BNHMO SMS Trojan (provisional)

BNHMO SMS Trojan (provisional) is an Android SMS trojan (“Touch It Rikka”, package com.luk.vlu) that requests SEND_SMS and SYSTEM_ALERT_WINDOW and sends premium/WAP messages via SmsManager.sendTextMessage. A check-in/validation endpoint https://validate.bnhmo.com/validate is invoked from a networking worker thread (La/d0;->run), with the host recovered as a plaintext string wired into that worker (source-to-sink). The package carries a Play reference to com.modobom.game.defense (Modobom monetization network), but attribution to Modobom is not confirmed. Family label provisional.