A new batch of 35 Android apps has been found to contain malware capable of displaying unwanted ads. The detected apps have been downloaded from the Play Store more than 2 million times. There are millions of victims who may still have them on their mobile without realizing it.
The apps were found by Bitdefender security researchers who used a real-time behavior-based analysis method to detect potentially malicious apps. Using standard tactics, apps entice users to install them by offering some functionality that interests them.
What these apps do when you download them
After installation, they change their icon and name to make it difficult to find and uninstall them, using various methods to hide themselves on Android. They could even have a gear icon and be called Settings so as not to raise suspicions. In some cases, they can masquerade as Samsung, Oppo, or Motorola system apps.
They also receive subsequent updates to make it easier for them to hide on their victims’ phones. They also feature heavy code encryption and obfuscation to thwart reverse engineering efforts. They are also hidden by excluding themselves from the Recent Apps list.
Upon installation, that is when they start to display intrusive advertisements by abusing WebView, to generate impressions and fraudulent advertising revenue for themselves. Clicking on the icon launches the malware app with size 0 to be hidden and launches the legitimate settings menu, or whatever is appropriate depending on the method of hiding they have used.
These are the malicious apps detected
In total, the security company has found several malware apps with downloads ranging from 10,000 to 100,000 downloads, with more than 2 million downloads in total.
The apps that have managed to deceive their users the most with more than 100,000 downloads are these:
- Walls of Light – Livewalls Pack (gb.packlivewalls.fournatewren)
- Big Emoji – Keyboard 5.0 (gb.blindthirty.funkeyfour)
- Great Wallpapers: 3D Backgrounds 2.0 (gb.convenientsoftfiftyreal.threeborder)
- Engine Wallpapers (gb.helectronsoftforty.comlivefour)
- Stock Wallpapers (gb.fiftysubstantiated.wallsfour)
- EffectMania – Photo Editor 2.0 (gb.actualfifty.sevenelegantvideo)
- Art Filter: Deep Photo Effect 2.0 (gb.crediblefifty.editconvincingeight)
- Fast Emoji Keyboard APK (de.eightylamocenko.editioneights)
- Create sticker for Whatsapp 2.0 (gb.convincingmomentumeightyverified.realgamequicksix)
- Math Solver – Camera Helper 2.0 (gb.labcamerathirty.mathcamera)
- Photopix Effects – Art Filter 2.0 (gb.mega.sixtyeffectcameravideo)
- LED Theme – Colorful Keyboard 2.0 (gb.theme.twentythreetheme)
- Animated Sticker Master 1.0 (am.asm.master)
- Sleep Sounds 1.0 (com.voice.sleep.sounds)
- Personality Loading Show 1.0 (com.charging.show)
- Image warping camera
- GPS Location Finder (smart.ggps.lockakt)
The complete list of apps according to their package name or unique identifier is this:
- gb.packlivewalls.fournatewren
- gb.blindthirty.funkeyfour
- gb.convenientsoftfiftyreal.tresborde
- gb.helectronsoftforty.comlivefour
- gb.fiftysubstantiated.wallsfour
- gb.actualfifty.sevenlegantvideo
- gb.crediblefifty.editconvincingeight
- by.eightylamocenko.editioneight
- gb.convincingmomentumeightyverified.realgamequicksix
- gb.labcamerathirty.mathcamera
- gb.mega.sixtyeffectcameravideo
- gb.theme.twentythreetheme
- gb.tolltwentytwo.ikey
- com.smart.tools.wifi
- jkdf.gds.gds.g
- com.newsoft.camera
- com.xmas.artgirlswallpaperhd
- hj.jk.jikj.jkj
- com.creator.smartqrcreator
- finze.lockgti.dae.cag
- kk.f.ea.tew.t
- com.xmas.girlsartwallpaper
- sc.qs.vak
- zzhse.ge.ge.ge.e
- ice.ccylice.volume
- ck.lad.secret
- smart.ggps.lockakt
- am.asm.master
- com.charging.show
- com.voice.sleep.sounds
- joao.de.def.e.aew
- ifa.nod.vys
- what.engine.astrology
- ice.ccylice.coloring
- gb.sixtycreativecyber.magiceleganttwo
What should you do if you have been infected?
Take extreme precautions. Some of these apps are still available on the Play Store , so be careful not to install them. Google will most likely get rid of them soon, though there may be more. If you have downloaded them or have any on your mobile, go to your phone’s settings, to applications, or search for it and uninstall it immediately. The most recommended thing is that you use a good antivirus for it, since they are well hidden in plain sight.
In any case, we recommend that you do not download apps that you do not need , delete them when you no longer need them, do not install the apk of apps that you are not totally sure are safe, and have an antivirus on your mobile. If an application with many downloads does not have good opinions, it is best to avoid it, since, although the Play Store is usually trustworthy, there are many apps that can sneak into it and affect many users. Do you recognize having seen any of these apps?
