On execution, RuFraud will check the country code in SIM card (figure 1&2). If matched, it will send premium-rate SMS after you click the "Next" button.  

Figure 1: Checking country code

 

Figure 2: snipped codes of checking country 

If not matched, it will run a "normal" horoscope program or try to download another APK.(figure 3) 

 

Figure 3: Try to download hxxp://91.213.175.148/app/angry.apk

The following table lists the countries were targeted and SMS number respectively.

C.C. Country
SMS Number
EE
Estonia
17013
CZ
Czech Republic
90901599
FR
France
81185
UA
Ukraine
7540
TJ
Tajikistan
1171
PL
Poland
92525
RU
Russian Federation
7781
LT
Lithuania
1645
LV
Latvia
1874
KG
Kyrgyzstan
4157
KZ
Kazakhstan
7790
IL
Israel
4545
GE
Georgia
8014
DE
Germany
80888
BY
Belarus
7781
AM
Armenia
1121
GB
Great Britain (UK)
79067
AZ
Azerbaijan
9014

 

By AegisLab