A new report by anti-virus firm Doctor Web claims they discovered 26 cheap phones that come pre-loaded with a downloader named Android.DownLoader.473.origin. This piece of software can download benign applications but also malicious and unwanted ones, including adware. The company also discovered another preinstalled downloader dubbed Android.Sprovider.7, this one has the ability to make phone calls to certain numbers and to show ads on top of apps.
"It is known that cybercriminals generate their income by increasing application download statistics and by distributing advertising software," the security researchers wrote. "Therefore, Android.DownLoader.473.origin and Android.Sprovider.7 were incorporated into Android firmware because dishonest outsources who took part in creation of Android system images decided to make money on users."Here's an overview of affected smartphones. Probably the biggest surprise are the two Lenovo devices on the list, these contained the Android.Sprovider.7 trojan. A quick Google search of various models mostly turned up Russian sites so the odds of coming across these phones in other geographies are pretty low.
MegaFon Login 4 LTE Irbis TZ85 Irbis TX97 Irbis TZ43 Bravis NB85 Bravis NB105 SUPRA M72KG SUPRA M729G SUPRA V2N10 Pixus Touch 7.85 3G Itell K3300 General Satellite GS700 Digma Plane 9.7 3G Nomi C07000 Prestigio MultiPad Wize 3021 3G Prestigio MultiPad PMT5001 3G Optima 10.1 3G TT1040MG Marshal ME-711 7 MID Explay Imperium 8 Perfeo 9032_3G Ritmix RMD-1121 Oysters T72HM 3G Irbis tz70 Irbis tz56 Jeka JK103 Lenovo A319 Lenovo A6000
Source: ARS Technica