Android Users: Remove These Eight Apps NOW

Eight Android apps were found to contain a new malware that targeted users in Southeast Asia and the Arabian Peninsula. These apps have over 7,00,000 downloads, according to McAfee Mobile Research.

The malware found in these fake apps impersonates photo editors, wallpapers, puzzles, keyboard skins, and other camera-related apps, hijacking SMS message alerts and making unauthorised purchases.

According to the study, the apps were sent to the Google Play Store with a clean version of the software for review and then later updated with malicious code. This threat is identified as Android/Etinu by McAfee Mobile Security, which warns mobile users if it is present.

And, because of the complex code loading, the malware in these apps takes advantage of it. Malware payloads with names like "cache.bin," "settings.bin," "data.droid," or apparently harmless ".png" files appear in the assets folder associated with the app.

As per the study, "to begin, the secret malicious code in the main.apk opens the assets folder's "1.png" file, decrypts it to "loader.dex," and then loads the dropped.dex. The package name is used as the key to encrypt the "1.png." The first payload sends a POST request to the C2 server over HTTP."

Also, the malware uses key management servers and requests keys from them for the AES encrypted second payload, "2.png," according to the study. The malware also has a self-update feature, and when the “URL” value is used instead of “2.png,” the information in the URL is used.

As with the Android Joker malware, the latest malware hijacks the Notification Listener and then steals incoming SMSes.

The following are the eight applications that should be uninstalled if they are found on your Android device:

keypaper2021 (com.studio.keypaper2021)
editor camera (com.pip.editor.camera)
my favorites up keypaper (org.my.favorites.up.keypaper)
hairdryer (com.super.color.hairdryer)
celeb photo editor (com.ce1ab3.app.photo.editor)
camera pip (com.hit.camera.pip)
daynight keyboard wallpaper (com.daynight.keyboard.wallpaper)
ringtones (Com.super.star.ringtones)

The McAfee Mobile Research team continues to monitor these threats and protect customers by analyzing potential malware and working with app stores to remove them.