Pornography - A Favorite Costume For Android Malware

This report analyzes two adult-themed Android malware samples used to lure victims via porn-themed apps: (1) a Chinese SMS Trojan (package com.uryioen.lkhgonsd) that displays encoded adult URLs, collects device information and sends SMS messages to attacker-specified numbers (C&C: http://www.mscdea.com:7981); and (2) a fake ransomware/infostealer (package com.gi.to) that presents a threatening warning screen while harvesting and exfiltrating inbox messages, contacts and email addresses to a C&C (http://maturefucklist.com). The analysis includes APK download URLs, VirusTotal detection counts, code and network captures, and recommends installing apps only from trusted stores and disabling unknown sources.