious .SIS files, this malware drops certain files and creates several other ones. It then uses the infected phone as a launchpad for wider propagation by sending MMS messages that contain any of the mentioned innocent-looking file names. And so the cycle continues. This is a disturbing prospect given the ubiquity of mobile phone transactions in that sometimes users no longer give a second thought to entertaining messages from unknown senders.

SYMBOS_BESELO.A affects mobile phones running the Symbian/S60 2nd edition operating system, which is commonly found in the following Nokia models:

• 6600
• 6630
• 7610
• N70
• N72

It does not affect newer Nokia models, such as the Nokie E-series, N71, N73, N75, N76, N80, N91, N92, N93, N93i, N95, etc. as those phone models use Symbian 9.1/S60 3rd edition. In any case, users are advised to not accept unexpected files sent via Bluetooth, and to be careful when opening MMS messages. Mobile users with Trend Micro Mobile Security 3.0 for Symbian/S60 or 5.0 for Symbian/S60 installed are automatically protected from this malware.

Additional information provided by Todd Thiemann and Rolf Rennemo