206 Malicious Android Adware Apps Downloaded 150 Million Times from Google Play Store
SimBad, a massive adware campaign discovered in Google playstore from more than 200 malicious apps that have been downloaded by nearly 150 million times.
Most of the Infected Malicious apps are belongs to simulator games category and these apps creating extremely annoying ads and displaying outside of the app which let users difficult to uninstall once it gets installed.
Malicious SDK (software development kit) “RXDrioder” played a major role in this campaign which utilizing by attackers to displaying a higher number of ads in order to generate more revenue.
Dubbed SimBad adware campaign was not particularly targeting any country and this SDK provided by ‘addroider[.]com’ who fooled developers to use it for app development.
According to checkpoint research, The app’s perform various malicious behavior including,
- Showing ads outside of the application, for example when the user unlocks their phone or uses other apps.
- Constantly opening Google Play or 9Apps Store and redirecting to another particular application, so the developer can profit from additional installations.
- Hiding its icon from the launcher in order to prevent uninstallation.
- Opening a web browser with links provided by the app developer.
- Downloading APK files and asking the user to install it.
- Searching a word provided by the app in Google Play.
Once the Adware apps installed into the victims mobile, SimBad registers itself to make sure the installed app keeps running on the victims mobile whenever they boot or unlock the mobile.
SimBad later connect to the C&C Server in order to receive the commands from attackers to perform a various malicious operation such as removing the icon, making user harder to uninstall, pushing back round ads. “image”
According to Checkpoint, “SimBad’ has capabilities that can be divided into three groups – Show Ads, Phishing, and Exposure to other applications. With the capability to open a given URL in a browser, the actor behind ‘SimBad’ can generate phishing pages for multiple platforms and open them in a browser, thus performing spear-phishing attacks on the user.”
Observed C2 server is ‘addroider[.]com’ that is used to Parse Backend infrastructure, a model for providing web app and mobile app developers with a way to link their applications to backend cloud storage and APIs exposed by back-end applications.
This C2 server domain was registered in via GoDaddy and currently, this domain was expired 7 months ago According to RiskIQ’s PassiveTotal.
This post 206 Malicious Android Adware Apps Downloaded 150 Million Times from Google Play Store originally appeared on GB Hackers.
