Android.Xiny.19.origin: Over 60 Play Store Games Infected With Trojan
Android.Xiny.19.origin: Over 60 Play Store Games Infected With Trojan Over 60 games in Google Play Store have been found to contain a malicious Trojan according to a research conducted by researchers at Dr.Webs, a mobile antivirus maker. Infected games were found to be from different publishers but they have certain things in common– the way the apps are packaged and similar behaviors. This suggests that the games are probably from the same source.
According to the report, some of the game publishers include Conexagon Studio, Fun Color Games, BILLAPPS, and many others. When any of these games are downloaded and installed, users’ personal informal are sent to a remote server. The Trojan, Android.Xiny.19.origin, sends details such as IMEI number and MAC address, version and language of the operating system, mobile network operator name, information about accessibility of a memory card and more.
Android.Xiny.19.origin doesn’t have root access yet but the code it contains is powerful enough to root a device. It can can download exploits from its server to root the device. On devices with root access already, the Trojan can even perform worse functions. It is able to install new apps without users knowledge and delete existing ones. Android.Xiny.19.origin can also display annoying ads.
The researchers found out the the virus makers cleverly hide the malware in specially created images using a method called steganography. This makes detection little bit difficult since the malware is covertly deployed. Steganography is a way of hiding information or data within other non-secret text or data.
According to the report: Virus makers presumably decided to complicate the detection procedure expecting that security analysts would not pay attention to benign images. Upon receiving a necessary image from the server,Android.Xiny.19.origin retrieves a hidden apk file with the help of a special algorithm and then executes it.
Dr.Web explains that the information has been sent to Google but these games are still available at the Play Store at the time of this report.
According to the report, some of the game publishers include Conexagon Studio, Fun Color Games, BILLAPPS, and many others. When any of these games are downloaded and installed, users’ personal informal are sent to a remote server. The Trojan, Android.Xiny.19.origin, sends details such as IMEI number and MAC address, version and language of the operating system, mobile network operator name, information about accessibility of a memory card and more.
Android.Xiny.19.origin doesn’t have root access yet but the code it contains is powerful enough to root a device. It can can download exploits from its server to root the device. On devices with root access already, the Trojan can even perform worse functions. It is able to install new apps without users knowledge and delete existing ones. Android.Xiny.19.origin can also display annoying ads.
The researchers found out the the virus makers cleverly hide the malware in specially created images using a method called steganography. This makes detection little bit difficult since the malware is covertly deployed. Steganography is a way of hiding information or data within other non-secret text or data.
According to the report: Virus makers presumably decided to complicate the detection procedure expecting that security analysts would not pay attention to benign images. Upon receiving a necessary image from the server,Android.Xiny.19.origin retrieves a hidden apk file with the help of a special algorithm and then executes it.
Dr.Web explains that the information has been sent to Google but these games are still available at the Play Store at the time of this report.