Computer techologies

More than two dozen apps on Google Play contained a dangerous backdoor

Sophos experts found 22 dangerous applications in the official Google Play catalog that were installed more than 2,000,000 times in total (Sparkle Flashlight alone was downloaded over 1,000,000 times.)

Researchers They write that three malicious applications were added to the catalog as early as 2016-2017, and the rest appeared in the summer of 2018. Moreover, the malicious functionality appeared in the already mentioned Sparkle Flashlight and two more “old” applications in March of the current year, and later applications downloaded to Google Play contained a malicious code from the very beginning.

This family of Malvari was named Andr / Clickr-ad and, as is easy to understand by this identifier, mostly applications were used for background clicking All applications were launched and continued to work, even if the user tried to terminate them forcibly, while actively spending traffic and battery. So, the malware contacted the mobbt [.] com domain, from which it received modules for the advertising fraud and new instructions, every 10 minutes and 80 seconds, respectively.

To avoid suspicion and merge with the traffic of real users, the applications forged the user-agent and impersonating other products and devices, including the iPhone. Thus, the malware imitated the activity allegedly emanating from iPhone from 5 to 8 Plus, as well as 249 models from 33 manufacturers of Android devices (supposedly running Android from version 4.4.2 to 7.x). And here is Apple? The fact is that advertising on Apple devices is more expensive than on Android, Linux or Windows.

Experts point out that malware could harm not only users, but advertising networks and even the entire Android ecosystem. Worse, malicious applications were completely controlled by hackers from the management server and could at any time be used to install additional malware on the infected device.

Currently, all dangerous applications have already been removed from Google Play. Below you can see a list compiled by Sophos analysts.

Package name name Sha1
com.sparkle.flashlight Sparkle FlashLight 9ed2b260704fbae83c02f9f19a2c4e85b93082e7
com.mobilebt.snakefight Snake Attack 0dcbbae5d18c33039db726afd18df59a77761c03
com.mobilebt.mathsolver Math Solver be300a317264da8f3464314e8fdf08520e49a55b
com.mobilebt.shapesorter ShapeSorter e28658e744b2987d31f26b2dd2554d7a639ca26d
com.takatrip.android Tak A Trip 0bcd55faae22deb60dd8bd78257f724bd1f2fc89
com.magnifeye.android Magnifeye 7d80bd323e2a15233a1ac967bd2ce89ef55d3855
com.pesrepi.joinup Join Up c99d4eaeebac26e46634fcdfa0cb371a0ae46a1a
com.pesrepi.zombiekiller Zombie Killer 19532b1172627c2f6f5398cf4061cca09c760dd9
com.pesrepi.spacerocket Space Rocket 917ab70fffe133063ebef0894b3f0aa7f1a9b1b0
com.pesrepi.neonpong Neon Pong d25fb7392fab90013e80cca7148c9b4540c0ca1d
app.mobile.justflashlight Just Flashlight 6fbc546b47c79ace9f042ef9838c88ce7f9871f6
com.mobile.tablesoccer Table Soccer fea59796bbb17141947be9edc93b8d98ae789f81
com.mobile.cliffdiver Cliff Diver 4b23f37d138f57dc3a4c746060e57c305ef81ff6
com.mobile.boxstack Box Stack c64ecc468ff0a2677bf40bf25028601bef8395fc
net.kanmobi.jellyslice Jelly Slice 692b31f1cd7562d31ebd23bf78aa0465c882711d
com.maragona.akblackjack AK Blackjack 91663fcaa745b925e360dad766e50d1cc0f4f52c
com.maragona.colortiles Color Tiles 21423ec6921ae643347df5f32a239b25da7dab1b
com.beacon.animalmatch Animal Match 403c0fe a7d6fcd0e28704fccf5f19220a676bf6c
com.beacon.roulettemania Roulette Mania 8ad739a454a9f5cf02cc4fb311c2479036c36d0a
com.atry.hexafall HexaFall 751b515f8f01d4097cb3c24f686a6562a250898a
com.atry.hexablocks HexaBlocks ef94a62405372edd48993030c7f256f27ab1fa49
com.atry.pairzap PairZap 6bf67058946b74dade75f22f0032b7699ee75b9e